WMI Events can alert you when a new process is created. Depending on the event you may have to poll. Using the Win32_ProcessStartTrace class you don't have to poll. New events are raised as events in your code. Below is an example (Add System.Management as a reference in your project)
public System.Management.ManagementEventWatcher mgmtWtch;
private delegate void ListBoxItemAdd(string Item);
public Form1()
{
InitializeComponent();
mgmtWtch = new System.Management.ManagementEventWatcher("Select * From Win32_ProcessStartTrace");
mgmtWtch.EventArrived += new System.Management.EventArrivedEventHandler(mgmtWtch_EventArrived);
mgmtWtch.Start();
}
void AddItem(string Item)
{
if (lwProcesses.InvokeRequired)
lwProcesses.Invoke(new ListBoxItemAdd(AddItem), Item);
else
lwProcesses.Items.Add(Item);
}
void mgmtWtch_EventArrived(object sender, System.Management.EventArrivedEventArgs e)
{
//MessageBox.Show((string)e.NewEvent["ProcessName"]);
foreach (Process p in Process.GetProcesses("."))
{
string Title = p.MainWindowTitle;
if (Title.Length > 0) AddItem(Title);
}
}
private void Form1_FormClosing(object sender, FormClosingEventArgs e)
{
mgmtWtch.Stop();
}