}
			}
			// Insert into top-level menu
			InsertMenu( GetMenu( hWnd ), 3, MF_BYPOSITION|MF_POPUP|MF_STRING,
						(UINT)DriveMenu, _T("&Drives") );

			// Have driver hook the selected drives
			CurDriveSet = Hook_Drives( DriveMenu, MaxDriveSet, CurDriveSet );

			// set the time type bitmap
			SendMessage( hWndToolbar, TB_CHANGEBITMAP, IDM_TIME, (TimeIsDuration?10:9) );

			// Start up timer to periodically update screen
			SetTimer( hWnd,	1, 500/*ms*/, NULL );
			
			// Initialization done
			SetCursor( hSaveCursor );
			ReleaseCapture();
			return 0;

		case WM_PARENTNOTIFY:

			// pop-up what the user clicked on
			if( LOWORD(wParam) == WM_RBUTTONDOWN ) {  

				hitItem.pt.x = LOWORD(lParam);
				hitItem.pt.y =  HIWORD(lParam);

				ClientToScreen( hWnd, &hitItem.pt );
				itemClick.itemPosition = hitItem.pt;

				if( ScreenToClient( hWndList, &hitItem.pt ) &&
					hitItem.pt.y >= 0 && 
					ListView_SubItemHitTest( hWndList, &hitItem ) != -1 ) {

					itemClick.itemText[0] = 0;
					ListView_GetItemText( hWndList, hitItem.iItem,
							hitItem.iSubItem, itemClick.itemText, 1024 );

					// delete any existing balloon
					if( hBalloon ) DestroyWindow( hBalloon );

					if( wcslen( itemClick.itemText ) ) {

						// pop-up a balloon (tool-tip like window)
						hBalloon = CreateWindowEx( 0, _T("BALLOON"), 
										_T("balloon"), 
										WS_POPUP|WS_VISIBLE|WS_BORDER,
										100, 100,
										200, 200,
										hWnd, NULL, hInst, 
										&itemClick );
					}
					return TRUE;
				}
			}
			break;

		case WM_NOTIFY:
			// Make sure its intended for us
			if ( wParam == ID_LIST )  {
				NM_LISTVIEW	* pNm = (NM_LISTVIEW *)lParam;
				switch ( pNm->hdr.code )  {

			        case LVN_BEGINLABELEDIT:
						// Don't allow editing of information
						return 0;
				}
			} else {

				switch (((LPNMHDR) lParam)->code) 
				{
					case TTN_NEEDTEXT:    
						// Display the ToolTip text.
						lpToolTipText = (LPTOOLTIPTEXT)lParam;
    					LoadString (hInst, lpToolTipText->hdr.idFrom, szBuf, sizeof(szBuf));
				    	lpToolTipText->lpszText = szBuf;
						break;

					default:
						return 0;
				}
			}
			return 0;

		case WM_COMMAND:

			switch ( LOWORD( wParam ) )	 {

				// stats related commands to send to driver
				case IDM_CLEAR:
					// Have driver zero information
					if ( ! DeviceIoControl(	sys_handle, FILEMON_zerostats,
											NULL, 0, NULL, 0, &nb, NULL ) )
					{
						Abort( hWnd, _T("Couldn't access device driver") );
						return 0;
					}
					// Update statistics windows
					UpdateStatistics( hWnd, hWndList, TRUE );
					return 0;

				case IDM_HELP:
					WinHelp(hWnd, _T("filemon.hlp"), HELP_CONTENTS, 0L);
					return 0;

				case IDM_CAPTURE:
					// Disable filtering
					Capture = !Capture;
					if ( ! DeviceIoControl(	sys_handle, 
								Capture ? FILEMON_startfilter: FILEMON_stopfilter,
								NULL, 0, NULL, 0, &nb, NULL ) )
					{
						Abort( hWnd, _T("Couldn't access device driver") );
						return 0;
					}
					CheckMenuItem( GetMenu(hWnd), IDM_CAPTURE,
									MF_BYCOMMAND|(Capture?MF_CHECKED:MF_UNCHECKED) );
					SendMessage( hWndToolbar, TB_CHANGEBITMAP, IDM_CAPTURE, (Capture?2:1) );
					InvalidateRect( hWndToolbar, NULL, TRUE );
					return 0;

