Processes

[cycomcorp]

I want to make a program that monitors all the process running in the background, and notifies the user if a new process has been started. I also don't want to take up a lot of memory doing it. Can someone help please?

 

[jmcilhinney]

If you want to notify the user then it sounds like you want a Windows Forms app that runs in the system tray rather than a Service, which has no user interface. To create an app that shows an icon in the system tray you simply add a NotifyIcon to your form and set its Visible property to true. You will probably want set the WindowState of your form to Minimized and the ShowInTaskbar property to False so that the only evidence of your app is the system tray icon. You can attach a ContextMenu to the NotifyIcon to allow the user to interact. You should probably at least supply an Exit option. You can also add a Restore option if you want to be able to show the main window.

To monitor processes you will probably have to use the Process class. It can be used to get a list of running processes. As for detecting changes, I'm not sure there are any events you can use to be notified immediately, but you should investigate yourself. I'd say your options would be to use a timer to check periodically to see whether the process list has changed, or perhaps there may be API calls you could use to intercept certain messages to provide immediate notification.

As for notifying the user, you have several options. You can popup a MessageBox, although the user would have to dismiss it and they might find that intrusive. You could also try something fancy like Outlook 2003's new mail notification. This would actually be relatively easy using a timer and the Form's Opacity property. A simple and elegant, as well as commonly used, option would be for your system tray icon to provide a balloon tip, which is the yellow, speech-balloon-type message that ZoneAlarm and many other apps use. Hans Blomme has extended the NotifyIcon component to support balloon tips. It works just like a regular NotifyIcon in all other respects. Get it here, although this page has no information about what you are downloading. Get to that page from here by following the NotifyIcon XP link.

 

[vitoto]

WMI and Win32_ProcessStartTrace

Hi, use WMI and Win32_ProcessStartTrace

http://www.vbdotnetforums.com/attachment.php?attachmentid=430&d=1135639929

Dim q As New EventQuery("SELECT * FROM Win32_ProcessStartTrace")
WithEvents w As New ManagementEventWatcher(q)
Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
'start subscribing to the WMI event
w.Start()
End Sub
Private Sub Form1_FormClosing(ByVal sender As Object, ByVal e As System.Windows.Forms.FormClosingEventArgs) Handles Me.FormClosing
'stop subscribing to the WMI event
w.Stop()
End Sub
Private Sub ProcStartEventArrived(ByVal sender As Object, ByVal e As EventArrivedEventArgs) Handles w.EventArrived
'Get the Event object and display it, this will list all properties and values of the Win32_ProcessStartTrace for each process started
For Each pd As PropertyData In e.NewEvent.Properties
TextBox1.Text += pd.Name & " " & pd.Value & Environment.NewLine
Next
End Sub​

​