Option Explicit Dim strComputer strComputer = "." '±âº» Object °¡Á®¿À±â Dim Shell : Set Shell = WScript.CreateObject("WScript.Shell") Dim FSO : Set FSO = CreateObject("Scripting.FileSystemObject") Dim objWMIService : Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") Dim colMonitorCreateProcessesEvent : Set colMonitorCreateProcessesEvent = objWMIService.ExecNotificationQuery("select * from __InstanceCreationEvent within 1 where TargetInstance isa 'Win32_Process'" ) Dim colMonitorDeleteProcessesEvent : Set colMonitorDeleteProcessesEvent = objWMIService.ExecNotificationQuery("select * from __InstanceDeletionEvent within 1 where TargetInstance isa 'Win32_Process'" ) 'CMD À©µµ¿ì 98¿¡¼­µµ Àû¿ë °¡´ÉÇÏ°Ô COMSPECÀ¸·Î °¡Á®¿Â´Ù. Dim COMSPEC : COMSPEC = Shell.ExpandEnvironmentStrings("%comspec%") '¸ÞÀÎ ÇÔ¼ö ½ÇÇà Call MainFunction() Sub MainFunction 'Áߺ¹ ½ÇÇà ¹æÁö ÄÚµå - vbs ÆÄÀϸíÀ» ÀÔ·ÂÇÕ´Ï´Ù. If( IsExistSameVBS( "ProcessEvent.vbs" ) ) Then Wscript.Quit End If Do While True Call ProcessCreatedEvent() Call ProcessDeletedEvent() Wscript.Sleep( 1000 ) Loop Wscript.Quit End Sub Sub ProcessCreatedEvent 'ÇÁ·Î¼¼½º ½ÃÀ۽à '¸ð´ÏÅ͸µÇÒ ÇÁ·Î¼¼½º À̸§ Dim strMonitorProcessName : strMonitorProcessName = "notepad.exe" '½ÇÇàÇÒ ÆÄÀÏ Dim strExecuteFilePath : strExecuteFilePath = "C:\Windows\system32" Dim strExecuteFileName : strExecuteFileName = "calc.exe" 'ÇÁ·Î¼¼½º ½ÃÀÛ À̺¥Æ® °Ë»ç Dim objLastestProcess : Set objLastestProcess = colMonitorCreateProcessesEvent.NextEvent If( StrComp(Lcase(objLastestProcess.TargetInstance.Name), Lcase(strMonitorProcessName), 1 ) = 0 ) Then 'ÇÁ·Î±×·¥ ½ÇÇà Call ExecuteOnce( strExecuteFilePath, strExecuteFileName, "" ) End If End Sub Sub ProcessDeletedEvent 'ÇÁ·Î¼¼½º Á¾·á½Ã '¸ð´ÏÅ͸µÇÒ ÇÁ·Î¼¼½º À̸§ Dim strMonitorProcessName : strMonitorProcessName = "Notepad.exe" 'Á¾·áÇÒ ÇÁ·Î¼¼½º À̸§ Dim strKillProcessName : strKillProcessName = "calc.exe" 'ÇÁ·Î¼¼½º Á¾·á À̺¥Æ® °Ë»ç Dim objLastestProcess : Set objLastestProcess = colMonitorDeleteProcessesEvent.NextEvent If( StrComp(Lcase(objLastestProcess.TargetInstance.Name), Lcase(strMonitorProcessName), 1) = 0 ) Then 'ÇÁ·Î¼¼½º Á¾·á Call KillProcess( strKillProcessName ) End If End Sub Sub ExecuteFile (strFileFullPath, Arguments) If( FSO.FileExists( strFileFullPath ) ) Then Shell.Run COMSPEC & " /c " & strFileFullPath & Arguments & " & Exit", 0 Else Shell.Popup strFileFullPath & " À»(¸¦) ãÀ» ¼ö ¾ø½À´Ï´Ù.", 3, "File Dose not exist", 48 Wscript.Quit End If End Sub Function IsExistProcess( strProcessName ) IsExistProcess = False Dim colProcessList, objProcess Set colProcessList = objWMIService.ExecQuery( "select * from Win32_Process" ) For Each objProcess in colProcessList If( StrComp(Lcase(strProcessName), Lcase(objProcess.Name), 1) = 0 ) Then IsExistProcess = True End If Next End Function Sub ExecuteOnce( strFilePath, strFileName, Arguments ) If( IsExistProcess( strFileName ) = False ) Then Call ExecuteFile( strFilePath & "\" & strFileName, Arguments ) Wscript.Sleep 2000 End If End Sub Sub KillProcess( strProcessName ) Dim colProcessList, objProcess Set colProcessList = objWMIService.ExecQuery( "select * from Win32_Process" ) For Each objProcess in colProcessList If( StrComp(Lcase(strProcessName), Lcase(objProcess.Name), 1) = 0 ) Then objProcess.Terminate() End If Next End Sub Function IsExistSameVBS( strFileName ) IsExistSameVBS = False Dim nSameVBSCount : nSameVBSCount = 0 Dim colProcessList, objProcess Set colProcessList = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE Name = 'wscript.exe' OR Name = 'cscript.exe'") For Each objProcess in colProcessList If InStr( Lcase(objProcess.CommandLine), Lcase(strFileName) ) Then nSameVBSCount = nSameVBSCount + 1 End If Next If( nSameVBSCount > 1 ) Then IsExistSameVBS = True Wscript.echo strFileName & " Àº ÀÌ¹Ì ½ÇÇàÁßÀÎ ½ºÅ©¸³Æ® ÀÔ´Ï´Ù." End If End Function