check if process is running VBS, when closed log off - vbscript

Apologies i am a bit of a newbie at vbs and was wondering if i could get some help.
I want to write some vbscript to check if a process name is still running, if it is keep checking the process. If the process-name is not running log off windows.
This is what i have tried so far
set service = GetObject ("winmgmts:")
for each Process in Service.InstancesOf ("Win32_Process")
If Process.Name = "notepad.exe" False ,then
Set WshShell=WScript.CreateObject("WScript.Shell")
WshShell.run "shutdown.exe -L -F"
'wscript.echo "Notepad running"
'wscript.quit
End If
next
please let me know if you need any more information :)

This vbscript can did the trick :
Option Explicit
Dim ProcessPath,WshShell
ProcessPath = "%Windir%\System32\Notepad.exe"
Set WshShell = CreateObject("WScript.Shell")
If AppPrevInstance() Then
MsgBox "There is an existing proceeding !" & VbCrLF &_
CommandLineLike(WScript.ScriptName),VbExclamation,"There is an existing proceeding !"
WScript.Quit
Else
Do
Pause(10) ' Pause 10 seconds
If CheckProcess(DblQuote(ProcessPath)) = False Then
Call Logoff()
End If
Loop
End If
'**************************************************************************
Function CheckProcess(ProcessPath)
Dim strComputer,objWMIService,colProcesses,Tab,ProcessName
strComputer = "."
Tab = Split(ProcessPath,"\")
ProcessName = Tab(UBound(Tab))
ProcessName = Replace(ProcessName,Chr(34),"")
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcesses = objWMIService.ExecQuery _
("Select * from Win32_Process Where Name = '"& ProcessName & "'")
If colProcesses.Count = 0 Then
CheckProcess = False
Else
CheckProcess = True
End if
End Function
'**************************************************************************
Function DblQuote(Str)
DblQuote = Chr(34) & Str & Chr(34)
End Function
'**************************************************************************
Sub Logoff()
Dim ws,Command,Execution
Set ws = CreateObject("wscript.Shell")
Command = "Cmd /c shutdown.exe -L -F"
Execution = ws.run(Command,0,True)
End sub
'**************************************************************************
Sub Pause(Secs)
Wscript.Sleep(Secs * 1000)
End Sub
'**************************************************************************
Function AppPrevInstance()
With GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")
With .ExecQuery("SELECT * FROM Win32_Process WHERE CommandLine LIKE " & CommandLineLike(WScript.ScriptFullName) & _
" AND CommandLine LIKE '%WScript%' OR CommandLine LIKE '%cscript%'")
AppPrevInstance = (.Count > 1)
End With
End With
End Function
'***************************************************************************
Function CommandLineLike(ProcessPath)
ProcessPath = Replace(ProcessPath, "\", "\\")
CommandLineLike = "'%" & ProcessPath & "%'"
End Function
'****************************************************************************

Related

Start chrome with URL and kiosk mode using vbs

I want to run Chrome with parameters using VBS code, this is my program:
check if chrome process in NOT running:
if so... start Chrome with URL with kiosk mode parameters.
Set objShell = CreateObject("WScript.Shell") i = 1
strPC = "." strProfile = objShell.ExpandEnvironmentStrings("%LOCALAPPDATA%")
strPath = "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
--kiosk www.stackoverflow.com"
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strPC & "\root\cimv2")
Do While i = 1
booChrome = False
Set colProcesses = objWMIService.ExecQuery _
("Select * From Win32_Process")
For Each objItem in colProcesses
strProcessName = objItem.Caption
If strProcessName = "chrome.exe" Then booChrome = True
Next
If booChrome = False Then objShell.Run(Chr(34) & strPath & Chr(34))
WScript.Sleep 300000 Loop
This code is faild, but if i remove the parameters from URL its start Chrome well
I created and tested this vbscript on windows 10 (32 bits).
So, you should modifie it for your purpose.
Option Explicit
Dim ProcessPath,KioskMode,URL
ProcessPath = "%ProgramFiles%\Google\Chrome\Application\chrome.exe"
KioskMode = "--kiosk"
URL = "https://stackoverflow.com/questions/56458100/start-chrome-with-url-and-kiosk-mode-using-vbs"
'Exit if the script is already running.
If AppPrevInstance() Then
MsgBox "There is an existing proceeding",VbExclamation,"There is an existing proceeding"
WScript.Quit
Else
Do
Call Main(Array(ProcessPath))
Call Pause(1) 'Sleep for 1 seconde
Loop
End If
'**************************************************************************
Sub Main(colProcessPaths)
Dim ProcessPath
For Each ProcessPath In colProcessPaths
CheckProcess(ProcessPath)
Next
End Sub
'**************************************************************************
Sub CheckProcess(ProcessPath)
Dim ProcessName : ProcessName = StripProcPath(ProcessPath)
With GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")
With .ExecQuery("SELECT * FROM Win32_Process WHERE Commandline LIKE " & CommandLineLike(ProcessName))
If .Count = 0 Then
With CreateObject("WScript.Shell")
.Run DblQuote(ProcessPath) & " " & KioskMode & " " & URL
End With
Else
Exit Sub
End if
End With
End With
End Sub
'**************************************************************************
'Checks whether a script with the same name as this script is already running
Function AppPrevInstance()
With GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")
With .ExecQuery("SELECT * FROM Win32_Process WHERE CommandLine LIKE " & CommandLineLike(WScript.ScriptFullName) & _
" AND CommandLine LIKE '%WScript%' OR CommandLine LIKE '%cscript%'")
AppPrevInstance = (.Count > 1)
End With
End With
End Function
'**************************************************************************
Sub Pause(Secs)
Wscript.Sleep(Secs * 1000)
End Sub
'**************************************************************************
Function StripProcPath(ProcessPath)
Dim arrStr : arrStr = Split(ProcessPath, "\")
StripProcPath = arrStr(UBound(arrStr))
End Function
'**************************************************************************
Function CommandLineLike(ProcessPath)
ProcessPath = Replace(ProcessPath, "\", "\\")
CommandLineLike = "'%" & ProcessPath & "%'"
End Function
'**************************************************************************
'Function to add the double quotes into a variable
Function DblQuote(Str)
DblQuote = Chr(34) & Str & Chr(34)
End Function
'**************************************************************************

