Polling is just dead slow for such a purpose. You might want to use a kernel mode driver for such a thing. Alternatively you could use API hooking in user land. But it's difficult to do this kind of stuff in a way which doesn't eat too much performance. The driver approach would be the best one.