Process Monitor

[DumbAndDumber]

Use WMI for this. A quick Google for "wmi process events" returned this as the top hit:
http://weblogs.asp.net/whaggard/arch...11/438006.aspx

It's in C#, but can be converted to vb.net using online conversion tools. Or if you search enough, you should be able to find a vb.net version of it.

well, this is the output:

Imports System
Imports System.ComponentModel
Imports System.Collections
Imports System.Globalization
Imports System.Management
 
Namespace WMI.Win32
    Public delegate void ProcessEventHandler(Win32_Process proc)
    Public Class ProcessWatcher
     Inherits ManagementEventWatcher
        ' Process Events
        Public event ProcessEventHandler ProcessCreated
        Public event ProcessEventHandler ProcessDeleted
        Public event ProcessEventHandler ProcessModified
 
        ' WMI WQL process query strings
        Shared ReadOnly String WMI_OPER_EVENT_QUERY = "SELECT Property FROM() As *
        End Property
__InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA "Win32_Process"c"
        static readonly String WMI_OPER_EVENT_QUERY_WITH_PROC =
            WMI_OPER_EVENT_QUERY + " and TargetInstance.Name = '{0}'"
 
        Public  Sub New()
            Init(String.Empty)
        End Sub
        Public  Sub New(ByVal processName As String)
            Init(processName)
        End Sub
        Private  Sub Init(ByVal processName As String)
            Me.Query.QueryLanguage = "WQL"
            If String.IsNullOrEmpty(processName) Then
                Me.Query.QueryString = WMI_OPER_EVENT_QUERY
            Else 
                Me.Query.QueryString =
                    String.Format(WMI_OPER_EVENT_QUERY_WITH_PROC, processName)
            End If
 
            Me.EventArrived += New EventArrivedEventHandler(watcher_EventArrived)
        End Sub
        Private  Sub watcher_EventArrived(ByVal sender As Object, ByVal e As EventArrivedEventArgs)
            Dim eventType As String =  e.NewEvent.ClassPath.ClassName 
            Win32_Process proc = New 
                Win32_Process(e.NewEvent("TargetInstance") as ManagementBaseObject)
 
            Select Case eventType
                Case "__InstanceCreationEvent"
                    If Not ProcessCreated Is Nothing Then
                         Dim break As ProcessCreated(proc)
                    End If
                Case "__InstanceDeletionEvent"
                    If Not ProcessDeleted Is Nothing Then
                         Dim break As ProcessDeleted(proc)
                    End If
                Case "__InstanceModificationEvent"
                    If Not ProcessModified Is Nothing Then
                         Dim break As ProcessModified(proc)
                    End If
            End Select
        End Sub
    End Class
 
    ' Auto-Generated running: mgmtclassgen Win32_Process /n root\cimv2 /o WMI.Win32
    ' Renaming the class from Process to Win32_Process
    Public Class Win32_Process
         ...
    End Class
End Namespace
 
' Sample Usage
Dim procWatcher As ProcessWatcher =  New ProcessWatcher("notepad.exe") 
procWatcher.ProcessCreated += New ProcessEventHandler(procWatcher_ProcessCreated)
procWatcher.ProcessDeleted += New ProcessEventHandler(procWatcher_ProcessDeleted)
procWatcher.ProcessModified += New ProcessEventHandler(procWatcher_ProcessModified)
procWatcher.Start()
 
' Do Work
 
procWatcher.Stop()

which obviously isn't going to work