利用WMI监视进程的创建

Private Sub StartMonitorCreateProcessEvent()

Set CreateProcessEvent = New SWbemSink

Set objSWbemServices = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")

objSWbemServices.ExecNotificationQueryAsync CreateProcessEvent, \"SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA Win32_Process \"

End Sub