一道难题（给好的方案者包给100分）

[fazhu]

我在程序中设了两个timer(timer1,timer2),我用timer1来每隔1秒来监视是否有新的应用程序在远行。如有就激活timer2。
请问这样才能捕获windows新建的应用程序。是那个api函数、返回值是啥？

[lxcc]

我知道SPY++有这个功能，具体实现，我觉得可以参考一下SPY++的参考说明

[cd_dragon]

用FindWindow：
The FindWindow function retrieves the handle to the top-level window whose class name and window name match the specified strings. This function does not search child windows.

Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long

?lpClassName
Points to a null-terminated string that specifies the class name or is an atom that identifies the class-name string. If this parameter is an atom, it must be a global atom created by a previous call to the GlobalAddAtom function. The atom, a 16-bit value, must be placed in the low-order word of lpClassName; the high-order word must be zero.

?lpWindowName
Points to a null-terminated string that specifies the window name (the window抯 title). If this parameter is NULL, all window names match.

希望对你有用

[niuzhenjun]

1.首先得到当前所有运行的程序，保存到数组A。
2.timer1再次捕获当前所有运行的程序，保存到数组B，两次比较。
3.如相同重复运行2；不同将B赋值给A，同时激活timer2；

捕获所有运行的程序建如下代码：你只需将Debug.Print hProcess, ModuleName 存到数组内就行，至于比较，嘿嘿，你会。

注：要使用以下程序，首先新建一个EXE工程，然后粘贴代码到窗体中即可。
Private Declare Function CloseHandle Lib "Kernel32.dll" _
(ByVal Handle As Long) As Long
Private Declare Function OpenProcess Lib "Kernel32.dll" _
(ByVal dwDesiredAccessas As Long, ByVal bInheritHandle As Long, _
ByVal dwProcId As Long) As Long
Private Declare Function EnumProcesses Lib "psapi.dll" _
(ByRef lpidProcess As Long, ByVal cb As Long, _
ByRef cbNeeded As Long) As Long
Private Declare Function GetModuleFileNameExA Lib "psapi.dll" _
(ByVal hProcess As Long, ByVal hModule As Long, _
ByVal ModuleName As String, ByVal nSize As Long) As Long
Private Declare Function EnumProcessModules Lib "psapi.dll" _
(ByVal hProcess As Long, ByRef lphModule As Long, _
ByVal cb As Long, ByRef cbNeeded As Long) As Long

Const PROCESS_QUERY_INFORMATION = &H400
Const PROCESS_VM_READ = &H10



Private Sub Form_Load()
Dim cb As Long
Dim cbNeeded As Long
Dim NumElements As Long
Dim ProcessIDs() As Long
Dim cbNeeded2 As Long
Dim NumElements2 As Long
Dim Modules(1 To 255) As Long
Dim lRet As Long
Dim ModuleName As String
Dim nSize As Long
Dim hProcess As Long
Dim i As Long
cb = 8
cbNeeded = 96

‘取得所有的进程数，并设置缓冲区的大小
Do While cb <= cbNeeded
cb = cb * 2

‘在以下这句中，《Hardcore Visual Basic》一书写成ReDim aProcesses(0 To (cRequest
‘/ 4) - 1) As Long，不明白他为什么要这么写？我最初的调试不成功，后来把减1
‘去掉后就成功了^^
ReDim ProcessIDs(cb / 4) As Long
lRet = EnumProcesses(ProcessIDs(1), cb, cbNeeded)
Loop
NumElements = cbNeeded / 4

‘取得进程数
For i = 1 To NumElements

’取得一个进程的句柄
‘使用OpenProcess函数打开句柄，其中的两个常量在winnt.h中可以找到相应的声明。
hProcess = OpenProcess(PROCESS_QUERY_INFORMATION _
Or PROCESS_VM_READ, 0, ProcessIDs(i))

’如果句柄有效，则
If hProcess <> 0 Then
’取得一个指定句柄的module
‘注：以下这一句中我觉得《Hardcore Visual Basic》一书中的作者有个很大的错
‘误：在MSDN中对module参数的解释明明是array to receive the module handles，
‘但是他在这里却使用了一个普通变量？何解？真不知道他当初是怎么调试成功
‘的，所以我在这里使用了数组传递，实践证明我的判断是对得！：）
lRet = EnumProcessModules(hProcess, Modules(1), 255, _
cbNeeded2)

’如果模式有效，则取得它得文件名
If lRet <> 0 Then

‘按照我刚才说的，给他一个最大的空间！
ModuleName = Space(255)
nSize = 255
lRet = GetModuleFileNameExA(hProcess, Modules(1), _
ModuleName, 255)

Debug.Print hProcess, ModuleName’在立即窗口中列出找到的进程和文件！

End If
End If

’最后一步，别忘记关闭句柄
lRet = CloseHandle(hProcess)
Next
End Sub