bei neuem prozess ereignis aufrufen

[Motzi]

Ich muss mich korrigieren... Win32_ProcessStartTrace gibt es doch erst ab XP, aber es gibt eine andere Möglichkeit (ebenfalls per WMI):

Delphi-Quellcode:

type
  TForm1 = class(TForm)
    procedure FormCreate(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
    aSink     : TSWbemSink;
    aLocator  : TSWbemLocator;
    aServices : SWbemServices;
    procedure ProcessCreated(Sender: TObject; var objWbemObject, objWbemAsyncContext: OleVariant);
  end;



procedure TForm1.FormCreate(Sender: TObject);
begin
  aLocator := TSWbemLocator.Create(Self);
  aServices := aLocator.ConnectServer('', 'root\cimv2', '', '', '', '', 0, nil); // connect to the local computer

  aSink := TSWbemSink.Create(Self); // sink-objects are used for asynchronous method-calls
  aSink.OnObjectReady := ProcessCreated;

  aServices.ExecNotificationQueryAsync(aSink.DefaultInterface,
      'SELECT * FROM __InstanceCreationEvent within 0.1 WHERE TargetInstance ISA "Win32_Process"',
      'WQL', 0, nil, nil); // every creation of a Win32_Proces-Object should be notified
end;

procedure TForm1.ProcessCreated(Sender: TObject; var objWbemObject, objWbemAsyncContext: OleVariant);
begin
  ShowMessage('ProcessCreated');
end;

Vorraussetzung ist wie gesagt die importierte TypeLibrary "Microsoft WMI Scripting"...