Option Explicit
 
Public Declare Function EnumWindows Lib "user32.dll" (ByVal lpEnumFunc As Long, ByVal lParam As Long) As Long
Public Declare Function GetWindowLong Lib "user32" Alias "GetWindowLongA" (ByVal hwnd As Long, ByVal nIndex As Long) As Long
Public Declare Function GetClassName Lib "user32" Alias "GetClassNameA" (ByVal hwnd As Long, ByVal lpClassName As String, ByVal nMaxCount As Long) As Long
Public Const GWL_STYLE = (-16)
 
Declare Function AccessibleObjectFromWindow Lib "oleacc" (ByVal hwnd As Long, ByVal dwId As Long, riid As tGUID, ppvObject As Object) As Long
'Esta API que sigue se usa para enumerar los objetos IAccessible de los children de la ventana
'Declare Function AccessibleChildren Lib "oleacc" (ByVal paccContainer As IAccessible, ByVal iChildStart As Long, ByVal cChildren As Long, rgvarChildren As Variant, pcObtained As Long) As Long
 
Type tGUID
    lData1            As Long '4 bytes DWORD
    nData2            As Integer '2 bytes
    nData3            As Integer '2 bytes
    abytData4(0 To 7) As Byte  '8 bytes (array)
End Type
 
Type AccObject
    objIA As IAccessible 'objeto IAccessible de oleacc.dll
    lngChild As Long '4 bytes
End Type
 
Global Enumerando As Boolean
Global Marcar As Long
 
Public Function EnumWindowsProc(ByVal hwnd As Long, ByVal lParam As Long) As Long
'Esta funcion es el Callback de la API EnumWindows (Se llama por cada ventana de nivel 1 que encuentre)
'Los BalloonTips del Area de Notificacion estan en el nivel 1!
 
Dim retval As Long ' return value
Dim accName As String ' guardar el nombre de la propiedad de IAccessible
Dim clsname As String ' guarda nombre de la clase de la ventana
Dim oParent As IAccessible  ' objeto IAccessible que se llenara al llamar a IAccessibleFromHwnd
 
'Room for classname
clsname = Space(200)
'Get classname string
retval = GetClassName(hwnd, clsname, 200)
clsname = Trim(Mid(clsname, 1, retval))
'get style DWORD of window
retval = GetWindowLong(hwnd, GWL_STYLE)
 
If LCase(clsname) = "tooltips_class32" Then     'if classname is a tooltip
    If retval And &HC0 Then                     'and the style has the TTS_BALLOON (0x40) and the TTS_CLOSE (0x80) bits set
        Set oParent = IAccessibleFromHwnd(hwnd) 'get IAccessible object of window
        accName = Trim(oParent.accName)         'get accName property value
        If InStr(1, accName, "Threat detected by Sophos.") <> 0 Then 'compare propval with my text
            Form1.Label1.Caption = "Sophos Detectado!!!" 'jejeje
        End If
    End If
End If
 
EnumWindowsProc = 1 ' return value of 1 means continue enumeration
End Function
 
Function IAccessibleFromHwnd(hwnd As Long) As IAccessible
'Obtiene objeto IAccessible de una ventana a partir del hwnd de la misma
Dim oIA As IAccessible
Dim tg As tGUID
Dim lReturn As Long
 
' Define the GUID for the IAccessible object
' {618736E0-3C3D-11CF-810C-00AA00389B71}
 
With tg
    .lData1 = &H618736E0
    .nData2 = &H3C3D
    .nData3 = &H11CF
    .abytData4(0) = &H81
    .abytData4(1) = &HC
    .abytData4(2) = &H0
    .abytData4(3) = &HAA
    .abytData4(4) = &H0
    .abytData4(5) = &H38
    .abytData4(6) = &H9B
    .abytData4(7) = &H71
End With
 
' Retrieve the IAccessible object from the window identified by hwnd
lReturn = AccessibleObjectFromWindow(hwnd, 0, tg, oIA)
' Return Object
Set IAccessibleFromHwnd = oIA
End Function