Как можно организовать перехват запуска файлов?

Подскажите, как можно организовать перехват запуска файлов в Windows на подобии AVPMonitor?
см. Hooks в API Win32 Help

функция SetWindowsHookEx

WH_CBT - The CBTProc hook procedure is an application-defined or library-defined callback function that the system calls before activating, creating, destroying, minimizing, maximizing, moving, or sizing a window; before completing a system command; before removing a mouse or keyboard event from the system message queue; before setting the keyboard focus; or before synchronizing with the system message queue. The value returned by the hook procedure determines whether Windows allows or prevents one of these operations. A computer-based training (CBT) application uses this hook procedure to receive useful notifications from the system.

TopList Rambler's Top100