How to Differentiate Mouse Over Event and actual File Open Event or Read Event

NTFSD
1

Hello,

I have taken a reference of Minispy Code in which i am tracing
all file operation eg:- read, write, delete, open and rename, but
it display file name on Mouse over Event as Open File,but i don’t want this
action to be display,
so how to differentiate between actual file open and Mouse Over Event?

2

>so how to differentiate between actual file open and Mouse Over Event?

Write a shell extension DLL and detect Mouse Over there.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

3

Unfortunately the problem is deeper than “mouse over”. Explorer requests file information (and opens and reads files) whenever you open the folder in Explorer. There’s no reliable way to detect the reads, caused by Explorer taking preview/meta information.

4

@Miti

>But it display file name on Mouse over Event as Open File,but i don’t want this action to be display.

Ideally your driver does not know any thing about why this IRP is raised. Even if there is a reasonable concern to detect this (though not sure what it could be), you can not do this in your driver.

you may have a look on similar thread though http://www.osronline.com/showThread.cfm?link=149271

Thanks,
Aditya