Detect program starting

This is not really an answer more of a direction I think you should look at. Have a look in the Win32 help file for Event Logging Information. The procedures to look at i reckon relate to the registry and log files. These are as follows

GetNumberofEventLogRecords()
GetOldestEventLogRecord()
OpenEventLog()
ReportEvent()
ReportEventLog()
etc etc

See if that helps at all...
Like I said may not be a solution but may point you in direction...

WESTY

An easy way, not the best, is to scan the process list (process walking) by using
Process32First and Process32Next. Then you will get a complete list of all available
Win32 processes.

OR

.even easier, if you just want to detect windowed "programs"; use EnumWindows, EnumChildWindows to get all visible windows.

/// John

Well, don't want to offend you, d003303, but I have made a freely available shell hook component. mmilan, give him the points and I'll give you the component... ;)

On the other hand I don't understand ..."and read it's path?"
What do you want to say with that ?

bome

The executable filename?

Is it OK, HURRY UP!

Yo,
mmilan, reject my answer and give bome the points !
bome, no problem. Just didn't know you have something for hooking in stock ;-)

Slash/d003303

OK, read the executable filename. My component does not provide that.

mmilan, what do you mean with hurry up ?

bome

OK, d003303.
mmilan, download it at
http://clio.unice.fr/~fbomers/Watch100.zip

I don't want the points, d003303, your answer was right and appropriate for the points.

bome

PS: and I was too late :)

Yo,
I took a look at your problem with the program path. The only thing you can get is the name of the module (EXE, DLL, VXD, DRV, ...) and the name of the process (EXE) the window belongs to. AFAIK there is no way to get the complete path out.
If you want to write a log with all used apps on the system, you may want to create a continiously updated table with EXE files in the system and search through that with the process file name.

Slash/d003303