				case IDM_AUTOSCROLL:
					Autoscroll = !Autoscroll;
					CheckMenuItem( GetMenu(hWnd), IDM_AUTOSCROLL,
									MF_BYCOMMAND|(Autoscroll?MF_CHECKED:MF_UNCHECKED) ); 
					SendMessage( hWndToolbar, TB_CHANGEBITMAP, IDM_AUTOSCROLL, (Autoscroll?4:3) );
					InvalidateRect( hWndToolbar, NULL, TRUE );
					return 0;

				case IDM_TIME:
					TimeIsDuration = !TimeIsDuration;
					CheckMenuItem( GetMenu(hWnd), IDM_TIME,
									MF_BYCOMMAND|(TimeIsDuration?MF_CHECKED:MF_UNCHECKED) ); 
					// tell the driver
					if ( !DeviceIoControl(	sys_handle, FILEMON_timetype,
											(PVOID) &TimeIsDuration, sizeof(BOOLEAN), 
											NULL, 0, &nb, NULL ) )
					{
						Abort( hWnd, _T("Couldn't access device driver") );
						return 0;
					}
					SendMessage( hWndToolbar, TB_CHANGEBITMAP, IDM_TIME, (TimeIsDuration?10:9) );
					InvalidateRect( hWndToolbar, NULL, TRUE );
					return 0;

				case IDM_FILTER:
					DialogBox( hInst, _T("Filter"), hWnd, (DLGPROC) FilterProc );
					return 0;

				case IDM_EXIT:
					// Close ourself
					SendMessage( hWnd, WM_CLOSE, 0, 0 );
					return 0;

				case IDM_FIND:
					// search the listview
					if( !hWndFind ) {
						PrevMatch = FALSE;
						PopFindDialog( hWnd );
					} else if( PrevMatch ) {

						// treat this like a find-next
						SetCapture(hWndFind);
						hSaveCursor = SetCursor(hHourGlass);
						EnableWindow( hWndFind, FALSE );
						if (FindInListview( hWnd, &FindTextInfo ) ) {
							Autoscroll = FALSE;
							CheckMenuItem( GetMenu(hWnd), IDM_AUTOSCROLL,
											MF_BYCOMMAND|MF_UNCHECKED ); 
							SendMessage( hWndToolbar, TB_CHANGEBITMAP, IDM_AUTOSCROLL, 3 );
						}
						EnableWindow( hWndFind, TRUE );
						SetCursor( hSaveCursor );
						ReleaseCapture(); 
					}
					return 0;

				case IDM_ABOUT:
					// Show the names of the authors
					DialogBox( hInst, _T("AboutBox"), hWnd, (DLGPROC)About );
					return 0;

				case IDM_SAVE:
					SaveFile( hWnd, hWndList, FALSE );
					return 0;

				case IDM_SAVEAS:
					SaveFile( hWnd, hWndList, TRUE );
					return 0;

				default:
					drive = LOWORD( wParam ) - IDC_DRIVE;
					if ( drive < 32 )  {
						// Toggle status
						newDriveSet = CurDriveSet ^ (1 << drive);
						// Have driver hook the selected drives
						CurDriveSet = Hook_Drives( DriveMenu, MaxDriveSet, newDriveSet );
						if( newDriveSet != CurDriveSet ) {
							swprintf( msgbuf, _T("Filemon could not attach to drive %C:"),
								drive + L'A' );
							MessageBox( hWnd, msgbuf, 
								APPNAME, MB_ICONWARNING|MB_OK );
						}
						return FALSE;
					} else {
						// Default behavior
						return DefWindowProc( hWnd, message, wParam, lParam );
					}
			}
			break;

		case WM_TIMER:
			// Time to query the device driver for more data
			if ( Capture )  {

