Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am currently looking for a program or source in C / C++ that will allow me to monitor any new executable files and output the results to a text file

Any help would be greatly appreciated

share|improve this question

migrated from stackoverflow.com May 20 '11 at 3:12

This question came from our site for professional and enthusiast programmers.

1  
I think you'll get better results on Serverfault.com –  Erik van Brakel May 19 '11 at 20:39
    
possible duplicate of Detecting child processes –  Hans Passant May 19 '11 at 20:59
    
+1 on Erik van Brakel's comment, as there are probably tools out there that already do this. Also, is there any reason you only want to look at .exe files? Depending on your needs, you find it easier to catalog md5 / SHA hashes of all files on a periodic basis for monitoring purposes. A lot of homebrew malware detection solutions use this method. –  meklarian May 19 '11 at 21:03
    
I don't know why a programming question was moved to SF but I'll give you a clue: FindFirstChangeNotification() and FindNextChangeNotification(). Check the documentation for the details. –  John Gardeniers May 20 '11 at 3:18
add comment

3 Answers 3

If you're just interested in watching the file system for new files with a specific extension or extensions then it's trivially easy using the .net framework filesystem watcher: http://msdn.microsoft.com/en-us/library/system.io.filesystemwatcher.aspx

share|improve this answer
add comment

disclaimer: this is not a real answer

the thing is

  • what is the definition of an executable file
  • what is a new executable file (created locally, created on a network location, found in indexing service, launched process etc. etc.)

Regardless of what it is that you wanted to, there are a hundred ways in which you could want to design your application (as a service, high security, as a shell extension, as a DLL Hook, as a debug monitor, using filesystemwatcher or using indexing service, using filesystem scanning or using shadow copies; using filetype fingerprints or using name based patterns, brute force (all files/folders) or targeted (only Program Files and WINDOWS\System32).

You can include alternative filestreams, or you can skip them. You can include scripts, you can include registered COM components.

I get the feeling this question bight be tad too broad as written :)

I suggest you take up a mindmapping tool, or ask your client for specifications of requirements and come back once you know what you want to do, but are trying to get past a technical hurdle.

share|improve this answer
add comment

You can write a reasonable program to do this as a file system filter driver. The documentation should help you.

share|improve this answer
    
Oh, yes and this too. This ain't for the faint of heart, though. –  sehe May 19 '11 at 20:51
    
I have had to do this a couple of times before, it isn't as bad as the documentation will have you believe. –  Aurojit Panda May 19 '11 at 20:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.