Traps process deletion events and calculates time processes ran. It uses the SWbemDateTime object of the WMI Scripting API, which is available only on Windows XP and Windows Server 2003. Press Ctrl+C to end script.

Visual Basic
Edit|Remove
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colMonitorProcess = objWMIService.ExecNotificationQuery _
 ("SELECT * FROM __InstanceDeletionEvent " _ 
 & " WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'")
WScript.Echo "Waiting for process to stop ..."
Do
  Set objLatestEvent = colMonitorProcess.NextEvent
  Set objDateTime = CreateObject("WbemScripting.SWbemDateTime")
  Wscript.Echo vbCrLf & "Process Name: " & objLatestEvent.TargetInstance.Name
  Wscript.Echo "Process ID: " & objLatestEvent.TargetInstance.ProcessId
  objDateTime.Value = objLatestEvent.TargetInstance.CreationDate
  Wscript.Echo "Time created: " & objDateTime.GetVarDate
  WScript.Echo "Time deleted: " & Now
  intSeconds = DateDiff("s", objDateTime.GetVarDate, Now)
  WScript.Echo "Duration: " & intSeconds & " seconds"
Loop