0

I have a WQL query as follows that lists all the running processes of my system.

ExecQuery(
        bstr_t("WQL"), 
        bstr_t("SELECT * " 
            "FROM  Win32_Process"), 
        WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, 
        NULL,
        &pEnumerator);

Now how should I write a WQL query to get notification on process creation and termination using C++. I tried "SELECT * FROM __InstanceCreationEvent", "SELECT * FROM Win32_ProcessStartTrace",etc.. But it didnot work. Please help.

Jackzz
  • 1,417
  • 4
  • 24
  • 53

0 Answers0