Abstract: A method for associating file activity of an application with the graphical display of the file on a screen comprises loading by an operating system an executable code of a message monitoring program adapted to monitoring a message sent by an operating system to a document display window. The message monitoring program establishes a system-wide window hook using available operating system API functions associated with one or more functions in a library of the message monitoring program. The message monitoring program library is loaded into the memory space of a newly started application program, the import table of the application is fixed with addresses of functions from the message monitoring program library, and the application's main window function is substituted with a message monitoring program window function.