//ApplicationScanner
//Author: Greg Jarzab
using System;
using System.IO;
using System.Text;
using System.Collections;
using System.Runtime.InteropServices;
using Microsoft.Win32;
using System.Threading;
 
namespace ApplicationScanner
{
    public delegate bool CallBack(IntPtr hWnd, int lParam);
 
    class WindowManager
    {
        static string WindowTitle;
        ArrayList BlackListedApps;
        bool done = false;
 
        public WindowManager()
        {
            SystemEvents.SessionEnding += new SessionEndingEventHandler(LoggingOff);
        }
 
        public void GetWindows()
        {
            while (!done)
            {
                NativeWIN32.EnumWindows(new CallBack(EnummerateWindows), 0);
                Thread.Sleep(5000);
            }
        }
 
        private void Warn(string title)
        {
            //This is for testing purposes.
            System.Windows.Forms.MessageBox.Show(title + " detected!", "Blocked application has been detected!");
        }
 
        private bool CheckViolations(string current)
        {
            foreach (string ae in BlackListedApps)
            {
                if (current.ToUpper().Contains(ae.ToUpper()))
                {
                    Warn(current);
                    return true;
                }
            }
            return false;
        }
 
        private bool EnummerateWindows(IntPtr hWnd, int lParam)
        {
            if (NativeWIN32.IsWindowVisible(hWnd))
            {
                int length = NativeWIN32.GetWindowTextLength(hWnd);
                StringBuilder wt = new StringBuilder(length + 1);
                int result = NativeWIN32.GetWindowText(hWnd, wt, wt.Capacity);
                WindowTitle = wt.ToString();
                if (result > 0)
                {
                    //System.Windows.Forms.MessageBox.Show("Window Title: " + WindowTitle.ToString());
                    if (CheckViolations(WindowTitle.ToString()))
                    {
                        NativeWIN32.SendMessage(hWnd, NativeWIN32.WM_SYSCOMMAND, NativeWIN32.SC_CLOSE, 0);
                    }
                }
            }
            return true;
        }
 
        public bool LoadBlackList(string path)
        {
            BlackListedApps = new ArrayList();
            StreamReader file = new StreamReader(path);
            string line;
 
            while ((line = file.ReadLine()) != null)
            {
                BlackListedApps.Add(line);
            }
			file.Close();
            return true;
        }
 
        private void LoggingOff(object sender, SessionEndingEventArgs e)
        {
            done = true;
            System.Windows.Forms.MessageBox.Show("Logging off");
        }
    }
 
    class NativeWIN32
    {
        public const int WM_SYSCOMMAND = 0x0112;
        public const int SC_CLOSE = 0xF060;
 
        [DllImport("user32.dll")]
        public static extern int EnumWindows(CallBack cb, int lParam);
        [DllImport("user32.dll")]
        public static extern int GetWindowText(IntPtr hWnd, StringBuilder s, int MaxCount);
        [DllImport("user32.dll")]
        public static extern int GetWindowTextLength(IntPtr hWnd);
        [DllImport("user32.dll")]
        public static extern int SendMessage(IntPtr hWnd, uint Msg, int wParam, int lParam);
        [DllImport("user32.dll")]
        public static extern bool IsWindowVisible(IntPtr hWnd);
        [DllImport("user32.dll")]
        public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);
        [DllImport("kernel32.dll")]
        public static extern IntPtr GetConsoleWindow();
    }
}

using System;
using System.Text;
using System.Threading;
using ApplicationScanner;
 
public class Monitor
{
    public static void Main()
    {
        WindowManager wm = new WindowManager();
        wm.LoadBlackList(@"C:\Blocked.txt");
 
        IntPtr handle = NativeWIN32.GetConsoleWindow();
        NativeWIN32.ShowWindow(handle, 0);
        wm.GetWindows();
    }
}