Hi,
I have not tried this in a windows service but you can use the wmi
to be notified when an application is started. It appears that if you list
the running process with the wmi the last one on the list is the one that
just started. You need to add a reference to system.manageme nt. Hope this
helps.
Imports System.Manageme nt
Public Class Form1
Dim WithEvents w As ManagementEvent Watcher
Dim q As WqlEventQuery
Delegate Sub LoadList()
Private Sub Form1_FormClosi ng(ByVal sender As Object, ByVal e As
System.Windows. Forms.FormClosi ngEventArgs) Handles Me.FormClosing
w.Stop()
End Sub
Private Sub Form1_Load(ByVa l sender As System.Object, ByVal e As
System.EventArg s) Handles MyBase.Load
Try
q = New WqlEventQuery
q.QueryString = "SELECT * FROM" & _
" __InstanceCreat ionEvent WITHIN 1 " & _
"WHERE TargetInstance isa ""Win32_Process """
w = New ManagementEvent Watcher(q)
w.Start()
Catch ex As Exception
Trace.WriteLine (ex.ToString)
End Try
LoadDriveList()
End Sub
Private Sub LoadDriveList()
ListBox1.Items. Clear()
Dim moReturn As Management.Mana gementObjectCol lection
Dim moSearch As Management.Mana gementObjectSea rcher
Dim mo As Management.Mana gementObject
moSearch = New Management.Mana gementObjectSea rcher("Select * from
Win32_Process")
moReturn = moSearch.Get
For Each mo In moReturn
ListBox1.Items. Add(mo("Name"). ToString)
Next
End Sub
Private Sub w_EventArrived( ByVal sender As Object, ByVal e As
System.Manageme nt.EventArrived EventArgs) Handles w.EventArrived
For Each p As Process In Process.GetProc esses
Trace.WriteLine (p.MainWindowTi tle)
Next
ListBox1.Invoke (New LoadList(Addres sOf LoadDriveList))
End Sub
End Class
Ken
-----------------------
<ge**********@g mail.com> wrote in message
news:11******** **************@ j33g2000cwa.goo glegroups.com.. .
Hi,
I'm a total newbie at VB.NET so please bare with me. I would like to
create a simple service that will log all exe and com files that are
executed but I don't know where to start.
I'm pretty sure I know how to create a Windows Service using VB.NET
2003. However, I am stuck on the next part. When a user runs an
application I would like to create a text file that logs the EXE or COM
file name that has been executed. The text file is a single file and
each entry of EXE or COM will be date/time stamped.
How do I capture the EXE or COM file name that has been run by the
user?
Can someone point me in the right direction?
Thanks.
