strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" _
    & strComputer & "\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery _
    ("SELECT * FROM Win32_NTLogEvent " _
    & "WHERE Logfile = 'System'")
For Each objEvent In colLoggedEvents
  If InStr(objEvent.Message, "Сообщение от ") >  0  Then
    str = str & objEvent.Message & vbCrLf
  End If
Next

Set fso = CreateObject("Scripting.FileSystemObject")
Set f = fso.CreateTextFile("c:\MyPopUpLog.txt", True)
f.Write str
f.Close

Wscript.Echo "The END"