Starting the monitoring process in the system

Question

Is there a way to track processes starting on the system before they start?

Example:
In programs such as ZoneAlarm or Antivirus, when you start the program, he asks you whether you allow this program to run or not before it starts ...

Answer 1

There are several ways to do this. If you only need to track the creation of a process coming from a specific program (or several programs), the EasyHook / Detours method described here will work very well, but you really need to set the hook to CreateProcess in each program, so this is not a great solution if you want to track all the processes in the system.

To do this, there is a specific API for NT versions of Windows (NT / 2000 / XP / Vista) called PsSetCreateProcessNotifyRoutine (). Unfortunately, this function can only be called from ring0, so it needs to be done in the driver. This CodeProject article has a convenient explanation (and code): http://www.codeproject.com/KB/threads/procmon.aspx .

AFAIK, this is just a notification and in itself does not allow you to tell the system whether the process should be created or not. However, if you need to do this, you can pause the process (for example, by binding it to the debugger), while your code decides whether to kill it or not.

Answer 2

You should check out the easyhook-continuing-detours project , which is the .NET port of the Microsoft Detours Project . This will allow you to connect unmanaged APIs (such as CreateProcess). Check out the sample code for a simple FileMon-like program here .

Answer 3

You can find out when processes are started using the ETW consumer in real time, however, in order to be able to take some actions that could cancel the process from starting, you will need to do something shadow / undocumented, for example, CreateProcess or using the driver kernel filter to block reading in exe.

Answer 4

Just use process notifications. It is included in Windows. You do not need to intercept anything.