How can I use CBProcess to prevent a process from being started?

To prevent a process from being started with the CBFS Filter product's CBProcess component, implement the ProcessCreation and do the following: validate the new process using the information provided by the event parameters, and if you wish to prevent it from starting, return the Windows error code ERROR_ACCESS_DENIED (5) using the event's ResultCode parameter.

Monitoring of process creation is covered in more detail in this article