Re: How to monitor file is executed by user or program in window

Antivirus applications use kernel space drivers to do their thing, don't
expect to do this kind of thing from user space. Take a look at my other
reply, it shows you how you can achieve your goal using C#.

Willy.



"spentun" <spentun@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:A99D7368-4C29-49DE-B6CC-C7365E9D5161@xxxxxxxxxxxxxxxx
| but.... why can the antivirus detect the malicious file when we click a
| executable file. And, why can FileSystemWatcher know which file was
changed,
| but can't know which file was executed ????
|
| "Ignacio Machin ( .NET/ C# MVP )" wrote:
|
| > Hi,
| >
| > "spentun" <spentun@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
| > news:B496E184-288E-4717-B534-2A486E180868@xxxxxxxxxxxxxxxx
| > > How can I moitor file which is executed by user or program in window.
| > > I need to write a code to monitor file. When user clicks the
file(.exe) or
| > > is called by program, the name of file will be return to a program.
| > > so, excatly, I need to know the name of the executable file that is
| > > executed.
| > > originally, I try to windows service + FileSystemWatcher.
| > > but, There are just created, renamed, deleted, and changed four events
in
| > > the FileSystemWacher, not excuted.
| > > So, How can I do???????
| >
| >
| > There is no way of doing it
| >
| >
| >
| > --
| > Ignacio Machin,
| > ignacio.machin AT dot.state.fl.us
| > Florida Department Of Transportation
| >
| >
| >


.