Process Sniper

The following is AI-generated (aka vibe-coded) software. The software is specific to my needs and my system and may not work for you or your system. Support is limited, but if you report a bug I'll certainly look into it. All code is provided in a zip file for you to review should you choose.

A small Windows tray app that ends any program on your blacklist, and the programs it started, as soon as it starts. It needs nothing but Windows: it is built with the C# compiler that comes with Windows.

It watches for programs starting through Windows Management Instrumentation (WMI), when Windows allows it, and also checks the running programs every minute (or as often as you set), which catches anything else.

Features

• Ends programs as they start, with their child processes. A program that can’t be ended is tried five times, and each try is logged. Windows’ own programs are never ended, whatever the rules say.
• Stats and logs window: terminations per program beside a log of each one, with the program’s path and the rule that caught it, sortable by any column.
• Adding a running program to the blacklist from a list, by name or by path.
• An alert on the tray icon after a program is ended, a yellow dot that stays until you clear it, so you see it even if you missed the notification. Clearing it leaves the log as it is.
• Allowing a program for a while: 15 minutes or an hour, from the tray menu or by clicking its notification, without pausing the rest.
• Pausing for 5 minutes, 15 minutes, 1 hour or indefinitely from the tray menu. A pause lasts through a restart; a timed one ends by itself.
• Blacklist rules by name, by full path, with * and ? wildcards, and with comments.
• Changes apply when you save the settings or the blacklist, without restarting.
• History kept for as long as you choose: older entries are removed every hour.
• Run at startup, from the tray menu.
• One copy at a time: starting it again says it is already running.
• PortableApps: appicon.ico comes with it.

Building and running

You don’t need Visual Studio or the .NET SDK.

1. Put the repository’s files in a folder of their own.
2. Double-click build.bat. It uses Windows’ own C# compiler (csc.exe, .NET Framework 4) to make ProcessSniper.exe, and closes by itself when the build succeeds.
3. Double-click ProcessSniper.exe. On its first run it creates process-sniper.ini (the settings) and blacklist.txt in its folder.

To keep the files somewhere else, double-click launch.bat instead: it starts ProcessSniper.exe with --working-folder-path "c:\workingfolder" and closes its console window, leaving the app in the tray. Edit the folder in it to use another.

Keep process-sniper.ico, process-sniper-paused.ico, process-sniper-alert.ico and process-sniper-paused-alert.ico beside ProcessSniper.exe: they are the tray icons. The icons are drawn by tools/make_icon.py (Python with Pillow), which writes all five .ico files.

The tray icon and menu

The icon shows the state:

• Red circle with a slash: monitoring.
• Gray circle with a slash: paused. Blacklisted programs are allowed to run.
• A yellow dot at the bottom right, on either: programs have been ended since you last cleared the alert. The tooltip says how many. Clear the alert in the menu takes the dot away; the log and the stats stay as they are. The alert lasts through a restart, and Clear stats and logs clears it too.

Its tooltip says the state, says “checking every minute” when programs can only be caught by the regular check (see Troubleshooting), and says which program is allowed and until when.

The notification for a program ended says “Click here to allow it for 15 minutes”: a click asks, then allows it. An allowance lasts through a restart; when it runs out, a notification says the program is blocked again, and it is ended at its next start or check.

Right-click it for:

• View stats and logs: opens the stats and logs window, or brings it to the front.
• Clear the alert: takes the yellow dot off the icon, without changing the log. Grayed out when there is no alert.
• Clear stats and logs: asks, then deletes the whole history.
• Edit settings: opens process-sniper.ini in Notepad. What you save applies within a second.
• Edit blacklist: the same for blacklist.txt. A notification says how many rules there are when a save changes them.
• Add a running program to the blacklist: see below.
• Pause monitoring: for 5 minutes, 15 minutes, 1 hour or indefinitely, and Resume monitoring.
• Allow a program for a while: lists the programs ended most recently; pick one and For 15 minutes or For 1 hour. Below them, Block … again ends an allowance early. Other blacklisted programs are still ended.
• Run at startup: starts Process Sniper when you sign in to Windows (with the same working folder).
• Exit.

The stats and logs window

Terminations per program over the stats’ retention on the left, and each termination and failed attempt over the log’s retention on the right, newest first, with the rule that matched and the program’s path (blank when Windows wouldn’t say, and in entries logged before these columns were added). Drag the divider between them to share the room.

• Click a column heading to sort by it; click it again to reverse. A triangle shows the sort.
• The columns fit their contents when the window opens, and then stay put while it is open. A column you drag to a width of your own keeps it, also next time; double-click its divider to make it fit its contents again.
• Refresh reads the history again; it also refreshes by itself after each termination.
• Clear stats and logs does the same as the tray menu’s.
• The status bar shows the monitoring state and the counts, with failed attempts in red.

The window reopens where you last closed it, at the same size, with the same divider, column widths and sort. If it was on a monitor that is no longer there, it opens in the middle of the main one.

Adding a running program to the blacklist

Add a running program to the blacklist in the tray menu lists the programs running now, one row per program and folder, with how many copies are running. Type in Filter to narrow it by name or path.

• Block by name (or a double click) adds the program’s name: it is ended wherever it runs from.
• Block by path adds its full path: it is ended only when it runs from that folder.

Each asks first, adds the rule at the end of blacklist.txt, and ends the running copies, unless monitoring is paused. Refresh (F5) reads the running programs again; Esc closes the window. Windows’ own programs and Process Sniper aren’t listed. The window reopens where you last closed it.

