Trapping Process starts using WMI

[=?Utf-8?B?Um9i?=]

I've a requirement to monitor when certain applications are started. I'm
using WMI called from VS Stusio 2005 in VB to trap Excel and Word starting.
I've written the following console application which wires up 4 events to
trap Excel/Word Start/Stop events. The application works fine for Excel but
Word behaves strangely. When I start an instance of Word I get the correct
message displayed in the console. When I start a second instance of Word I
get the Stop event fired (rather then the Start) - the console looks like
this
after the second instance is started - ie an immediate stop event and stop
message.

press <enterto stop...
Application=Wor d, Start, Parent Process Id=324, Process Id=4776
Application=Wor d, Start, Parent Process Id=324, Process Id=5236
Application=Wor d, Stop, Parent Process Id=324, Process Id=5236

any help appreciated. The code is attached.
thanks

Imports System
Imports System.Manageme nt

Module TaskMonitor

Dim Applications As New ApplicationColl ection

Dim WordStartWatche r As ManagementEvent Watcher
Dim WordStopWatcher As ManagementEvent Watcher
Dim ExcelStartWatch er As ManagementEvent Watcher
Dim ExcelStopWatche r As ManagementEvent Watcher

Sub Main()

StartWatching()

Console.WriteLi ne("press <enterto stop...")
Console.ReadLin e()

StopWatching()

End Sub

Private Sub StartWatching()

WordStartWatche r = New
ManagementEvent Watcher(Generat eStartQuery("WI NWORD.EXE"))
AddHandler WordStartWatche r.EventArrived, AddressOf WordStarted
WordStartWatche r.Start()

WordStopWatcher = New
ManagementEvent Watcher(Generat eStopQuery("WIN WORD.EXE"))
AddHandler WordStopWatcher .EventArrived, AddressOf WordStopped
WordStopWatcher .Start()

ExcelStartWatch er = New
ManagementEvent Watcher(Generat eStartQuery("EX CEL.EXE"))
AddHandler ExcelStartWatch er.EventArrived , AddressOf ExcelStarted
ExcelStartWatch er.Start()

ExcelStopWatche r = New
ManagementEvent Watcher(Generat eStopQuery("EXC EL.EXE"))
AddHandler ExcelStopWatche r.EventArrived, AddressOf ExcelStopped
ExcelStopWatche r.Start()

End Sub

Private Sub StopWatching()

WordStartWatche r.Stop()
RemoveHandler WordStartWatche r.EventArrived, AddressOf WordStarted
WordStartWatche r = Nothing

WordStopWatcher .Stop()
RemoveHandler WordStopWatcher .EventArrived, AddressOf WordStopped
WordStopWatcher = Nothing

ExcelStartWatch er.Stop()
RemoveHandler ExcelStartWatch er.EventArrived , AddressOf ExcelStarted
ExcelStartWatch er = Nothing

ExcelStopWatche r.Stop()
RemoveHandler ExcelStopWatche r.EventArrived, AddressOf ExcelStopped
ExcelStopWatche r = Nothing

End Sub

Public Sub WordStarted(ByV al sender As Object, ByVal e As
EventArrivedEve ntArgs)

Applications.Ad d(e.NewEvent.Pr operties("Proce ssID").Value, New
Word(e.NewEvent .Properties("Pa rentProcessID") .Value,
e.NewEvent.Prop erties("Process ID").Value))
Console.WriteLi ne(String.Conca t("Application= Word, Start, Parent
Process Id=", e.NewEvent.Prop erties("ParentP rocessID").Valu e.ToString, ",
Process Id=", e.NewEvent.Prop erties("Process ID").Value.ToSt ring))

End Sub

Public Sub WordStopped(ByV al sender As Object, ByVal e As
EventArrivedEve ntArgs)

If
Applications.Co ntainsKey(e.New Event.Propertie s("ProcessID"). Value) Then
Applications.Re move(e.NewEvent .Properties("Pr ocessID").Value )
End If

Console.WriteLi ne(String.Conca t("Application= Word, Stop, Parent
Process Id=", e.NewEvent.Prop erties("ParentP rocessID").Valu e.ToString, ",
Process Id=", e.NewEvent.Prop erties("Process ID").Value.ToSt ring))

End Sub

Public Sub ExcelStarted(By Val sender As Object, ByVal e As
EventArrivedEve ntArgs)

Applications.Ad d(e.NewEvent.Pr operties("Proce ssID").Value, New
Word(e.NewEvent .Properties("Pa rentProcessID") .Value,
e.NewEvent.Prop erties("Process ID").Value))
Console.WriteLi ne(String.Conca t("Application= Excel, Start, Parent
Process Id=", e.NewEvent.Prop erties("ParentP rocessID").Valu e.ToString, ",
Process Id=", e.NewEvent.Prop erties("Process ID").Value.ToSt ring))

End Sub

Public Sub ExcelStopped(By Val sender As Object, ByVal e As
EventArrivedEve ntArgs)

If
Applications.Co ntainsKey(e.New Event.Propertie s("ProcessID"). Value) Then
Applications.Re move(e.NewEvent .Properties("Pr ocessID").Value )
End If

Console.WriteLi ne(String.Conca t("Application= Excel, Stop, Parent
Process Id=", e.NewEvent.Prop erties("ParentP rocessID").Valu e.ToString, ",
Process Id=", e.NewEvent.Prop erties("Process ID").Value.ToSt ring))

End Sub

Private Function GenerateStartQu ery(ByVal ProcessName As String) As
WqlEventQuery
Dim ApplicationStar tQuery As New WqlEventQuery
ApplicationStar tQuery.EventCla ssName = "Win32_ProcessS tartTrace"
ApplicationStar tQuery.QueryStr ing = String.Concat(" SELECT * FROM
Win32_ProcessSt artTrace where ProcessName = ", """", ProcessName, """")
Return ApplicationStar tQuery
End Function

Private Function GenerateStopQue ry(ByVal ProcessName As String) As
WqlEventQuery
Dim ApplicationStop Query As New WqlEventQuery
ApplicationStop Query.EventClas sName = "Win32_ProcessS topTrace"
ApplicationStop Query.QueryStri ng = String.Concat(" SELECT * FROM
Win32_ProcessSt opTrace where ProcessName = ", """", ProcessName, """")
Return ApplicationStop Query
End Function

End Module