Rather than trying to kill the process when it runs, how about stopping it from running in the first place?
Changing what happens when the shell tries to launch an application is simple - add a new registry key to HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options
To test this I added a registry key called notepad.exe and within this the string value Debugger with the value calc.exe. Now whenever I try and run notepad calc opens. The following is the exported registry key.
REGEDIT4
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options
otepad.exe]
"Debugger"="calc.exe"
Having made this change I've not yet managed to open notepad, not bad for a no code solution. If you need to be 100% certain that the application never runs you could always add a "kill" solution too as detailed by others.
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…