even if you can identify a process by not looking at its filename (ie internal name, original name, or some kind of signatures like crc2, etc) you will still have a problem in terms of performance, as far as i know. because constant polling for running applications may cause a lot overhead to the system.

i think what you need is a "notification/event" from the system that an application has started, somekind of a "hook" which i guess is not for .Net world.