oSvc := ComObjGet("winmgmts:")
ComObjConnect(createSink := ComObjCreate("WbemScripting.SWbemSink"), "ProcessCreate_")
ComObjConnect(deleteSink := ComObjCreate("WbemScripting.SWbemSink"), "ProcessDelete_")
Command := "WITHIN 0.5 WHERE TargetInstance ISA 'Win32_Process'"
oSvc.ExecNotificationQueryAsync(createSink, "SELECT * FROM __InstanceCreationEvent " Command)
oSvc.ExecNotificationQueryAsync(deleteSink, "SELECT * FROM __InstanceDeletionEvent " Command)Появляется такая особенность, что PIDы процессов перестают ре-использоваться и начинают расти как на дрожжах: после всего пары дней аптайма системы PIDы становятся по 40000-60000, а если аптайм неделя или больше, то значения PIDов доходят до миллионов и выше.
]]>#SingleInstance Force
#Persistent
#NoEnv
SetBatchLines -1
oSvc := ComObjGet("winmgmts:")
ComObjConnect(createSink := ComObjCreate("WbemScripting.SWbemSink"), "ProcessCreate_")
Command := "Within 0.1 Where TargetInstance ISA 'Win32_Process'"
oSvc.ExecNotificationQueryAsync(createSink, "select * from __InstanceCreationEvent " Command)
Return
ProcessCreate_OnObjectReady(obj) {
Process := obj.TargetInstance
If (Process.Name != "CefSharp.BrowserSubprocess.exe")
Return
Query := "SELECT * FROM Win32_Process WHERE Name = 'CefSharp.BrowserSubprocess.exe' AND ParentProcessID = "
. Process.ParentProcessID " AND ProcessID != " Process.ProcessID
For Proc In ComObjGet("winmgmts:").ExecQuery(Query)
Proc.Terminate()
}
#SingleInstance Force
#Persistent
#NoEnv
SetBatchLines -1
oSvc := ComObjGet("winmgmts:")
ComObjConnect(deleteSink := ComObjCreate("WbemScripting.SWbemSink"), "ProcessDelete_")
Command := "Within 0.1 Where TargetInstance ISA 'Win32_Process'"
oSvc.ExecNotificationQueryAsync(deleteSink, "select * from __InstanceDeletionEvent " Command)
Return
ProcessDelete_OnObjectReady(obj) {
Process := obj.TargetInstance
If (Process.Name != "Krutub.exe")
Return
Query := "SELECT * FROM Win32_Process WHERE Name = 'CefSharp.BrowserSubprocess.exe' AND ParentProcessID = " Process.ProcessID
For Proc In ComObjGet("winmgmts:").ExecQuery(Query)
Proc.Terminate()
}