#include <stdio.h>
#include <windows.h>

#define COMPLETO FILE_NOTIFY_CHANGE_ATTRIBUTES || FILE_NOTIFY_CHANGE_DIR_NAME || FILE_NOTIFY_CHANGE_FILE_NAME || FILE_NOTIFY_CHANGE_SIZE || FILE_NOTIFY_CHANGE_LAST_WRITE || FILE_NOTIFY_CHANGE_SECURITY

/*FUNCIÓN PRINCIPAL*/
void main()
{
//devuelde la descripción del error, a partir de su código
char *MensajeError(DWORD error_num);
HANDLE mon1;

mon1=FindFirstChangeNotification("C:\\",TRUE,COMPLETO);
WaitForSingleObject(mon1,1);

//creamos el handle
if(mon1==INVALID_HANDLE_VALUE)
{
printf("[!] Error al crear el handle -> %s",MensajeError(GetLastError()));
return;
}

for(;;)
{
FindNextChangeNotification(mon1);
if(WaitForSingleObject(mon1,1)==0)
{
printf("\nLa informacion en la unidad C:\\ ha cambiado");
}

Sleep(1000);
}

//cerramos y salimos
FindCloseChangeNotification(mon1);
return;
}

//devuelde la descripción del error, a partir de su código
char *MensajeError(DWORD error_num)
{
char *lpMsgBuf;

//cojemos el mensaje del error
FormatMessage(
FORMAT_MESSAGE_ALLOCATE_BUFFER |
FORMAT_MESSAGE_FROM_SYSTEM |
FORMAT_MESSAGE_IGNORE_INSERTS,
NULL,
error_num,
0,
(LPTSTR) &lpMsgBuf,
0,
NULL
);

return lpMsgBuf;
}

Option Explicit

Private Const FILE_NOTIFY_CHANGE_ATTRIBUTES = &H4
Private Const FILE_NOTIFY_CHANGE_DIR_NAME = &H2
Private Const FILE_NOTIFY_CHANGE_FILE_NAME = &H1
Private Const FILE_NOTIFY_CHANGE_SIZE = &H8
Private Const FILE_NOTIFY_CHANGE_LAST_WRITE = &H10
Private Const FILE_NOTIFY_CHANGE_SECURITY = &H100
Private Const FILE_NOTIFY_CHANGE_ALL = &H4 Or &H2 Or &H1 Or &H8 Or &H10 Or &H100
Private Const INFINITE = &HFFFFFFFF
Private Const OBJECT_WAIT_0 = 0
Private Const INVALID_HANDLE_VALUE = -1

Declare Function FindFirstChangeNotification Lib "kernel32" Alias "FindFirstChangeNotificationA" (ByVal lpPathName As String, ByVal bWatchSubtree As Long, ByVal dwNotifyFilter As Long) As Long
Declare Function FindNextChangeNotification Lib "kernel32" (ByVal hChangeHandle As Long) As Long
Declare Function FindCloseChangeNotification Lib "kernel32" (ByVal hChangeHandle As Long) As Long
Declare Function WaitForSingleObject Lib "kernel32" (ByVal hHandle As Long, ByVal dwMilliseconds As Long) As Long

Declare Function SetTimer Lib "user32" (ByVal hWnd As Long, ByVal nIDEvent As Long, ByVal uElapse As Long, ByVal lpTimerFunc As Long) As Long
Declare Function KillTimer Lib "user32" (ByVal hWnd As Long, ByVal nIDEvent As Long) As Long

Private bFileMonEnabled As Boolean

Sub Main()
  Call StartFileMon
  Call frmMain.Show
End Sub

Sub FileMonProc(ByVal hWnd As Long, ByVal uMsg As Long, ByVal idEvent As Long, ByVal dwTime As Long)
        Dim r&, hMon&

  r = KillTimer(0&, idEvent)
 
  bFileMonEnabled = True
  hMon = FindFirstChangeNotification("C:\WINDOWS", True, FILE_NOTIFY_CHANGE_ALL)
 
  Do While bFileMonEnabled
    r = WaitForSingleObject(hMon, 100&)
   
    If r = OBJECT_WAIT_0 Then
      r = FindNextChangeNotification(hMon)
     
      'Se modificó el directorio.
      '
    End If
   
    DoEvents
  Loop
 
  r = FindCloseChangeNotification(hMon)
End Sub

Sub StartFileMon()
  If Not bFileMonEnabled Then
    Call SetTimer(0&, 0&, 0&, AddressOf FileMonProc)
  End If
End Sub

Sub StopFileMon()
  bFileMonEnabled = False
End Sub