Never mind, found the answer myself after many search in msdn.microsoft.com
thanks anyway.
thanks anyway.
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colProcesses = objWMIService.ExecNotificationQuery("SELECT * FROM __InstanceCreationEvent WITHIN 2 WHERE TargetInstance ISA 'Win32_Process'")
Do
Set objNewProcess = colProcesses.NextEvent
If objNewProcess.TargetInstance.Name = "WINWORD.EXE" THEN
Do While ObjNewProcess Is Open
'Do something
Loop
End If
Loop
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colProcess = objWMIService.ExecNotificationQuery("SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'notepad.exe'")
Set objNewProcess = colProcess.NextEvent
'Do something