				// don't process for more than a second without pausing
				startTime = GetTickCount();
				for (;;)  {
					// Have driver fill Stats buffer with information
					if ( ! DeviceIoControl(	sys_handle, FILEMON_getstats,
											NULL, 0, &Stats, sizeof Stats,
											&StatsLen, NULL ) )
					{
						Abort( hWnd, _T("Couldn't access device driver") );
						return TRUE;
					}
					if ( StatsLen == 0 )
						break;
					// Update statistics windows
					UpdateStatistics( hWnd, hWndList, FALSE );

					if( GetTickCount() - startTime > 1000 ) break;
				}
			}
			return 0;

		case WM_SIZE:
			// Move or resize the List
            MoveWindow( hWndList, 0, TOOLBARHEIGHT, LOWORD(lParam), HIWORD(lParam)-TOOLBARHEIGHT, TRUE );
			MoveWindow( hWndToolbar, 0, 0, LOWORD(lParam), HIWORD(lParam), TRUE );
            return 0;

		case WM_CLOSE:
#if _DEBUG
			// see if the driver can unload
			if ( ! DeviceIoControl(	sys_handle, FILEMON_unloadquery,
									NULL, 0, NULL, 0,
									&irpcount, NULL ) ) {
				Abort( hWnd, _T("Couldn't access device driver") );
				return 0;
			}
			if( irpcount ) {

				wsprintf( msgbuf, 	_T("The Filemon device driver cannot unload\n")
									_T("at this time due to oustanding requests.\n\n")
									_T("Do you wish to exit the GUI now?"));
				if( MessageBox( hWnd, msgbuf, APPNAME, MB_ICONSTOP|MB_YESNO ) == IDNO )
					return 0;
#endif
				CloseHandle( sys_handle );
#if _DEBUG
			} else {
				CloseHandle( sys_handle );	
				if ( ! UnloadDeviceDriver( SYS_NAME ) )  {
					wsprintf( msgbuf, _T("Error unloading \"%s\""), SYS_NAME );
					MessageBox( hWnd, msgbuf, APPNAME, MB_OK );
				}
			}
#endif
			Save_Position_Settings( hWnd );
			return DefWindowProc( hWnd, message, wParam, lParam );

		case WM_DESTROY:
			PostQuitMessage(0);
			return 0;

		default:

			// is it a find-string message?
			if (message == findMessageID ){ 

				// get a pointer to the find structure
				findMessageInfo = (LPFINDREPLACE)lParam;

				// If the FR_DIALOGTERM flag is set, invalidate the find window handle
				if( findMessageInfo->Flags & FR_DIALOGTERM) {
					hWndFind = NULL;
					PrevMatch = FALSE;
				    FindFlags = FindTextInfo.Flags & (FR_DOWN|FR_MATCHCASE|FR_WHOLEWORD);
					return 0;
				}

				// if the FR_FINDNEXT flag is set, go do the search
				if( findMessageInfo->Flags & FR_FINDNEXT ) {
					SetCapture(hWndFind);
					hSaveCursor = SetCursor(hHourGlass);
					EnableWindow( hWndFind, FALSE );
					if( FindInListview( hWnd, findMessageInfo ) ) {
						Autoscroll = FALSE;
						CheckMenuItem( GetMenu(hWnd), IDM_AUTOSCROLL,
										MF_BYCOMMAND|MF_UNCHECKED ); 
						SendMessage( hWndToolbar, TB_CHANGEBITMAP, IDM_AUTOSCROLL, 3 );
					}
					EnableWindow( hWndFind, TRUE );
					ReleaseCapture(); 
					return 0;
				}
				return 0;
			}

			// Default behavior
			return DefWindowProc( hWnd, message, wParam, lParam );
	}
	return 0;
}


/****************************************************************************
*
*    FUNCTION: InitApplication(HANDLE)
*
*    PURPOSE: Initializes window data and registers window class
*
****************************************************************************/
BOOL InitApplication( HANDLE hInstance )
{
	WNDCLASS  wc;
	
