How to monitor process creation?

I need my program (vc++) to monitor and log applications executions (name and full path to the exe).

My programs runs ar background and if any application on the windows xp system is executed (Microsoft Word, IE, calculator and etc) it should log and it's executable file's path.

I've found this article : http://www.codeproject.com/KB/system...protector.aspx
But it's to complicated and has stuff that I don't need.

I'll appreciate any help.

WMI is another way to monitor this:
C++: http://msdn2.microsoft.com/en-us/lib...25(vs.85).aspx
VBScript: http://msdn2.microsoft.com/en-us/lib...11(VS.85).aspx

gg

Thanks,
But I have problems compiling the code from the example, though I didn't change anything.

(Environment: Visual studio 2005, Visual C++ win32 console application)

You'll have to be more specific if you want help your compiling problems.

gg

At first it complained about "stdafx.h" , so I included it.
Now it complains about:
Error 1 error C2065: 'HRESULT' : undeclared identifier

strange, cause example should have all includes, shouldn't it?

#include <windows.h>?

Quote:

---

Originally Posted by Elysia

#include <windows.h>?

---

Why it wasn't included in the example?

Now I have other "include" errors:
Error 1 error C2065: 'COINIT_MULTITHREADED' : undeclared identifier

Maybe I should Create another type of project?

No. Just missing headers.
Well, it's not full source code, is it? Anyway.
#include <objbase.h>?

Quote:

---

Originally Posted by Elysia

No. Just missing headers.
Well, it's not full source code, is it? Anyway.
#include <objbase.h>?

---

I thought it's a full source.


<objbase.h> didn't help! still same error.

P.s. total count 46 errors!

Yes, I see it's a fat example now, but Microsoft didn't include the right headers in the code. Bah. Stupid Microsoft.
What other errors? HRESULT you can get from Windows.h and COM stuff from objbase.h.

I still get COINIT_MULTITHREADED error! Though I've included:
#include <windows.h>
#include <objbase.h>

Maybe, if it's not to hard, you can compile it yourself?


other errors:
Error 1 error C2065: 'COINIT_MULTITHREADED' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 12
Error 2 error C3861: 'CoInitializeEx': identifier not found d:\1\eventsink\eventsink\event.cpp 12
Error 3 error C2065: 'cout' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 15
Error 4 error C2065: 'hex' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 16
Error 5 error C2065: 'endl' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 16
Error 6 error C2065: 'EOAC_NONE' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 35
Error 7 error C3861: 'CoInitializeSecurity': identifier not found d:\1\eventsink\eventsink\event.cpp 27
Error 8 error C2065: 'IWbemLocator' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 51
Error 9 error C2065: 'pLoc' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 51
Error 10 error C2065: 'CLSID_WbemLocator' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 54
Error 11 error C2065: 'IID_IWbemLocator' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 57
Error 12 error C2065: 'IWbemServices' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 71
Error 13 error C2065: 'pSvc' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 71
Error 14 error C2227: left of '->ConnectServer' must point to class/struct/union/generic type d:\1\eventsink\eventsink\event.cpp 75
Error 15 error C3861: '_bstr_t': identifier not found d:\1\eventsink\eventsink\event.cpp 76
Error 16 error C2227: left of '->Release' must point to class/struct/union/generic type d:\1\eventsink\eventsink\event.cpp 90
Error 17 error C3861: 'CoSetProxyBlanket': identifier not found d:\1\eventsink\eventsink\event.cpp 101
Error 18 error C2227: left of '->Release' must point to class/struct/union/generic type d:\1\eventsink\eventsink\event.cpp 116
Error 19 error C2227: left of '->Release' must point to class/struct/union/generic type d:\1\eventsink\eventsink\event.cpp 117
Error 20 error C2065: 'IUnsecuredApartment' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 126
Error 21 error C2065: 'pUnsecApp' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 126
Error 22 error C2065: 'CLSID_UnsecuredApartment' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 128
Error 23 error C2065: 'IID_IUnsecuredApartment' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 129
Error 24 error C2065: 'EventSink' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 132
Error 25 error C2065: 'pSink' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 132
Error 26 error C2061: syntax error : identifier 'EventSink' d:\1\eventsink\eventsink\event.cpp 132
Error 27 error C2227: left of '->AddRef' must point to class/struct/union/generic type d:\1\eventsink\eventsink\event.cpp 133
Error 28 error C2227: left of '->CreateObjectStub' must point to class/struct/union/generic type d:\1\eventsink\eventsink\event.cpp 136
Error 29 error C2065: 'IWbemObjectSink' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 138
Error 30 error C2065: 'pStubSink' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 138
Error 31 error C2065: 'IID_IWbemObjectSink' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 139
Error 32 error C2227: left of '->ExecNotificationQueryAsync' must point to class/struct/union/generic type d:\1\eventsink\eventsink\event.cpp 144
Error 33 error C2065: 'WBEM_FLAG_SEND_STATUS' : undeclared identifier d:\1\eventsink\eventsink\event.cpp 149
Error 34 error C3861: '_bstr_t': identifier not found d:\1\eventsink\eventsink\event.cpp 145
Error 35 error C3861: '_bstr_t': identifier not found d:\1\eventsink\eventsink\event.cpp 146
Error 36 error C2227: left of '->Release' must point to class/struct/union/generic type d:\1\eventsink\eventsink\event.cpp 158
Error 37 error C2227: left of '->Release' must point to class/struct/union/generic type d:\1\eventsink\eventsink\event.cpp 159
Error 38 error C2227: left of '->Release' must point to class/struct/union/generic type d:\1\eventsink\eventsink\event.cpp 160
Error 39 error C2227: left of '->Release' must point to class/struct/union/generic type d:\1\eventsink\eventsink\event.cpp 162
Error 40 error C2227: left of '->Release' must point to class/struct/union/generic type d:\1\eventsink\eventsink\event.cpp 163
Error 41 error C2227: left of '->CancelAsyncCall' must point to class/struct/union/generic type d:\1\eventsink\eventsink\event.cpp 171
Error 42 error C2227: left of '->Release' must point to class/struct/union/generic type d:\1\eventsink\eventsink\event.cpp 176
Error 43 error C2227: left of '->Release' must point to class/struct/union/generic type d:\1\eventsink\eventsink\event.cpp 177
Error 44 error C2227: left of '->Release' must point to class/struct/union/generic type d:\1\eventsink\eventsink\event.cpp 178
Error 45 error C2227: left of '->Release' must point to class/struct/union/generic type d:\1\eventsink\eventsink\event.cpp 180
Error 46 error C2227: left of '->Release' must point to class/struct/union/generic type d:\1\eventsink\eventsink\event.cpp 181

