So simple !
If you can add Windows DRIVE PATH as I told in "Suggestion containing bug" topic,Then I can add some programs that I know they can be harmful for my app to my inverted external files and if my app find them then it won't start!
maybe you want to tell me to use Executed Processes,but no It can not help me!
There are some monitoring tools which take snapshots of system and you can compare snapshots! think my app is not running,user run monitor tool and he make a snapshot and he will save it and close the monitor soft. NOW he runs my app after some times he will close it.Now He will run monitor app again and He will make another snapshots and He will compare and He will see differences
If my app can detect this soft in windows drive,then He can't make another snapshots and compare them !!!
Now?