	// Fill in window class structure with parameters that describe the
	// main (statistics) window. 
	wc.style			= 0;                     
	wc.lpfnWndProc		= (WNDPROC)MainWndProc; 
	wc.cbClsExtra		= 0;              
	wc.cbWndExtra		= 0;              
	wc.hInstance		= hInstance;       
	wc.hIcon			= LoadIcon( hInstance, _T("APPICON") );
	wc.hCursor			= LoadCursor( NULL, IDC_ARROW );
	wc.hbrBackground	= (HBRUSH)(COLOR_INACTIVEBORDER + 1); // Default color
	wc.lpszMenuName		= _T("LISTMENU");  
	wc.lpszClassName	= _T("FileMonClass");
	if ( ! RegisterClass( &wc ) )
		return FALSE;

	wc.lpszMenuName	  = NULL;
 	wc.lpfnWndProc    = (WNDPROC) BalloonDialog;
	wc.hbrBackground  = CreateSolidBrush( 0x00D0FFFF );
	wc.lpszClassName  = _T("BALLOON");
	RegisterClass( &wc );
	
	return TRUE;
}


/****************************************************************************
*
*    FUNCTION:  InitInstance(HANDLE, int)
*
*    PURPOSE:  Saves instance handle and creates main window
*
****************************************************************************/
HWND InitInstance( HANDLE hInstance, int nCmdShow )
{
	HWND hWndMain;

	// get the window position settings from the registry
	Get_Position_Settings();

	// create the main window
	hInst = hInstance;
	hWndMain = CreateWindow( _T("FileMonClass"), _T("File Monitor"), 
							WS_OVERLAPPEDWINDOW,
							PositionInfo.left, PositionInfo.top, 
							PositionInfo.width, PositionInfo.height,
							NULL, NULL, hInstance, NULL );

	// if window could not be created, return "failure" 
	if ( ! hWndMain )
		return NULL;
	
	// make the window visible; update its client area; and return "success"
	ShowWindow( hWndMain, nCmdShow );

	// maximize it if necessary
	if( PositionInfo.maximized ) {

		ShowWindow( hWndMain, SW_SHOWMAXIMIZED );
	}

	UpdateWindow( hWndMain ); 
	return hWndMain;      
}


/****************************************************************************
*
*	FUNCTION: WinMain(HANDLE, HANDLE, LPSTR, int)
*
*	PURPOSE:	calls initialization function, processes message loop
*
****************************************************************************/
int APIENTRY WinMain( HINSTANCE hInstance, HINSTANCE hPrevInstance,
						LPSTR lpCmdLine, int nCmdShow )
{
	MSG 	msg;      
	HWND	hWnd;
	HACCEL	hAccel;
 	DWORD	NTVersion;
        
	if ( ! InitApplication( hInstance ) )
		return FALSE;   
	
	// get NT version
	NTVersion = GetVersion();
	if( NTVersion >= 0x80000000 ) {
		MessageBox( NULL, _T("Not running on Windows NT. Visit http://www.sysinternals.com to get Filemon for Windows 95"),
			APPNAME, MB_OK|MB_ICONERROR );
		return TRUE;
	}  

	// initializations that apply to a specific instance 
	if ( (hWnd = InitInstance( hInstance, nCmdShow )) == NULL )
		return FALSE;

	// load accelerators
	hAccel = LoadAccelerators( hInstance, _T("ACCELERATORS"));

	// register for the find window message
    findMessageID = RegisterWindowMessage( FINDMSGSTRING );

	// acquire and dispatch messages until a WM_QUIT message is received.
	while ( GetMessage( &msg, NULL, 0, 0 ) )  {
		if( !TranslateAccelerator( hWnd, hAccel, &msg ) &&
			(!hWndFind || !IsWindow(hWndFind) || !IsDialogMessage( hWndFind, &msg ))) {
			TranslateMessage( &msg );
			DispatchMessage( &msg ); 
		}
	}
	return msg.wParam;										 
}