WMI event handler

[DantanaSwat]

It dont wanna work
The idea
Upon a new xdb file being created in the c:\program files\Symantec Antivirus folder I want it to delete all folders in the c:\program file\symantec antivirus\I2_LDVP.VDB folder

strComputer = "virus server"

Dim objWMIService, strComputer, colMonitiredEvents, objLatestEvent, objEmail, colDataFila
Set objWMIService = GetObject("winmgmts:\\" & _
strComputer & "\root\cimv2")

Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
("SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE " _
& "Targetinstance ISA 'CIM_DirectoryContainsFile' and " _
& "TargetInstance.GroupComponent = " _
& "'Win32_Directory.Name=""c:\\\\Program Files\\\\Symantec AntiVirus\\\\""'" _
& " and TargetInstance.PartComponent = 'CIM_DataFile.extension = ""xdb""'")

Do While True
Set objLatestEvent = colMonitoredEvents.NextEvent
WScript.Echo objLatestEvent.TargetInstance.PartComponent
Set objEmail = CreateObject("CDO.Message")
objEmail.From = "xxx@xxx.xxx"
objEmail.To = "xxx@xxx.xxx"
objEmail.Subject = "Virus server got a file"
objEmail.Textbody = objLatestEvent.TargetInstance.PartComponent
objEmail.Send


Set colFolders = objWMIService.ExecQuery _
("SELECT * FROM Win32_Directory WHERE Name = 'c:\\Progam Files\\Symantec AntiVirus\\I2_LDVP.VDB'")
For Each objFolder in colFolders
objFolder.Delete
Next


Loop

 

[mrmovie]

what part doesnt work?
your script appears to have a number of functions. which functions have you tested standalone and work? which functions have you tested standalone and dont work?

for instance is the .NetEvent working?

 

[DantanaSwat]

Specifically its the first part...If I drop out the & " and TargetInstance.PartComponent = 'CIM_DataFile.extension = ""xdb""'") the query works great and it e-mails me with the file name. When I try to filter it down to only e-mail and delete the folders when a file with an xdb extension it says invalid query

 

[tsuji]

DantanaSwat,

I don't think your query string will ever work. Do not set conditional directly on cim_datafile. Try this.

strComputer = "virus server"

Dim objWMIService, strComputer, colMonitiredEvents, objLatestEvent, objEmail, colDataFila
Set objWMIService = GetObject("winmgmts:\\" & _
        strComputer & "\root\cimv2")

Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
    ("SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE " _
        & "Targetinstance ISA 'CIM_DirectoryContainsFile' and " _
            & "TargetInstance.GroupComponent = " _
                & "'Win32_Directory.Name=""c:\\\\Program Files\\\\Symantec AntiVirus""'")

Do While True
    Set objLatestEvent = colMonitoredEvents.NextEvent
    WScript.Echo objLatestEvent.TargetInstance.PartComponent
    sext=objWMIService.get(objLatestEvent.TargetInstance.PartComponent).properties_("extension")
    if strcomp(sext,"xdb",1)=0 then
        Set objEmail = CreateObject("CDO.Message")
objEmail.From = "xxx@xxx.xxx"
        objEmail.To = "xxx@xxx.xxx"
        objEmail.Subject = "Virus server got a file"
        objEmail.Textbody = objLatestEvent.TargetInstance.PartComponent
        objEmail.Send
        set objEmail=nothing

        Set colFolders = objWMIService.ExecQuery _
 ("SELECT * FROM Win32_Directory WHERE Name = 'c:\\Progam Files\\Symantec AntiVirus\\I2_LDVP.VDB'")
        For Each objFolder in colFolders
            objFolder.Delete
        Next
        set colFolders=nothing
        'exit do    'if you don't want to monitor anymore
    end if
Loop

regards - tsuji

 

[DantanaSwat]

Works like a charm..thanks