<ei********@gmail.comwrote in message
news:11**********************@q75g2000hsh.googlegr oups.com...
Hi all .
I want to know when new process has added\loaded, i looked for system
event but i could not find any.
Is there any way to do it ?
I'm writing in c#.NET.
(Process Added meand that new process added to the task manager)
Using System.Management anamespace classes and the WMI class Win32_ProcessStartTrace, you
can trace process creation events.
Note that you need to run as administrator for this to work :-(
Here is a small sample to get you started....
....
WqlEventQuery q = new WqlEventQuery( "Win32_ProcessStartTrace");
using(ManagementEventWatcher w = new ManagementEventWatcher(q)){
w.EventArrived += new EventArrivedEventHandler(ProcessStartEventArrived) ;
w.Start();
Console.ReadLine(); // block main thread for test purposes
w.Stop();
}
}
static void ProcessStartEventArrived(object sender, EventArrivedEventArgs e) {
//Get the Event object and display it's properties
foreach(PropertyData pd in e.NewEvent.Properties)
Console.WriteLine("{0} : {1}",pd.Name, pd.Value);
}
....
Willy.