using System;
using System.Collections.Generic;
using System.Linq;
using System.Management;
using System.Diagnostics;

namespace Detection
{
    class Program
    {
        static void Main(string[] args)
        {
            WaitForProcess();
            CheckCurrentProcesses();
            Console.ReadLine();
        }

        private static void CheckCurrentProcesses()
        {
            Process.GetProcesses()
            .Where(p => badPrograms
            .Any(bp => p.ProcessName.ToLower().Contains(bp.ToLower()))).ToList()
            .ForEach(foundP =>
            {
                foundP.Kill();
                Console.WriteLine($"Process was killed: {foundP.ProcessName}");
            });
        }

        private static void WaitForProcess()
        {
            var startWatch = new ManagementEventWatcher(
              new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"));
            startWatch.EventArrived
                                += new EventArrivedEventHandler(StartWatch_EventArrived);
            startWatch.Start();

            var stopWatch = new ManagementEventWatcher(
              new WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace"));
            stopWatch.EventArrived
                                += new EventArrivedEventHandler(StopWatch_EventArrived);
            stopWatch.Start();
        }

        private static void StopWatch_EventArrived(object sender, EventArrivedEventArgs e)
        {
            string processName = e.NewEvent.Properties["ProcessName"].Value.ToString();
            if (badPrograms.Any(bp => processName.ToLower().Contains(bp.ToLower())))
                Console.WriteLine($"Process has closed: {processName}");
        }

        private static void StartWatch_EventArrived(object sender, EventArrivedEventArgs e)
        {
            string processName = e.NewEvent.Properties["ProcessName"].Value.ToString();
            int processId = Convert.ToInt32(e.NewEvent.Properties["ProcessId"].Value);
            if (badPrograms.Any(bp => processName.ToLower().Contains(bp.ToLower())))
            {
                Process.GetProcessById(processId).Kill();
                Console.WriteLine($"Process was killed: {processName}");
            }
        }

        private static List<string> badPrograms = new List<string>()
        {
            "Fiddler",
            "Cheat Engine",
            "Cracky",
            "Notepad"
        };
    }
}