Detection using heuristic analysis

[Mr.M]

Hi Dw

Well I know this kind of question has been asked over and over again but with not straight to the point question, so since I'm also creating a program that require it I've decided to break this down and ask a straight to the point question to get an idea of how it is done. How can I detect a program that is coping a file or performing coping task of files using the heuristic
analysis, meaning in VB.NET how can I detect a program that is performing a file copying task. The examples will guide me and also give me and others the idea of how to detect a program's behavior and flag it or notify of such a program and most importantly gets it location.

Thank you.

[Minimalist]

I don't think you will find a lot of code performing heuristic
analysis. The reason is that this is used by anti virus companies, patented and copy righted. See the link here:
http://www.google.nl/patents/US7480683
There are some other articels that might interest you as well:
http://www.symantec.com/connect/articles/building-anti-virus-engine
With this one coming sort in the direction you are investigating:
http://www.thescarms.com/dotnet/FileSysWatcher.aspx
You want to check out the filesystem watcher at ms:
http://msdn.microsoft.com/en-us/library/system.io.filesystemwatcher.created(v=vs.110).aspx
which looks like a good starting point. If you want to list all of the threads running on your computer this bit of code will do it:

 Private Sub Form1_Load(sender As Object, e As EventArgs) Handles MyBase.Load
        Dim psList() As Process
        Try
            psList = Process.GetProcesses()

            For Each p As Process In psList
                Console.WriteLine(p.Id.ToString() + " " + p.ProcessName)
            Next p

        Catch ex As Exception
            Console.WriteLine(ex.Message)
        End Try
    End Sub