I'm writing a script that will stay resident and react when a batch file is ran. I've got it to perform the desired functionality when running. The problem is, when I terminate the process wscript.exe) on WinXP one of the svchost.exe processes start chewing away at additional memory. It continues like that until I kill that process
as well. If I do not kill it it will slowly consume the page file and crash the system.

I assume it has something to do with the WMI events, that the loop that captures the events continues unchecked after the wscript host process ends. Although without control it just continues to accumulate the events in memory. But, that is only a guess as I am not all that familiar with scripting within WMI.

Here is an example of the script.

-------------Start Code------------------

strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
("select * from __InstanceOperationEvent " _
& " within 1 where TargetInstance isa 'Win32_Process'")


Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objOutFile = objFSO.OpenTextFile("c:\scripting\log.txt", 8, True)

Do While TRUE
Set objEventObject = colMonitoredEvents.NextEvent()

Select Case objEventObject.Path_.Class
Case "__InstanceCreationEvent"
If InStr(objEventObject.TargetInstance.CommandLine, ".cmd") Or _
InStr(objEventObject.TargetInstance.CommandLine, ".bat") Or _
InStr(objEventObject.TargetInstance.CommandLine, ".CMD")Or _
InStr(objEventObject.TargetInstance.CommandLine, ".BAT")Then
objOutFile.WriteLine "Time: " & Now & Chr(34) & "Batch File Started: " & _
objEventObject.TargetInstance.CommandLine
End If

Case "__InstanceDeletionEvent"
If InStr(objEventObject.TargetInstance.CommandLine, ".cmd") Or _
InStr(objEventObject.TargetInstance.CommandLine, ".bat") Or _
InStr(objEventObject.TargetInstance.CommandLine, ".CMD")Or _
InStr(objEventObject.TargetInstance.CommandLine, ".BAT")Then
objOutFile.WriteLine "Time: " & Now & Chr(34) & "Batch File Ended: " & _
objEventObject.TargetInstance.CommandLine
End If

End Select
Loop
-------------End Code------------------

I have been able to reproduce this issue on three other WinXP systems.

Here are the sources i used to create the script.

http://www.microsoft.com/technet/sc...
http://www.microsoft.com/technet/sc...
http://www.microsoft.com/technet/sc...
http://www.microsoft.com/technet/sc...

Using process explorer I determined the problem is in wmisvc.dll. Once the wscript process is ended and svchost starts chewing up RAM I can pause that dll and the RAM usage stops.

I Googled wmisvc.dll and found this kb article...

http://support.microsoft.com/kb/838884

Unfortunately this doesn't seem to apply to my version (5.1.2600.2180).

I'm at a loss. If anyone has a suggestion on either how I can update this script of create an alternative to accomplish my goal, it would be much appreciated.

Thank you!

Chad