Even though this post is a little old I thought it would be fun to write a powershell script to do this. It loops through and finds processes defined in $watchlist and does the folowing
- Creates a balloon notification
- Stopped the process(es)
- Writes an event to the Application log
#Find and stop select processes
[void] [System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
#Stop these processes
$watchlist = "notepad", "calculator"
#Show a Notification ballon when a process is stopped
Function Get-Notification([string]$Title, [string]$Message)
{
$notify = New-Object System.Windows.Forms.NotifyIcon
$notify.Icon = "C:\Users\Justin\Desktop\folder.ico"
$notify.BalloonTipIcon = "Error"
$notify.BalloonTipText = $Message
$notify.BalloonTipTitle = $Title
$notify.Visible = $True
$notify.ShowBalloonTip(5000)
}
#Loop checks all processes and sleeps for 5 seconds.
While($True)
{
$procs = Get-Process
ForEach($p In $procs)
{
ForEach($w In $watchlist)
{
if(($p).Name -eq $w)
{ Get-Notification -Title "Found $p" -Message "Process found, stopping"
Stop-Process $p
Write-EventLog -LogName Application -EntryType Information -EventId 9999 -Message "Stopped $p" -Source EventSystem -ErrorAction SilentlyContinue
}
}
}
Start-Sleep -s 5
}