Monday, December 8, 2008

Preventing a Process from Running

Temporary event consumer that terminates any new instances of Notepad.exe as soon as those new instances are created.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colMonitoredProcesses = objWMIService. _        
    ExecNotificationQuery("select * from __instancecreationevent " _ 
        & " within 1 where TargetInstance isa 'Win32_Process'")
i = 0
Do While i = 0
    Set objLatestProcess = colMonitoredProcesses.NextEvent
    If objLatestProcess.TargetInstance.Name = "notepad.exe" Then
    objLatestProcess.TargetInstance.Terminate
    End If
Loop

This is a VB Script, this can be used by saving the file in .vbs file