Set objSWbemLocator = CreateObject("WbemScripting.SWbemLocator")
Set objSWbemServices = objSWbemLocator.ConnectServer()
Set objSWbemSink = Wscript.CreateObject("WbemScripting.SWbemSink", "Sink_")

Set objSWbemNamedValueSet01 = CreateObject("WbemScripting.SWbemNamedValueSet")
objSWbemNamedValueSet01.Add "Process.Name", "svchost.exe"

Set objSWbemNamedValueSet02 = CreateObject("WbemScripting.SWbemNamedValueSet")
objSWbemNamedValueSet02.Add "Process.Name", "System"

strWQL = "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'"
strWQL01 = "SELECT * FROM Win32_Process WHERE Name = 'svchost.exe'"
strWQL02 = "SELECT * FROM Win32_Process WHERE Name = 'System'"

'objSWbemServices.ExecNotificationQueryAsync objSWbemSink, strWQL
objSWbemServices.ExecQueryAsync objSWbemSink, strWQL01,,,,objSWbemNamedValueSet01
objSWbemServices.ExecQueryAsync objSWbemSink, strWQL02,,,,objSWbemNamedValueSet02

Do
    Wscript.Sleep 1000
    Msgbox "??"
Loop

Sub Sink_OnObjectReady(objSWbemObject, objSWbemNamedValueSet)
    Msgbox "Sink_OnObjectReady" & vbCrLf & _
           objSWbemObject.Handle & vbCrLf & _
           objSWbemNamedValueSet.Item("Process.Name").Value
    objSWbemSink.Cancel()
    Set objSWbemSink = Nothing
    Wscript.Quit
    Msgbox "?"
End Sub  

Sub Sink_OnCompleted(iHResult, objSWbemLastError, objSWbemNamedValueSet)
    Msgbox "Sink_OnCompleted" & vbCrLf & _
           "iHResult：" & iHResult & vbCrLf & _
           objSWbemNamedValueSet.Item("Process.Name").Value
    'Msgbox IsObject(objSWbemLastError)    '.GetObjectText_
End Sub
复制代码

' Create an object sink
set oSink = WScript.CreateObject("wbemscripting.swbemsink","sink_")
' Connect to WMI and the cimv2 namespace, and obtain
' an SWbemServices object
set oSvc = GetObject("winmgmts:root\cimv2")

bdone = false
' Query for all Win32_Process objects
osvc.ExecQueryAsync oSink, "SELECT Name FROM Win32_Process"
' Wait until all instances are returned. 
' The bdone flag prevents the script from exiting until
' the sink.OnCompleted subroutine is executed when
' all the objects are returned.
while not bdone    
    wscript.sleep 1000
wend

' The sink subroutine to handle the OnObjectReady 
' event. This is called as each object returns.
sub sink_OnObjectReady(oInst, octx)
    WScript.Echo "Got Instance: " & oInst.Name
end sub
' The sink subroutine to handle the OnCompleted event.
' This is called when all the objects are returned. 
' The oErr parameter obtains an SWbemLastError object,
' if available from the provider.
sub sink_OnCompleted(HResult, oErr, oCtx)
    WScript.Echo "ExecQueryAsync completed"
    bdone = true
end sub
复制代码

Set objSWbemLocator = CreateObject("WbemScripting.SWbemLocator")
Set objSWbemServices = objSWbemLocator.ConnectServer()
Set objSWbemSink = Wscript.CreateObject("WbemScripting.SWbemSink", "Sink_")

Set objSWbemNamedValueSet01 = CreateObject("WbemScripting.SWbemNamedValueSet")
objSWbemNamedValueSet01.Add "ExecQueryAsync", "strWQL01"

Set objSWbemNamedValueSet02 = CreateObject("WbemScripting.SWbemNamedValueSet")
objSWbemNamedValueSet02.Add "ExecQueryAsync", "strWQL02"

strWQL = "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'"
strWQL01 = "SELECT * FROM Win32_Process WHERE Name = 'svchost.exe'"
strWQL02 = "SELECT * FROM Win32_Process WHERE Name = 'System'"

'objSWbemServices.ExecNotificationQueryAsync objSWbemSink, strWQL
objSWbemServices.ExecQueryAsync objSWbemSink, strWQL01,,,,objSWbemNamedValueSet01
objSWbemServices.ExecQueryAsync objSWbemSink, strWQL02,,,,objSWbemNamedValueSet02

bdone = True
Do While bdone
    Wscript.Sleep 1000
Loop

Sub Sink_OnObjectReady(objSWbemObject, objSWbemNamedValueSet)
    Msgbox "Sink_OnObjectReady" & vbCrLf & _
           objSWbemObject.Handle & vbCrLf & _
           objSWbemNamedValueSet.Item("ExecQueryAsync").Value
    objSWbemSink.Cancel()
    Set objSWbemSink = Nothing
    bdone = False
End Sub  

Sub Sink_OnCompleted(iHResult, objSWbemLastError, objSWbemNamedValueSet)
    Msgbox "Sink_OnCompleted" & vbCrLf & _
           "iHResult：" & iHResult & vbCrLf & _
           objSWbemNamedValueSet.Item("Process.Name").Value
    'Msgbox objSWbemLastError.GetObjectText_
End Sub
复制代码

Set objSWbemLocator = CreateObject("WbemScripting.SWbemLocator")
Set objSWbemServices = objSWbemLocator.ConnectServer()
Set objSWbemSink = Wscript.CreateObject("WbemScripting.SWbemSink", "Sink_")

Set objSWbemNamedValueSet01 = CreateObject("WbemScripting.SWbemNamedValueSet")
objSWbemNamedValueSet01.Add "ExecQueryAsync", "strWQL01"

Set objSWbemNamedValueSet02 = CreateObject("WbemScripting.SWbemNamedValueSet")
objSWbemNamedValueSet02.Add "ExecQueryAsync", "strWQL02"

strWQL = "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'"
strWQL01 = "SELECT * FROM Win32_Process WHERE Name = 'svchost.exe'"
strWQL02 = "SELECT * FROM Win32_Process WHERE Name = 'System'"

'objSWbemServices.ExecNotificationQueryAsync objSWbemSink, strWQL
objSWbemServices.ExecQueryAsync objSWbemSink, strWQL01,,,,objSWbemNamedValueSet01
objSWbemServices.ExecQueryAsync objSWbemSink, strWQL02,,,,objSWbemNamedValueSet02

bdone = True
Do While bdone
    Wscript.Sleep 1000
Loop

Sub Sink_OnObjectReady(objSWbemObject, objSWbemNamedValueSet)
    Msgbox "Sink_OnObjectReady" & vbCrLf & _
           objSWbemObject.Handle & vbCrLf & _
           objSWbemNamedValueSet.Item("ExecQueryAsync").Value
    'objSWbemSink.Cancel()
    'Set objSWbemSink = Nothing
    bdone = False
End Sub  

Sub Sink_OnCompleted(iHResult, objSWbemLastError, objSWbemNamedValueSet)
    Msgbox "Sink_OnCompleted" & vbCrLf & _
           "iHResult：" & iHResult & vbCrLf & _
           objSWbemNamedValueSet.Item("ExecQueryAsync").Value
    'Msgbox objSWbemLastError.GetObjectText_
End Sub
复制代码