none
Help with WMI eventing RRS feed

  • Question

  • Hello all. I am testing Wbem but Im having a problem that I hope you can help me to solve. The below code will execute the vbscipt as soon as I open calc.exe. I want to make it so that as soon as I put the .mof file into system32\wbem\mof, the vbscript will be executed automatically. Can anyone help me please? Sorry Im a new to scripting and programing in general so an example of the working code will be great. 

    #pragma namespace ("\\\\.\\root\\subscription")
    
    instance of ActiveScriptEventConsumer as $Cons
    {
        Name = "ASEC";
        ScriptingEngine = "VBScript";
        ScriptText =
            "Dim objFS, objFile\n"
            "Set objFS = CreateObject(\"Scripting.FileSystemObject\")\n"
            "Set objFile = objFS.OpenTextFile(\"C:\\ASEC.log\","
            " 8, true)\nobjFile.WriteLine \"Time: \" & Now & \";"
            " Entry made by: ASEC\"\nobjFile.WriteLine"
            " \"Application closed. UserModeTime:  \" & "
            "TargetEvent.TargetInstance.UserModeTime &_\n"
            "\"; KernelModeTime: \" & "
            "TargetEvent.TargetInstance.KernelModeTime "
            "& \" [hundreds of nanoseconds]\"\n"
            "objFile.Close\n";
    };
    
    instance of __EventFilter as $Filt
    {
        Name = "EF";
        Query = "SELECT * FROM __InstanceDeletionEvent WITHIN 5 "
            "WHERE TargetInstance ISA \"Win32_Process\" "
            "AND TargetInstance.Name = \"calc.exe\"";
        QueryLanguage = "WQL";
        EventNamespace = "root\\cimv2";
    };
    
    instance of __FilterToConsumerBinding
    {
        Filter = $Filt;
        Consumer = $Cons;
    };


    Wednesday, May 16, 2012 8:17 PM