I'm not sure what are you asking about, but here's my guess.

maybe you can keep track, in a seperate log file, of the current time, and when you next check the time, it should be higher that the previous - already logged - by a certain amount of (minutes|milliseconds|years)... if not, then the user has changed his clock.

And to add (because you're a newbie) to chady's reply, you need to store somewhere the value of the "time" function, eg:

# snippet...
open(TIMELOG,">timelog.txt") || die $!;
print TIMELOG time;
close(TIMELOG);
[download]

then when you need to see if clock has been set back:

open(TIMELOG,"<timelog.txt") || die $!;
my $stored_time = <TIMELOG>;
close(TIMELOG);

if (time < $stored_time) {
  ... do something because time now is earlier than stored
}
[download]

.02

cLive ;-)

You can compare the "system up time" vs. the "time of day" at two different points and see either that the system was rebooted in between or how much the time-of-day clock was adjusted during that period:

    use Win32;
    my $bootTime= time() - Win32::GetTickCount()/1000;
[download]

But it sounds like a better solution is to have something interact with an external system that few people have access to adjust the time-of-day clock on.

You can also use "net time \\lazy-bum" from some other computer to see what the time-of-day clock is currently set to on the lazy-bum computer.

We can get the startup time? not the elapsed time Because if we know the time that the computer startup, we can compare this to know if the clock was adjusted. For examples:
A = Real time -> time()
B = elapsed time -> GetTickCount()
C = Teorical startup time

A = 1:45pm
B = 10 minutes
C = 1:35pm

C = A - B
but we can't probe this because we don't know the real startup time. But if

D = Real startup time
D = 12:00pm
We can compute if C = D
if C = D the clock is correct
if C <> D the clock was adjusted

C = 1:35pm
D = 12:00pm

C <> D so the clock was adjusted

BUT WE CAN TO KNOW THE STARTUP TIME???

As I said, you compare two different values of the (computed) start-up time (based on the setting of the real-time clock at the time of your measurements). So you'll have to store (at least one of) your previous measurements somewhere for comparison.

        - tye (but my friends call me "Tye")