The blacklist (blacklist.txt)

One rule per line. A rule without a backslash is a program name: it matches with or without .exe, wherever the program is. A rule with a backslash is a full path: it matches only that program in that folder. * stands for any characters and ? for one. Case doesn’t matter.

A comment starts with # or // at the start of a line or after a space, so a # inside a path (C:\Tools\C#\) is part of the rule.

Windows’ own programs are never ended, even by a rule such as *: System, Registry, Memory Compression, smss, csrss, wininit, winlogon, services, lsass, lsaiso, svchost, dwm, fontdrvhost, explorer, sihost, ctfmon and conhost. Ending most of them stops Windows; ending explorer takes the taskbar and the tray with it. Nor is Process Sniper.

The child processes ended with a program are the ones it started, and the ones they started. Windows reuses process numbers, so a process only counts as a child if it started after the program did; one whose own parent ended long ago is left alone.

# Lines starting with # or // are comments.

# A name: ends the program wherever it runs from (.exe optional)
calc
notepad.exe

# A full path: ends the program only when it runs from this folder
C:\Temp\AnnoyingUpdater\update.exe

# Wildcards
background_task_v*.exe
bloatware_202?.exe

# A comment at the end of a rule
telemetry.exe // Stops daily telemetry uploads
C:\Downloads\setup_*.exe # Blocks untrusted installers

Settings (process-sniper.ini)

Edit with Edit settings and save: Process Sniper applies it within a second. A value that is missing, not a number, or out of range falls back to its default.

The app also writes [alert] (when the alert was last cleared, as cleared = 2026-10-29 10:45:00; programs ended after it turn the alert on), [pause] (a pause in progress), [allow] (the programs allowed for a while, as programs = 2026-10-28 23:30:00>calc) and [dialogs] (the windows’ places, sizes, column widths and sorts, and the stats window’s divider). It changes only those lines, so your comments and edits stay. A divider saved by an earlier version, as viewer_split in [panels], is still read.

Files

Everything Process Sniper writes is in its working folder: the folder of ProcessSniper.exe, unless --working-folder-path names another.

Coming from an earlier version: on its first run, Process Sniper takes your values from config.txt into process-sniper.ini, and your history from logs.txt and stats.txt into history.json. It leaves the old files as they were; you can delete them.

Command line

ProcessSniper.exe [--working-folder-path FOLDER]

• --working-folder-path FOLDER: the folder for the settings, the blacklist and the history, created if needed. Blank: the folder of ProcessSniper.exe. Also written as --working-folder-path=FOLDER.
• --help (or -h): shows the options.

It has no console, so the help and any mistake (an unknown option, an option without its value or given twice, a word that isn’t an option, a folder that can’t be created) show in a message box. A mistake exits with status 2.

Keyboard shortcuts

In the stats and logs window, and the window for adding a running program:

Testing

tests\run_tests.bat builds and runs tests/Tests.cs: 29 tests of the command line (with the default working folder, and one that can’t be created), the settings file (fallbacks, a hand-edited or damaged file, taking over config.txt, keeping hand edits on a save), the blacklist (comments, names, paths, wildcards, the rule that matched, Windows’ own programs, adding a rule), allowing programs (until a time, kept in the settings), process trees (children deepest first, a reused process number) and the history (round trip, path and rule, a damaged file kept aside, another program’s file left alone, importing the old files, pruning, counting the programs ended since the alert was cleared). It prints each result and exits with 1 if any fails. All 29 pass (run with Mono on Linux; see CLAUDE.md).

The tray, the windows, watching the files and ending programs have no automated tests: try them on Windows after a change.

Troubleshooting

• The tooltip says “checking every minute”, and programs run for a while before being ended. Windows reports programs starting only to administrators. Run Process Sniper as administrator to end them as they start, or lower scan_interval_seconds.
• A program isn’t ended. Check whether it is allowed for a while (the tooltip says so), or is one of Windows’ own programs (see The blacklist). Check the rule’s spelling in the log of a real run, and whether the rule has a backslash (then it is a full path, and matches only that folder). Programs running as administrator can’t be ended unless Process Sniper runs as administrator too; the log shows “Failed (attempt n)”.
• A saved change to the settings or the blacklist doesn’t apply. Check that you saved the file in the working folder (Edit settings and Edit blacklist open the right ones). On a network drive Windows can miss a save; the change then applies within the hour, or when Process Sniper restarts.
• “history.json was damaged”. The damaged file was kept as history.damaged-<date and time>.json, and a new history started.
• “… isn’t Process Sniper’s history” or “Couldn’t open history.json”. The file was left alone and nothing is saved this session. Close whatever has it open, or move it aside, and start Process Sniper again.
• “can’t write to its folder”. The folder of ProcessSniper.exe is read-only. Move it, or use --working-folder-path.
• The build says “Cannot find the C# compiler”. It needs .NET Framework 4 (64-bit), which comes with Windows 8 and later.

Limitations

• Windows only (WMI, the tray and the registry).
• Programs are caught as they start only when it runs as administrator; otherwise at the next check.
• A program is only ended after it has started, so it may run for a moment.
• A # or // after a space in a path starts a comment (C:\My #1 Tools\x.exe doesn’t work as a rule, and Block by path says so).
• Allowing works by program name, so it allows the program wherever it runs from, and only programs ended recently are offered in the menu.
• The window follows Windows’ display scaling when it starts; moved to a monitor with other scaling, it isn’t rescaled.