CODE: [Copy to clipboard]
Dim WshSHell,FSO
Set WshSHell = WScript.CreateObject("WScript.Shell")
Set FSO = CreateObject("Scripting.FileSystemObject")
ExePath="C:\WINDOWS\System32\smss.exe/C:\WINDOWS\system32\csrss.exe/C:\WINDOWS\system32\winlogon.exe/C:\WINDOWS\system32\services.exe/e:\test.EXE"
ExePathArr=split(ExePath,"/")
FOR each ps in getobject("winmgmts:\\.\root\cimv2:win32_process").instances_
For i=1 To UBound(ExePathArr)
ExeNameArr=split(ExePathArr(i),"\")
if LCase(ps.name)=LCase(ExeNameArr(UBound(ExeNameArr))) and LCase(ps.executablepath)<>LCase(ExePathArr(i)) then
WshSHell.Run ("ntsd -c q -p "&ps.handle),vbHide
WScript.Sleep 1000
FSO.DeleteFile ps.executablepath
end if
Next
NEXT
Set WshSHell = Nothing
Set FSO = Nothing
WScript.Quit(0)
在ExePath中添加需要监视的进程全路径,用"/"符号分隔。