Can someone help me understand this code ? Infected with Trojan Dropper VBS script

I wanna say sorry first ,
This isnt probly the best place to ask things like these , but i was infected by a virus and it seems to left traces.
If someone can understand the code behind some scripts i would be very grateful.
Option Explicit
Dim ProcessPath,WshShell
ProcessPath = "%Windir%\System32\Notepad.exe"
Set WshShell = CreateObject("WScript.Shell")
If AppPrevInstance() Then
MsgBox "There is an existing proceeding !" & VbCrLF &_
CommandLineLike(WScript.ScriptName),VbExclamation,"There is an existing proceeding !"
WScript.Quit
Else
Do
Pause(10) ' Pause 10 seconds
If CheckProcess(DblQuote(ProcessPath)) = False Then
Call Logoff()
End If
Loop
End If
'**************************************************************************
Function CheckProcess(ProcessPath)
Dim strComputer,objWMIService,colProcesses,Tab,ProcessName
strComputer = "."
Tab = Split(ProcessPath,"\")
ProcessName = Tab(UBound(Tab))
ProcessName = Replace(ProcessName,Chr(34),"")
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcesses = objWMIService.ExecQuery _
("Select * from Win32_Process Where Name = '"& ProcessName & "'")
If colProcesses.Count = 0 Then
CheckProcess = False
Else
CheckProcess = True
End if
End Function
'**************************************************************************
Function DblQuote(Str)
DblQuote = Chr(34) & Str & Chr(34)
End Function
'**************************************************************************
Sub Logoff()
Dim objShell
Set objShell = WScript.CreateObject( "WScript.Shell" )
objShell.Exec("C:\Users\Sblck\AppData\Local\AppVShNotifyt.exe")
Set objShell = Nothing
Wscript.Quit
End sub
'**************************************************************************
Sub Pause(Secs)
Wscript.Sleep(Secs * 1000)
End Sub
'**************************************************************************
Function AppPrevInstance()
With GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")
With .ExecQuery("SELECT * FROM Win32_Process WHERE CommandLine LIKE " & CommandLineLike(WScript.ScriptFullName) & _
" AND CommandLine LIKE '%WScript%' OR CommandLine LIKE '%cscript%'")
AppPrevInstance = (.Count > 1)
End With
End With
End Function
'***************************************************************************
Function CommandLineLike(ProcessPath)
ProcessPath = Replace(ProcessPath, "\", "\\")
CommandLineLike = "'%" & ProcessPath & "%'"
End Function
'****************************************************************************
I hope i formated the code right , there is some other script but in a txt form , the diference is in objShell.Exec it remotes to "%working%" , like this:
objShell.Exec("%working%")^
I'm gonna post pastebin's of it if it makes it easier
AppVShNotifytvbs.vbs PasteBin link
AppVShNotifytvbs.txt Pastebin link
First, it check previous instance to see that the current script is already running using another process ID.
Then, every 10 seconds is checks if notepad is running. If it's not, it calls AppVShNotifyt.exe

How to check whether a process is running using VB script?

