[Fack you in particular]

So when a user goes to explorer.exe (documents, pictures, etc.) and hits an item there, my program should intercept that and decide whatever happens.
I'm not totally helpless. I have a solution setup, but I reckon it's really shitty, and there must be a better way using hooking or something.

Anyways, here's my current solution:

I have a very broad WMI query: SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'
This is fed into an event listener, and then an event is fired everytime something fits that query.
Then, I'd close whatever process down that is (considering it's not owned by system or a well known process such as dllhost.exe), and then I'd do whatever I want.
Problem is WMI is horribly CPU expensive, and slow. Which in turn means the user will see their program flash for a second, then close.


Has anyone dealt with this before, and if so, what was your solution?

[Fack you in particular]

Right. I'm not looking for a rootkit. As far as I understand (from reading), rootkits have the effect of hiding your process in any task list, and from the registry.
I can't see how anybody reached the conclusion that is what I'm trying to achieve. I never even mentioned anything remotely in that gray sort of area.

But, what we're getting at is: It's impossible for .NETs hooks to do?