View difference between Paste ID: 4H2pQTuG and pfmBgQhR

 'I got this code from this post:
 'http://www.petri.co.il/forums/showthread.php?t=53689
 
 option explicit
 
 Const PROCESS      = "EWBIC.exe"
 Const MEM_LIMIT_KB = 511999
 Const SERVICE_NAME = "IC Service" '! make sure to use the service name here not the displayname of the service
 
 Dim objSWbemObject, strComputer
 Dim objSWbemServices, objSWbemEventSource
 Dim objProcess, iPID, iMem
 
 strComputer = "."
 
 Set objSWbemServices = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" _
    & strComputer & "\root\cimv2")
 
 ' Enable the SeDebugPrivilege privilege to terminate
 ' processes running under a different security context.
 objSWbemServices.Security_.ImpersonationLevel = 3
 objSWbemServices.Security_.privileges. _
    addasstring "SeDebugPrivilege", True
 
 Set objSWbemEventSource = objSWbemServices.ExecNotificationQuery( _
    "SELECT * FROM __InstanceModificationEvent WITHIN 60 Where (" & _
    "TargetInstance ISA 'Win32_Process' AND " & _
    "TargetInstance.Name='" & PROCESS & "' AND " & _
    "TargetInstance.WorkingSetSize > " & MEM_LIMIT_KB *1024 & ")")
 
 On Error Resume Next
 Do: Set objSWbemObject = objSWbemEventSource.NextEvent()
 
    Select Case objSWbemObject.TargetInstance.Path_.Class
 
      Case "Win32_Process"
        wscript.sleep 10000 ' wait 10 seconds then re-check mem usage by this process
 
        For Each objProcess in getobject("winmgmts://").instancesof(_
          "Win32_Process Where Name = '" & PROCESS & "' AND WorkingSetSize > " & MEM_LIMIT_KB *1024)
          iPID = objProcess.Processid
          iMem = objProcess.WorkingSetSize /1024
 
          objProcess.Terminate()  ' optional
 
          call notifyMe (iPID, iMem)
 
          ' stop/start service (do not use its displayname here)
          With objSWbemServices.Get("Win32_Service.Name='"  & SERVICE_NAME & "'")
            .StopService()
            wscript.sleep 10000 ' wait 10 seconds
            .StartService()
            wscript.sleep 10000 ' wait 10 seconds
          End With
        Next
 
    End Select
 
 Loop
 
 Sub notifyMe (PID, Mem)
 
    With CreateObject("WScript.Shell")
      .popup PROCESS & " [ID " & PID & "] terminated " _
        & "because its memory usage was: " & Mem & " kb", _
        5, strComputer & " Event", 0+64
    End With
 
 End Sub