I have the following VB Script which opens a particular window a performs Certain functions in the window.
WScript.Sleep 10000
Set WshShell = WScript.CreateObject("WScript.Shell")
WshShell.Run "Notepad"
#perform some function
WScript.Sleep 10000
I need to repeat same code when notepad is closed so that same notepad is opened again.I tried the following code for that purpose
WScript.Sleep 10000
Set WshShell = WScript.CreateObject("WScript.Shell")
If (WshShell.AppActivate("Notepad") = False) then
ret = True
End If
Do while ret
WshShell.Run "notepad"
WScript.Sleep 100
WshShell.AppActivate "Notepad"
loop
But this code keeps on opening the notepad even if the previous notepad isn't closed.
You can try like this way :
Option Explicit
Dim ProcessPath
ProcessPath = "%Windir%\System32\Notepad.exe"
Call CheckProcess(DblQuote(ProcessPath))
'**************************************************************************
Sub CheckProcess(ProcessPath)
Dim strComputer,objWMIService,colProcesses,WshShell,Tab,ProcessName
strComputer = "."
Tab = Split(ProcessPath,"\")
ProcessName = Tab(UBound(Tab))
ProcessName = Replace(ProcessName,Chr(34),"")
'Msgbox ProcessName
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcesses = objWMIService.ExecQuery _
("Select * from Win32_Process Where Name = '"& ProcessName & "'")
If colProcesses.Count = 0 Then
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run ProcessPath
Else
Exit Sub
End if
End Sub
'**************************************************************************
Function DblQuote(Str)
DblQuote = Chr(34) & Str & Chr(34)
End Function
'**************************************************************************
Or like this way :
Option Explicit
Dim ProcessPath,WshShell
ProcessPath = "%Windir%\System32\Notepad.exe"
Set WshShell = CreateObject("WScript.Shell")
If CheckProcess(DblQuote(ProcessPath)) = False Then
WshShell.Run ProcessPath
End If
'**************************************************************************
Function CheckProcess(ProcessPath)
Dim strComputer,objWMIService,colProcesses,Tab,ProcessName
strComputer = "."
Tab = Split(ProcessPath,"\")
ProcessName = Tab(UBound(Tab))
ProcessName = Replace(ProcessName,Chr(34),"")
'Msgbox ProcessName
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcesses = objWMIService.ExecQuery _
("Select * from Win32_Process Where Name = '"& ProcessName & "'")
If colProcesses.Count = 0 Then
CheckProcess = False
Else
CheckProcess = True
End if
End Function
'**************************************************************************
Function DblQuote(Str)
DblQuote = Chr(34) & Str & Chr(34)
End Function
'**************************************************************************

vbscript how can you see if a program is open then close it

How can I use vbscript to determine if a program is running or open and, if it is, close a different program?
For example, how could I check to see if game.exe is running and, if it is, then close google.exe?
Here is an example that show you how to check a process by name and if the check is positive so it kill it.
For example i choose the Game as Calc.exe and if the script found it, it will be killed, and also for internet explorer and Google Chrome
Option Explicit
If AppPrevInstance() Then
MsgBox "There is an existing proceeding !" & VbCrLF & CommandLineLike(WScript.ScriptName),VbExclamation,"There is an existing proceeding !"
WScript.Quit
Else
Dim Game,Browser1,Browser2
Game = "%windir%\system32\calc.exe"
Browser1 = "%ProgramFiles%\Google\Chrome\Application\chrome.exe"
Browser2 = "%ProgramFiles%\Internet Explorer\iexplore.exe"
Do
Call Main(Array(Game,Browser1,Browser2))
Call Pause(1) 'Sleeping for 1 minute
Loop
End If
'**************************************************************************
Sub Main(colProcessPaths)
Dim ProcessPath
For Each ProcessPath In colProcessPaths
CheckProcess(ProcessPath)
Next
End Sub
'**************************************************************************
Sub CheckProcess(ProcessPath)
On error resume Next
Dim Process,objWMIService,colProcesses,wshShell,btn,Timeout,User
Dim ProcessName : ProcessName = StripProcPath(ProcessPath)
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\.\root\cimv2")
Set colProcesses = objWMIService.ExecQuery _
("SELECT * FROM Win32_Process WHERE Commandline LIKE " & CommandLineLike(ProcessName))
For Each Process in colProcesses
If colProcesses.Count > 0 Then
Set wshShell = CreateObject("WScript.Shell")
User = CreateObject("WScript.Network").UserName
Timeout = 30 'Call the Popup method with a 30 seconds timeout.
btn = WshShell.Popup("Hello "& DblQuote(User) & " !" & vbcr &_
"Your Administrator has requested you to log out of this application after work. " & vbcr &_
"We have detected you are still using the program : "& DblQuote(ProcessName) & vbcr &_
"Please press on cancel button if you are still at your machine ?",Timeout,"Question", vbOKCancel + vbQuestion)
Select Case btn
' Yes button pressed.
case 1
Process.Terminate(0)
' No button pressed.
case 2
Exit Sub
' Timed out.
case -1
Process.Terminate(0)
End Select
Else
Exit Sub
End if
Next
End Sub
'**************************************************************************
Function AppPrevInstance()
With GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")
With .ExecQuery("SELECT * FROM Win32_Process WHERE CommandLine LIKE " & CommandLineLike(WScript.ScriptFullName) & _
" AND CommandLine LIKE '%WScript%' OR CommandLine LIKE '%cscript%'")
AppPrevInstance = (.Count > 1)
End With
End With
End Function
'**************************************************************************
Sub Pause(Minutes)
Wscript.Sleep(Minutes*1000*60)
End Sub
'**************************************************************************
Function StripProcPath(ProcessPath)
Dim arrStr : arrStr = Split(ProcessPath, "\")
StripProcPath = arrStr(UBound(arrStr))
End Function
'**************************************************************************
Function CommandLineLike(ProcessPath)
ProcessPath = Replace(ProcessPath, "\", "\\")
CommandLineLike = "'%" & ProcessPath & "%'"
End Function
'**************************************************************************
Function DblQuote(Str)
DblQuote = Chr(34) & Str & Chr(34)
End Function
'**************************************************************************