Add

#define _WIN32_WINNT 0x400

To your header and

using namespace std;

to your source file.
See if that helps.

using namespace std; this one I already have.

#define _WIN32_WINNT 0x400; didn't help

You need to have _WIN32_WINNT defined before you include any header files.

gg

I dunno. It compiles for me (using 2008).
The only thing I can think of is that VC's headers are outdated.
Try right-clicking on COINIT_MULTITHREADED and select "go to declaration". See if it finds it.

You can also try a rebuild.
Make sure you did as the tutorial mentioned. Copying the first past into the first .cpp source file, the second into a header and the third into 2nd sound file and compile works for me.

If it compiles to you maybe you send this code to me?
By email or upload it to some web-storage.

Copy n' paste, mate, copy n' paste.
All I was copy & paste.

Quote:

---

Originally Posted by Elysia

Copy n' paste, mate, copy n' paste.
All I was copy & paste.

---

Me too.

What kind of project did you create?

I simply used an existing console project.
But anyway, try finding the define, as I told you earlier. See if you can find them. Dig inside the headers.

Ok, the COINIT_MULTITHREADED error was fixed by adding #define _WIN32_DCOM to stdafx.h, why it's needed there?

It needs to be defined before you include all the headers.

#define _WIN32_DCOM- what it for? Why do i need to include it?

I don't know what it's used for, only that it seems you must define it to use COM (that or use a higher _WIN32_WINNT).

Ok, now the event us triggered when new process is created.
How Do I get the file name and path of this process?

Quote:

---

How Do I get the file name and path of this process?

---

Once you have the process ID, you can use the code example at this link to get the complete command line of the process.

There's lots of information in the Win32_Process object in the callback to Indicate(). Replace your EventSink::Indicate() with this. It shows how to get a "pointer" to the Win32_Process object and then get its "ExecutablePath" property.

Code:

---

#include <comutil.h>
_COM_SMARTPTR_TYPEDEF(IWbemClassObject, __uuidof(IWbemClassObject));

HRESULT EventSink::Indicate(long lObjectCount, IWbemClassObject **apObjArray)
{
        HRESULT hres = S_OK;

    for (int i = 0; i < lObjectCount; i++)
    {
        cout << "Event occurred" << endl;
        IWbemClassObject *pObj = apObjArray[i];

        HRESULT hres;
        VARIANT vInst_;
        hres = pObj->Get(L"TargetInstance", 0, &vInst_, 0, 0);
        if (FAILED(hres))
        {
            cout << "Failed to get TargetInstance: " << hres << endl;
            continue;
        }//if

        try
        {
            _variant_t vInst;
            vInst.Attach(vInst_); // use C++ class to manage VARIANT

            IWbemClassObjectPtr pWin32ProcessObj(vInst);

            VARIANT vVar;
            hres = pWin32ProcessObj->Get(L"ExecutablePath", 0, &vVar, 0, 0);
            if (FAILED(hres))
            {
                cout << "Failed to get ExecutablePath: " << hres << endl;
            }//if
            else
            {
                _variant_t vExecPath;
                vExecPath.Attach(vVar);

                wcout << L"ExecPath: " << (const wchar_t*)((_bstr_t)vExecPath) << endl;
            }//else
        }//try
        catch(_com_error &err)
        {
            cout << "caught _com_error: " << err.Error() << endl;
        }//catch
    }//for

    return WBEM_S_NO_ERROR;
}//Indicate

---

gg

Quote:

---

Originally Posted by Elysia

Yes, I see it's a fat example now, but Microsoft didn't include the right headers in the code. Bah. Stupid Microsoft.
What other errors? HRESULT you can get from Windows.h and COM stuff from objbase.h.

---

no the problem is he has teh project set as 'use precompiled headers' turn that option off and it shoudl compile fine

It seems the inital understanding was wrong, but it's not the fault of precompiled headers.
The OP fixed that before.
It was an astray define, it seems.

Well I saw the htread chasing the add mroe headers red herring. stdafk.h is alwasy a cause of problems when mixing PCH and non-PCH code. you should NEVER have to directly include objbase.h

Your reply makes no sense. And it has a lot of spelling errors too.
Stdafx.h does not cause problems. It only complains when you do not include it in every source file (but you can override that).
Plus msdn docs does not mention that including objbase.h is bad.