需求：孩子在家用电脑上网课，总是悄悄打开游戏或视频软件

方案：指定白名单exe，打开非白名单的就自动被杀死，并记录日志供查看

不知道是否还有更好的结果方案？

import psutil
import time
import logging

# 配置日志记录，禁用缓冲
logging.basicConfig(filename='killed_exes.log', level=logging.INFO, format='%(asctime)s - %(message)s', filemode='a',
                    force=True)

# 允许访问的EXE名称清单
# allowed_exes = ['notepad++.exe','SgrmBroker.exe', 'TextInputHost.exe', 'ChsIME.exe', 'HPPrintScanDoctorService.exe', 'esif_uf.exe', 'OfficeClickToRun.exe', 'smartscreen.exe', 'dllhost.exe', 'System Idle Process', 'spoolsv.exe', 'wlanext.exe', 'fontdrvhost.exe', 'PhoneExperienceHost.exe', 'FMService64.exe', 'lkads.exe', 'msedgewebview2.exe', 'WmiApSrv.exe', 'LAVService.exe', 'Lenovo.Modern.ImController.exe', 'NisSrv.exe', 'explorer.exe', 'NVDisplay.Container.exe', 'dasHost.exe', 'Lsf.exe', 'System', 'MSOfficePLUSService.exe', 'AggregatorHost.exe', 'ldnews.exe', 'SogouCloud.exe', 'DAX3API.exe', 'usysdiag.exe', 'audiodg.exe', 'tagsrv.exe', 'csrss.exe', 'StartMenuExperienceHost.exe', 'NvTelemetryContainer.exe', 'SecurityHealthService.exe', 'rundll32.exe', 'MemCompression', 'svchost.exe', 'nimxs.exe', 'crashpad_handler.exe', 'IShowServer.exe', 'service.exe', 'sihost.exe', 'chrome.exe', 'MsMpEng.exe', 'dwm.exe', 'pdfServer.exe', 'PdsClientsDaemon.exe', 'LenovoTray.exe', 'Locator.exe', 'DSRHost.exe', 'RtkAudUService64.exe', 'Registry', 'Everything.exe', 'SearchIndexer.exe', 'Lenovo.Modern.ImController.PluginHost.Device.exe', 'lktsrv.exe', 'SecurityHealthSystray.exe', 'IShowSU.exe', 'SunloginClient.exe', 'nidmsrv.exe', 'RuntimeBroker.exe', 'unsecapp.exe', 'LenovoInternetSoftwareFramework.exe', 'python.exe', 'PDFEngine.exe', 'SearchApp.exe', 'ctfmon.exe', 'sqlwriter.exe', 'CastSrv.exe', 'taskhostw.exe', 'WmiPrvSE.exe', 'mDNSResponder.exe', 'niauth_daemon.exe', 'CompPkgSrv.exe', 'LISFService.exe', 'TestStandService.exe', 'LnvSvcFdn.exe', 'MSPCManagerService.exe', 'jhi_service.exe', 'fsnotifier.exe', 'smss.exe', 'conhost.exe', 'MpDefenderCoreService.exe', 'LenovoPcManagerService.exe', 'WUDFHost.exe', 'LockApp.exe', 'MSPCManager.exe', 'services.exe', 'lsass.exe', 'rsSyncSvc.exe', 'pycharm64.exe', 'wininit.exe', 'aDrive.exe', 'winlogon.exe', 'SyncAppServer.exe', 'LMS.exe', 'SogouImeBroker.exe']
allowed_exes = ['LnvSvcFdn.exe', 'services.exe', 'LenovoPcManagerService.exe', 'SogouImeBroker.exe',
                'SyncAppServer.exe', 'Lenovo.Modern.ImController.PluginHost.Device.exe', 'PDFEngine.exe', 'Locator.exe',
                'winlogon.exe', 'SgrmBroker.exe', 'taskhostw.exe', 'Typora.exe', 'nidmsrv.exe', 'DAX3API.exe',
                'WINWORD.EXE', 'CalculatorApp.exe', 'aDrive.exe', '猿辅导.exe', 'SecurityHealthSystray.exe',
                'MSPCManager.exe', 'WmiApSrv.exe', 'SunloginClient.exe', 'WmiPrvSE.exe', 'dwm.exe', 'sqlwriter.exe',
                'SearchIndexer.exe', 'fontdrvhost.exe', 'WUDFHost.exe', 'rundll32.exe', 'smss.exe', 'FMService64.exe',
                'YunDetectService.exe', 'iPDF Viewer.exe', 'wininit.exe', 'tagsrv.exe', 'dllhost.exe', 'NisSrv.exe',
                'CodeSetup-stable-ea1445cc7016315d0f5728f8e8b12a45dc0a7286.tmp', 'MindMaster.exe', 'usysdiag.exe',
                'System', 'iPDFUpg.exe', 'TestStandService.exe', 'Everything.exe', 'StartMenuExperienceHost.exe',
