Windows event to add a new application to memory

Question

Is there a way to get any Windows event when new applications are added to the memory / taskbar?
I can run applications iterating through Process.GetProcesses () (although, for some reason, research processes will be excluded), but this means that I have to check new processes every few seconds, which is not very good. I was wondering if there is an interrupt that I can get in a C # application and then call a function to read processes?

Any code examples would be great.
Thanks.

Answer 1

WMI events may alert you to a new process. Depending on the event you may have to poll. Using the Win32_ProcessStartTrace class, you do not need to poll. New events occur as events in your code. The following is an example (add System.Management as a link to your project)

public System.Management.ManagementEventWatcher mgmtWtch; private delegate void ListBoxItemAdd(string Item); public Form1() { InitializeComponent(); mgmtWtch = new System.Management.ManagementEventWatcher("Select * From Win32_ProcessStartTrace"); mgmtWtch.EventArrived += new System.Management.EventArrivedEventHandler(mgmtWtch_EventArrived); mgmtWtch.Start(); } void AddItem(string Item) { if (lwProcesses.InvokeRequired) lwProcesses.Invoke(new ListBoxItemAdd(AddItem), Item); else lwProcesses.Items.Add(Item); } void mgmtWtch_EventArrived(object sender, System.Management.EventArrivedEventArgs e) { //MessageBox.Show((string)e.NewEvent["ProcessName"]); foreach (Process p in Process.GetProcesses(".")) { string Title = p.MainWindowTitle; if (Title.Length > 0) AddItem(Title); } } private void Form1_FormClosing(object sender, FormClosingEventArgs e) { mgmtWtch.Stop(); } 

Answer 2

WMI is one approach. If you do not realize the idea after changing the code in C # through P / invoke, as indicated in

http://www.codeproject.com/KB/threads/procmon.aspx

Good luck.

Answer 3

Of course (no WMI needed), just use your own creation events)

Answer 4

This can help. Since tnis is connected to connecting to the NT level (NtCreateFile () and NtOpenFile () or NtCreateSection ()), I suspect that Managed C ++ is the way to go.