[Creat0R]

А вот вариант куда более примитивный (для Fat):

Код:

HotKeySet("{ESC}", "Quit")

;Global $sBlock_Password = "Pass"

Global $sBlockFiles_List = "C:\Temp\Readme.txt|C:\Temp\Web.doc|C:\Temp\DXSETUP.exe"
Global $aBlockFiles_List = StringSplit($sBlockFiles_List, "|")

While 1
    Sleep(1000)

    $aProcess_Info = _ProcessesGetInfo()

    For $i = 1 To UBound($aProcess_Info)-1
        For $j = 1 To $aBlockFiles_List[0]
            If StringInStr($aProcess_Info[$i][1], $aBlockFiles_List[$j]) Or $aProcess_Info[$i][7] = $aBlockFiles_List[$j] Then
                _BlockFile_Proc($aBlockFiles_List[$j], $aProcess_Info[$i][26])
                ExitLoop
            EndIf
        Next
    Next
WEnd

Func _BlockFile_Proc($sFile, $iProc)
    ;_ProcessSuspendSwitch($iProc, True)

    Local $hBlockedFile_Win = _ProcessGetWindow($iProc)

;~  Local $s_Password = InputBox(StringFormat("File Blocked (%s) - Attention!", StringRegExpReplace($sFile, "^.*\\", "")), _
;~      "Blocked File Execution attempt. Please insert password to unlock it:", "", "*", 300, 120, -1, -1, 0, $hBlockedFile_Win[1])

    MsgBox(262144+48, "File Blocker - Attention!", _
        StringFormat("You are not allowed to open this File (%s)", _
            StringRegExpReplace($sFile, "^.*\\", "")), 0, $hBlockedFile_Win[1])

    ;If $s_Password = $sBlock_Password Then Return _ProcessSuspendSwitch($iProc, False)
    Return ProcessClose($iProc)
EndFunc

Func _ProcessesGetInfo()
    Local $oColItems, $objWMIService, $objItem, $cI_Compname = @ComputerName
    Local $aProcessInfo[1000][42], $i = 1

    $objWMIService = ObjGet("winmgmts:\\" & $cI_Compname & "\root\CIMV2")
    $oColItems = $objWMIService.ExecQuery("SELECT * FROM Win32_Process", "WQL")

    If Not IsObj($oColItems) Then Return SetError(1, 2, 0)

    For $objItem In $oColItems
        $aProcessInfo[$i][0]  = $objItem.Name
        $aProcessInfo[$i][1]  = $objItem.CommandLine
        $aProcessInfo[$i][2]  = $objItem.CreationClassName
        $aProcessInfo[$i][3]  = $objItem.CreationDate
        $aProcessInfo[$i][4]  = $objItem.Description
        $aProcessInfo[$i][5]  = $objItem.CSCreationClassName
        $aProcessInfo[$i][6]  = $objItem.CSName
        $aProcessInfo[$i][7]  = $objItem.ExecutablePath
        $aProcessInfo[$i][8]  = $objItem.ExecutionState
        $aProcessInfo[$i][9]  = $objItem.Handle
        $aProcessInfo[$i][10] = $objItem.HandleCount
        $aProcessInfo[$i][11] = $objItem.KernelModeTime
        $aProcessInfo[$i][12] = $objItem.MaximumWorkingSetSize
        $aProcessInfo[$i][13] = $objItem.MinimumWorkingSetSize
        $aProcessInfo[$i][14] = $objItem.OSCreationClassName
        $aProcessInfo[$i][15] = $objItem.OSName
        $aProcessInfo[$i][16] = $objItem.OtherOperationCount
        $aProcessInfo[$i][17] = $objItem.OtherTransferCount
        $aProcessInfo[$i][18] = $objItem.PageFaults
        $aProcessInfo[$i][19] = $objItem.PageFileUsage
        $aProcessInfo[$i][20] = $objItem.ParentProcessId
        $aProcessInfo[$i][21] = $objItem.PeakPageFileUsage
        $aProcessInfo[$i][22] = $objItem.PeakVirtualSize
        $aProcessInfo[$i][23] = $objItem.PeakWorkingSetSize
        $aProcessInfo[$i][24] = $objItem.Priority
        $aProcessInfo[$i][25] = $objItem.PrivatePageCount
        $aProcessInfo[$i][26] = $objItem.ProcessId
        $aProcessInfo[$i][27] = $objItem.QuotaNonPagedPoolUsage
        $aProcessInfo[$i][28] = $objItem.QuotaPagedPoolUsage
        $aProcessInfo[$i][29] = $objItem.QuotaPeakNonPagedPoolUsage
        $aProcessInfo[$i][30] = $objItem.QuotaPeakPagedPoolUsage
        $aProcessInfo[$i][31] = $objItem.ReadOperationCount
        $aProcessInfo[$i][32] = $objItem.ReadTransferCount
        $aProcessInfo[$i][33] = $objItem.SessionId
        $aProcessInfo[$i][34] = $objItem.Status
        $aProcessInfo[$i][35] = $objItem.ThreadCount
        $aProcessInfo[$i][36] = $objItem.UserModeTime
        $aProcessInfo[$i][37] = $objItem.VirtualSize
        $aProcessInfo[$i][38] = $objItem.WindowsVersion
        $aProcessInfo[$i][39] = $objItem.WorkingSetSize
        $aProcessInfo[$i][40] = $objItem.WriteOperationCount
        $aProcessInfo[$i][41] = $objItem.WriteTransferCount

        $i += 1
    Next

    $aProcessInfo[0][0] = $i-1
    ReDim $aProcessInfo[$i][42]

    If $aProcessInfo[0][0] < 1 Then Return SetError(1, 1, 0)

    Return $aProcessInfo
EndFunc

Func _ProcessGetWindow($iPID)
    Local $aWinList = WinList()
    Local $aRet[2]

    If IsString($iPID) Then $iPID = ProcessExists($iPID)

    For $i = 1 To UBound($aWinList)-1
        If WinGetProcess($aWinList[$i][1]) = $iPID Then
            $aRet[0] = $aWinList[$i][0] ;Title
            $aRet[1] = $aWinList[$i][1] ;WinHandle

            Return $aRet
        EndIf
    Next

    Return SetError(1, 0, $aRet)
EndFunc

Func _ProcessSuspendSwitch($iPIDOrName, $iSuspend = True)
    If IsString($iPIDOrName) Then $iPIDOrName = ProcessExists($iPIDOrName)
    If Not $iPIDOrName Then Return SetError(1, 0, 0)

    Local $aNtSuspResumProc
    Local $ah_OpProcess = DllCall("kernel32.dll", 'int', 'OpenProcess', 'int', 0x1F0FFF, 'int', False, 'int', $iPIDOrName)

    If $iSuspend Then
        $aNtSuspResumProc = DllCall("ntdll.dll", "int", "NtSuspendProcess", "int", $ah_OpProcess[0])
    Else
        $aNtSuspResumProc = DllCall("ntdll.dll", "int", "NtResumeProcess", "int", $ah_OpProcess[0])
    EndIf

    DllCall('kernel32.dll', 'ptr', 'CloseHandle', 'ptr', $ah_OpProcess)

    If IsArray($aNtSuspResumProc) Then Return 1
    Return SetError(2, 0, 0)
EndFunc

Func Quit()
    Exit
EndFunc

Работает не для всех файлов, зависит от приложения сопоставленного с типом файла.

Тестировалось на: WinXP SP3 FS:NTFS »

Работает и в «WinXP SP2 FS:FAT»