Detecting application startup and exit events

[Flidmouse]

Hi,

I have written ( using VS2008 c++ ) a windows service which sends information about PC usage to a central database, as part of a PC availability setup. I have been asked to add the following functionality to it:

1) What applications are most used, when and how long for, and

2) What web sites are being accessed, again to find the most popular etc.

My main question is, what functionality is there to trap application start / close events from within my service ( just need the application name ), and secondly, would somebody be able to confirm that, as I am already using sockets to send information to a PHP script on a server, the best way to see what web pages are being accessed is to build in a packet sniffer, and extract the information from that.

Thanks in advance

[MrViggy]

Why did you re-post the same question you asked here:

http://forums.codeguru.com/showthread.php?t=523114

Just ask a moderator to move that post to this forum.

Viggy

[JohnCz]

I would suggest looking into WMI __InstanceCreationEvent, __InstanceDeletionEvent and possibly __InstanceModificationEvent. WMI alows you to use mentioned classes to subscribe to receive notification of creation, deletion and modification of objects, like for example Win32_Process.

For detecting internet browsing history you can look into an open source tools allowing retrieval of the browsing history. Good start: http://www.symantec.com/connect/arti...rensics-part-1