Multiple instances of MSE7 open when I boot my computer

I am running various VBS scripts on our clients using Group Policy. On most clients this works fine. But on my computer (the one I created the scripts on), I always have multiple instances of MSE7 running after booting my computer - one for each of the VBS scripts I have deployed via Group Policy.
Can anyone help me understand why this is happening and / or how to stop it!
Thanks.
Andrew
With this script you can find any process by its commandline and choose to kill them. Just give a try !
Option Explicit
Dim Titre,Copyright,fso,ws,NomFichierLog,temp,PathNomFichierLog,OutPut,Count
If AppPrevInstance() Then
MsgBox "There is an existing proceeding !" & VbCrLF & CommandLineLike(WScript.ScriptName),VbExclamation,"There is an existing proceeding !"
WScript.Quit
Else
Copyright = "[© Hackoo © 2015 ]"
Set fso = CreateObject("Scripting.FileSystemObject")
Set ws = CreateObject( "Wscript.Shell" )
NomFichierLog="Killed_Process.txt"
temp = ws.ExpandEnvironmentStrings("%temp%")
PathNomFichierLog = temp & "\" & NomFichierLog
Set OutPut = fso.CreateTextFile(temp & "\" & NomFichierLog,1)
Call Find("wscript.exe")
Call Explorer(PathNomFichierLog)
End If
'***************************************************************************************************
Function Explorer(File)
Dim ws
Set ws = CreateObject("wscript.shell")
ws.run "Explorer "& File & "\",1,True
end Function
'***************************************************************************************************
Sub Find(MyProcess)
Dim colItems,objItem,Processus,Question
Titre = " Process "& DblQuote(MyProcess) &" running "
Set colItems = GetObject("winmgmts:").ExecQuery("Select * from Win32_Process " _
& "Where Name like '%"& MyProcess &"%' AND NOT commandline like " & CommandLineLike(WScript.ScriptFullName) & "",,48)
Count = 0
For Each objItem in colItems
Count= Count + 1
Processus = objItem.CommandLine
Question = MsgBox ("Would do you like to kill this script : " & DblQuote(Processus) & " ?" ,VBYesNO+VbQuestion,Titre+Copyright)
If Question = VbYes then
objItem.Terminate(0)'To kill the process
OutPut.WriteLine Processus
else
Count= Count - 1 'decrementing the count of -1
End if
Next
OutPut.WriteLine String(100,"*")
OutPut.WriteLine count & Titre & "were killed"
OutPut.WriteLine String(100,"*") & VbCrLF
End Sub
'**************************************************************************
Function DblQuote(Str)
DblQuote = Chr(34) & Str & Chr(34)
End Function
'**************************************************************************
Function AppPrevInstance()
With GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")
With .ExecQuery("SELECT * FROM Win32_Process WHERE CommandLine LIKE " & CommandLineLike(WScript.ScriptFullName) & _
" AND CommandLine LIKE '%WScript%' OR CommandLine LIKE '%cscript%'")
AppPrevInstance = (.Count > 1)
End With
End With
End Function
'**************************************************************************
Function CommandLineLike(ProcessPath)
ProcessPath = Replace(ProcessPath, "\", "\\")
CommandLineLike = "'%" & ProcessPath & "%'"
End Function
'**************************************************************************

Resources