# Program to monitor new exe files in Windows (C/C++)

I am currently looking for a program or source in C / C++ that will allow me to monitor any new executable files and output the results to a text file

Any help would be greatly appreciated

-

## migrated from stackoverflow.comMay 20 '11 at 3:12

This question came from our site for professional and enthusiast programmers.

I think you'll get better results on Serverfault.com –  Erik van Brakel May 19 '11 at 20:39
possible duplicate of Detecting child processes –  Hans Passant May 19 '11 at 20:59
+1 on Erik van Brakel's comment, as there are probably tools out there that already do this. Also, is there any reason you only want to look at .exe files? Depending on your needs, you find it easier to catalog md5 / SHA hashes of all files on a periodic basis for monitoring purposes. A lot of homebrew malware detection solutions use this method. –  meklarian May 19 '11 at 21:03
I don't know why a programming question was moved to SF but I'll give you a clue: FindFirstChangeNotification() and FindNextChangeNotification(). Check the documentation for the details. –  John Gardeniers May 20 '11 at 3:18

You can write a reasonable program to do this as a file system filter driver. The documentation should help you.

-
Oh, yes and this too. This ain't for the faint of heart, though. –  sehe May 19 '11 at 20:51
I have had to do this a couple of times before, it isn't as bad as the documentation will have you believe. –  Aurojit Panda May 19 '11 at 20:59

disclaimer: this is not a real answer

the thing is

• what is the definition of an executable file
• what is a new executable file (created locally, created on a network location, found in indexing service, launched process etc. etc.)

Regardless of what it is that you wanted to, there are a hundred ways in which you could want to design your application (as a service, high security, as a shell extension, as a DLL Hook, as a debug monitor, using filesystemwatcher or using indexing service, using filesystem scanning or using shadow copies; using filetype fingerprints or using name based patterns, brute force (all files/folders) or targeted (only Program Files and WINDOWS\System32).

You can include alternative filestreams, or you can skip them. You can include scripts, you can include registered COM components.

I get the feeling this question bight be tad too broad as written :)

I suggest you take up a mindmapping tool, or ask your client for specifications of requirements and come back once you know what you want to do, but are trying to get past a technical hurdle.

-

If you're just interested in watching the file system for new files with a specific extension or extensions then it's trivially easy using the .net framework filesystem watcher: http://msdn.microsoft.com/en-us/library/system.io.filesystemwatcher.aspx

-