API Events when Processes are launched 1

[Zcript3r]

We are attempting to control from our application what applications can be launched by a user. We basically have a locked down desktop application, and want to to be able to kill an exe if it gets launched and is on the "Do not allow to run" list. We have solved this problem by enumerating the processes running on the box once per second, and as we enumerate, check against the XML Document that contains the applications we do not want to run (i.e. Internet Explorer).
Does anybody know of an event that we can get from the operating system when a new process is launched, so that we don't have to enumerate once a second? We are using Delphi 7 for our DLL, and VB for the EXE.
Thanks for any help!!

Rob

 

[Griffyn]

Sounds very similar to a request for help I made a few days ago. Check out ShellExecuteHook. I found a tutorial for C users you may find useful.

http://www.codeguru.com/shell/ShellLogging.html

Post back if you manage to get anywhere with this - I'd appreciate some help with my problem.

 

[ddahlgren]

Wouldn't make more sense to put in the list what you will allow to run rather than what not to run?
Dave Dahlgren

 

[Zcript3r]

Wouldn't make more sense to put in the list what you will allow to run rather than what not to run?
Dave Dahlgren"

Since we are polling the System space and killing (or allowing in your solution) applications, we would have to know everything about the Operating System and what EXE's it launches for different situations.

It wouldn't be realistic.

 

[whosrdaddy]

you can do this very easily without having the need to poll the system. you'll have to change al registry keys that are associated with executables (COM, BAT, EXE, PIF, ...) and route them via your application. this way your app can decide wether to launch the app or not. here's an example of such a registry key :

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

change this to :

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\" yourapp %1\" %*"
[/code]

or something like this. various viruses use this technique to "sabotage" windows. (go look on symantec site and look for more info on the "swen" virus). I think this the way I would do it anyway.

Greetings,

http://www.damovo.com