Question

Is there any way to get some Windows event when new application(s) gets added into memory/taskbar?
I can get running applications by iterating through Process.GetProcesses() (although, explorer processes will be excluded for some reason), but that means that I have to check for new processes every few seconds which isn’t very good.
I was wondering if there’s any interrupt that I can receive in C# application and then call the function to read the processes?

Any code samples would be great.
Thanks.

Answer 1

WMI Events can alert you when a new process is created. Depending on the event you may have to poll. Using the Win32_ProcessStartTrace class you don’t have to poll. New events are raised as events in your code. Below is an example (Add System.Management as a reference in your project)

public System.Management.ManagementEventWatcher mgmtWtch;
private delegate void ListBoxItemAdd(string Item);

public Form1()
{
    InitializeComponent();
    mgmtWtch = new System.Management.ManagementEventWatcher("Select * From Win32_ProcessStartTrace");
    mgmtWtch.EventArrived += new System.Management.EventArrivedEventHandler(mgmtWtch_EventArrived);
    mgmtWtch.Start();
}

    void AddItem(string Item)
    {
        if (lwProcesses.InvokeRequired)
            lwProcesses.Invoke(new ListBoxItemAdd(AddItem), Item);
        else
            lwProcesses.Items.Add(Item);
    }

    void mgmtWtch_EventArrived(object sender, System.Management.EventArrivedEventArgs e)
    {
        //MessageBox.Show((string)e.NewEvent["ProcessName"]);
        foreach (Process p in Process.GetProcesses("."))
        {
            string Title = p.MainWindowTitle;
            if (Title.Length > 0) AddItem(Title);
        }

    }

private void Form1_FormClosing(object sender, FormClosingEventArgs e)
{
    mgmtWtch.Stop();
}