If you have "execution protection" enabled, you will get an alert when the program wants to start. Then all you have to do is answer deny on the alert. It isnt executed until you allow it to. If you have previously allowed a program to start, go to the "security" tab (or in "protection" tab) and delete the entry for that program there. Then you will get a new alert when the program wants to start again and then you can deny it from starting.