                'nimxs.exe', 'ldnews.exe', 'DSRHost.exe', 'LenovoInternetSoftwareFramework.exe', 'LockApp.exe',
                'wlanext.exe', 'IShowSU.exe', 'csrss.exe', 'LAVService.exe', 'SGTool.exe', 'MsMpEng.exe',
                'Lenovo.Modern.ImController.exe', 'notepad++.exe', 'BaiduNetdiskUnite.exe', 'RtkAudUService64.exe',
                'SearchFilterHost.exe', 'Registry', 'rsSyncSvc.exe', '小猿优课.exe', 'lsass.exe',
                'mmcrashpad_handler64.exe', 'Video.UI.exe', 'PdsClientsDaemon.exe', 'pdfServer.exe', 'sihost.exe',
                'Code.exe', 'OfficeClickToRun.exe', 'explorer.exe', 'svchost.exe', 'WiseOS.exe', 'BaiduNetdisk.exe',
                'WeChatOCR.exe', 'smartscreen.exe', 'CompPkgSrv.exe', 'jhi_service.exe', 'LenovoTray.exe', 'ctfmon.exe',
                'SearchApp.exe', 'Lsf.exe', 'PhoneExperienceHost.exe',
                'CodeSetup-stable-ea1445cc7016315d0f5728f8e8b12a45dc0a7286.exe', 'AggregatorHost.exe', 'wemeetapp.exe',
                'niauth_daemon.exe', 'msedgewebview2.exe', 'SnippingTool.exe', 'dasHost.exe', 'unsecapp.exe',
                'IShowServer.exe', 'baidunetdiskhost.exe', 'lkads.exe', 'WeChat.exe', 'lktsrv.exe',
                'NVDisplay.Container.exe', 'pycharm64.exe', 'audiodg.exe', 'esif_uf.exe', 'System Idle Process',
                'WeChatAppEx.exe', 'SearchProtocolHost.exe', 'MemCompression', 'python.exe', 'plugin_host.exe',
                'MpDefenderCoreService.exe', 'LISFService.exe', 'EXCEL.EXE', 'WeChatUtility.exe',
                'crashpad_handler.exe', 'ai.exe', 'WeChatPlayer.exe', 'fsnotifier.exe', 'TextInputHost.exe',
                'spoolsv.exe', 'splwow64.exe', 'NvTelemetryContainer.exe', 'ChsIME.exe', 'conhost.exe',
                'MSPCManagerService.exe', 'MSOfficePLUSService.exe', 'SogouCloud.exe', 'UserOOBEBroker.exe',
                'HPPrintScanDoctorService.exe', 'RuntimeBroker.exe', 'service.exe', 'FSCapture-动态截图工具.exe',
                'xnnexternal.exe', 'SecurityHealthService.exe', 'ApplicationFrameHost.exe', 'mDNSResponder.exe',
                'sublime_text.exe', 'LMS.exe', 'CastSrv.exe','cmd.exe','wemeetcrashhandler.exe','backgroundTaskHost.exe',
                'WMIC.exe','Appvant.exe']


def is_allowed_exe(exe_name):
    """检查EXE名称是否在允许访问的清单中"""
    return exe_name.lower() in [name.lower() for name in allowed_exes]


def kill_process(process_name):
    """杀死某个进程并记录到日志文件中"""
    for proc in psutil.process_iter():
        try:
            if process_name.lower() == proc.name().lower():
                proc.kill()
                logging.info(f"{process_name} killed")
                print(f"{process_name} 已被杀死")
                # 手动刷新缓冲区
                logging.getLogger().handlers[0].flush()
        except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
            pass


def monitor_and_kill_unallowed_exes(interval=1):
    """监控并杀死不在允许访问清单中的EXE"""
    while True:
        for proc in psutil.process_iter():
            try:
                exe_name = proc.name()
                if not is_allowed_exe(exe_name):
                    print(f"{exe_name} 不在允许访问清单中")
                    kill_process(exe_name)
            except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
                pass
        time.sleep(interval)


if __name__ == "__main__":
    monitor_and_kill_unallowed_exes()