隐藏进程的驱动代码可以看T-ProcMon. 在2000/xp下编译通过-hidden code-driven process can be seen T-ProcMon. Under the compiler through 2000/xp

查看Windows NT/2K 中进程的执行,有参考价值-View Windows NT/2K which the implementation process, a reference value

一个监控进程创建和退出的例子，采用的是命令行监控，简单修改即可改为MFC对话框的形式。-A monitoring process creation and exit example, using the command-line monitoring, a simple modification can change the form of MFC dialog box.