Monitor for system deletion events (VBS)

'Create some Global variables; Change these as you need
Dim sIEPath : sIEPath = "C:\Program Files\Internet Explorer\iexplore.exe"
Dim sIEProcessName : sIEProcessName = "iexplore.exe"


'Create the WMI object and connect to the localhost
Dim oWMI : Set oWMI = GetObject("winmgmts://./root/cimv2")

'Create a callback method name that the events will be raised at
Dim myEventSink : Set myEventSink = WScript.CreateObject("WbemScripting.SWbemSink","ProcessDeletion_")

'Start the async operation and send the event results to the "ProcessDeletion_OnObjectReady" event callback method
oWMI.ExecNotificationQueryAsync myEventSink, "SELECT * FROM __InstanceDeletionEvent  WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'"


'Have to keep the script alive
While(true)
    wscript.sleep 1000
WEnd


'''<summary>A call back for events raised by the ExecNotificationQueryAsync method</summary>
'''<param name="oObject">An SWbemObject object</param>
'''<param name="oAsyncContext">An SWbemNamedValueSet object that is passed to the original asynchronous call</param>
'''<remarks>This method needs to be 'Public' in order to be called from the ExecNotificationQueryAsync method</remarks>
Public Sub ProcessDeletion_OnObjectReady(ByRef oObject, ByRef oAsyncContext)
    Dim bResult

    bResult = CheckProcess(".", sIEProcessName)

    If Not(bResult) Then
        Call CreateProcess(".", sIEPath)
    End If
End Sub


'''<summary>Checks to see if a process exists</summary>
'''<param name="sComputer">The local or remote endpoint to connect to</param>
'''<param name="sParam">Name of process that you want to find</param>
'''<returns>A boolean value if the processes exists</returns>
Private Function CheckProcess(ByVal sComputer, ByVal sParam)
    On Error Resume Next

    Dim oWMI : Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!//" & sComputer & "/root/cimv2")
    Dim sQuery : sQuery = "SELECT * FROM Win32_Process WHERE Name='" & sParam & "'"
    Dim bResult : bResult = True
    Dim oProcessCollection

    Set oProcessCollection = oWMI.ExecQuery(sQuery)

    If oProcessCollection.Count = 0 Then
        bResult = False
    End If

    CheckProcess = bResult
End Function


'''<summary>Starts a process</summary>
'''<param name="sComputer">The local or remote endpoint to connect to</param>
'''<param name="sParam">Path to the process you want to start</param>
'''<returns>Process ID of the process created</returns>
Private Function CreateProcess(ByVal sComputer, ByVal sParam)
    Dim oWMI : Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!//" & sComputer & "/root/cimv2")
    Dim oProcess : Set oProcess = oWMI.Get("Win32_Process")
    Dim iProcessID

    oProcess.Create sParam, Null, , iProcessID

    CreateProcess = iProcessID
End Function