Imports System.Management

Public Class Form1

    Dim WithEvents ProcessStartWatcher As New ManagementEventWatcher(New WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"))
    Dim WithEvents ProcessStopWatcher As New ManagementEventWatcher(New WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace"))

    Private Sub Form1_Load(sender As Object, e As System.EventArgs) Handles MyBase.Load
        ProcessStartWatcher.Start()
        ProcessStopWatcher.Start()
    End Sub

    Private Sub Form1_FormClosing(sender As Object, e As System.Windows.Forms.FormClosingEventArgs)
        ProcessStartWatcher.Stop()
        ProcessStopWatcher.Stop()
    End Sub

    Private Sub ProcessStartWatcher_EventArrived(sender As Object, e As System.Management.EventArrivedEventArgs) Handles ProcessStartWatcher.EventArrived
        Dim ProcessName As String = e.NewEvent.Properties("ProcessName").Value
        Dim PID As Integer = e.NewEvent.Properties("ProcessID").Value

        MessageBox.Show(String.Format("Process ""{0}"" with ID {1} started.", ProcessName, PID))
    End Sub

    Private Sub ProcessStopWatcher_EventArrived(sender As Object, e As System.Management.EventArrivedEventArgs) Handles ProcessStopWatcher.EventArrived
        Dim ProcessName As String = e.NewEvent.Properties("ProcessName").Value
        Dim PID As Integer = e.NewEvent.Properties("ProcessID").Value

        MessageBox.Show(String.Format("Process ""{0}"" with ID {1} stopped.", ProcessName, PID))
    End Sub
End Class

Const PollingInterval As Double = 2.0 'Seconds.

Dim WithEvents ProcessStartWatcher As New ManagementEventWatcher(New WqlEventQuery("SELECT * FROM __InstanceCreationEvent WITHIN " & PollingInterval & " WHERE TargetInstance ISA 'Win32_Process'"))
Dim WithEvents ProcessStopWatcher As New ManagementEventWatcher(New WqlEventQuery("SELECT * FROM __InstanceDeletionEvent WITHIN " & PollingInterval & " WHERE TargetInstance ISA 'Win32_Process'"))

(...)

Private Sub ProcessStartWatcher_EventArrived(sender As Object, e As System.Management.EventArrivedEventArgs) Handles ProcessStartWatcher.EventArrived
    Dim ProcessName As String = CType(e("TargetInstance"), ManagementBaseObject)("Name")
    Dim PID As Integer = CType(e("TargetInstance"), ManagementBaseObject)("ProcessId")

    MessageBox.Show(String.Format("Process ""{0}"" with ID {1} started.", ProcessName, PID))
End Sub

Private Sub ProcessStopWatcher_EventArrived(sender As Object, e As System.Management.EventArrivedEventArgs) Handles ProcessStopWatcher.EventArrived
    Dim ProcessName As String = CType(e("TargetInstance"), ManagementBaseObject)("Name")
    Dim PID As Integer = CType(e("TargetInstance"), ManagementBaseObject)("ProcessId")

    MessageBox.Show(String.Format("Process ""{0}"" with ID {1} stopped.", ProcessName, PID))
End Sub