In general, I don't like polling solutions: most of the time, it's a waste of CPU time. Using events is often a better.

However, in this special case the only non-polling solution [seems to be WMI](http://stackoverflow.com/questions/848618/net-events-for-process-executable-start), and I'm not sure whether that's faster at all...