How Do I Stop An Application From Opening

Rather than trying to kill the process when it runs, how about stopping it from running in the first place?

Changing what happens when the shell tries to launch an application is simple - add a new registry key to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

To test this I added a registry key called notepad.exe and within this the string value Debugger with the value calc.exe. Now whenever I try and run notepad calc opens. The following is the exported registry key.

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe]
"Debugger"="calc.exe"

Having made this change I've not yet managed to open notepad, not bad for a no code solution. If you need to be 100% certain that the application never runs you could always add a "kill" solution too as detailed by others.


Just a small addition to Stephen Nutt's otherwise excellent answer:

If you want the program to go away for good, don't just pop up something else in its stead (calc.exe in Stephen's example). Specify the key: "Debugger" = "ntsd -c q"

This will invoke NT's ever-present command-line debugger ntsd for the program with the command line argument -c saying "execute the debugger command specified next"; the debugger command is q (meaning quit). This will stop the debugger, which as a side effect will kill the debuggee -- the program you want to prevent from running -- too.

Clean, nice and easy. The only side effect I observed is that sometimes a transient command window pops up briefly with a debugger prompt only to disappear again in a moment.

Tags:

C#

.Net

C++

Winapi