文件夹监控

xp下感觉挺难

不难，
简单点的直接注册一个消息就可以了，这样只能是监控，不能拦截和修改
复杂点 就挂钩api，挂钩api 就可以拦截 ，拒绝、或者修改等
再复杂点就写个驱动什么的了

SHChangeNotifyRegister
SHChangeNotifyDeregister

查下这两个函数的用法就行了
下面的是以前写的，可以供你参考下：

void CDiskMonDlg::OnBnClickedOk()
{
    this->InitFunc();

    IDLSTRUCT ps;

    if (m_bStartMon == 0) {  
        SHGetSpecialFolderLocation(0, CSIDL_DRIVES, &g_pidlDesktop);
        if (g_pidlDesktop != NULL) {   
            memset(&ps, 0x00, sizeof(IDLSTRUCT));
            ps.pidl = g_pidlDesktop;
            ps.bWatchSubFolders = 1;

            m_bStartMon = g_SHChangeNotifyRegister((long)m_hWnd, SHCNF_TYPE | SHCNF_IDLIST, SHCNE_ALLEVENTS | SHCNE_INTERRUPT, WM_SHNOTIFY, 1, &ps);

            ::SetDlgItemText(m_hWnd, IDOK, L"停止");
        }   
    }
    else {   
        if (g_SHChangeNotifyDeregister(m_bStartMon)) {  
            m_bStartMon = 0;
            CoTaskMemFree(g_pidlDesktop);
            g_pidlDesktop = 0;
            ::SetDlgItemText(m_hWnd, IDOK, L"监控");
            memset(&m_LastNii, 0, sizeof(NOTIFY_ITEM_INFO));
        }   
    }
}


LRESULT CDiskMonDlg::OnNotifyReceipt(WPARAM wParam, LPARAM lParam)
{     
    WCHAR wzEvent[2048] = { 0 };
    WCHAR wzPath1[512] = { 0 };
    WCHAR wzPath2[512] = { 0 };

    SHNOTIFYSTRUCT *pidlItem = PSHNOTIFYSTRUCT(wParam);
    SHGetPathFromIDListW(pidlItem->dwItem1, wzPath1);
    SHGetPathFromIDListW(pidlItem->dwItem2, wzPath2);

    if (wzPath1[0] == L'\0' && wzPath1[1] == L'\0') {
        return 1;
    }

    if (m_LastNii.dwType == (DWORD)lParam &&
        wcscmp(wzPath1, m_LastNii.wzPath1) == 0 &&
        wcscmp(wzPath2, m_LastNii.wzPath2) == 0) {
            // 主要是防止重复的信息
            return 0;
    }
   
    switch(lParam)
    {
    case SHCNE_RENAMEITEM:
        swprintf_s(wzEvent, _countof(wzEvent), L"文件: %s 重命名为: %s。", wzPath1, wzPath2);
        break;
    case SHCNE_CREATE:   
        swprintf_s(wzEvent, _countof(wzEvent), L"新建文件:%s。", wzPath1);
        break;
    case SHCNE_DELETE:
        swprintf_s(wzEvent, _countof(wzEvent), L"删除文件:%s。", wzPath1);
        break;
    case SHCNE_MKDIR:  
        swprintf_s(wzEvent, _countof(wzEvent), L"新建文件夹:%s。", wzPath1);
        break;
    case SHCNE_RMDIR:     
        swprintf_s(wzEvent, _countof(wzEvent), L"删除文件夹:%s。", wzPath1);
        break;
    case SHCNE_MEDIAINSERTED:
        swprintf_s(wzEvent, _countof(wzEvent), L"%s 中插入可移动存储器。", wzPath1);
        break;
    case SHCNE_MEDIAREMOVED:  
        swprintf_s(wzEvent, _countof(wzEvent), L"%s 中移去可移动存储器。", wzPath1);
        break;
    case SHCNE_DRIVEREMOVED:   
        swprintf_s(wzEvent, _countof(wzEvent), L"移去驱动器: %s。", wzPath1);
        break;
    case SHCNE_DRIVEADD:      
        swprintf_s(wzEvent, _countof(wzEvent), L"添加驱动器: %s。", wzPath1);
        break;
    case SHCNE_NETSHARE:
        swprintf_s(wzEvent, _countof(wzEvent), L"改变文件夹 %s 的共享属性。", wzPath1);
        break;
    case SHCNE_UPDATEDIR:  
        swprintf_s(wzEvent, _countof(wzEvent), L"更新文件夹: %s。", wzPath1);
        break;
    case SHCNE_UPDATEITEM:        
        swprintf_s(wzEvent, _countof(wzEvent), L"修改了文件: %s。", wzPath1);
        break;
    case SHCNE_SERVERDISCONNECT:   
        swprintf_s(wzEvent, _countof(wzEvent), L"断开与服务器的连接: %s %s。", wzPath1, wzPath2);
        break;
    case SHCNE_DRIVEADDGUI:      
        swprintf_s(wzEvent, _countof(wzEvent), L"添加并显示驱动器: %s。", wzPath1);
        break;
    case SHCNE_RENAMEFOLDER:   
        swprintf_s(wzEvent, _countof(wzEvent), L"文件夹: %s 重命名为 %s。", wzPath1, wzPath2);
        break;
    default:   
        swprintf_s(wzEvent, _countof(wzEvent), L"其他操作。");
        break;
    }

    m_LastNii.dwType = (DWORD)lParam;
    wcscpy_s(m_LastNii.wzPath1, _countof(m_LastNii.wzPath1), wzPath1);
    wcscpy_s(m_LastNii.wzPath2, _countof(m_LastNii.wzPath1), wzPath2);


    SYSTEMTIME stTime = {0};
    ::GetLocalTime(&stTime);

    WCHAR wzTime[32] = { 0 };
    swprintf_s(wzTime, _countof(wzTime), L"%02d:%02d:%02d", stTime.wHour, stTime.wMinute, stTime.wSecond);

    m_pInfoList->InsertItem(0, wzTime);
    m_pInfoList->SetItemText(0, 1, wzEvent);   

    return 0;
}