The only two ways to protect an external program that come to mind are neither simple nor easily implimented. The first would be true full program polymorphism, to prevent any remote hash checks of the executable memory space. The second would be a Ring0 driver hooking NtQuerySystemInformation and NtOpenProcess, as well as the Win32k.sys GUI window enumeration functions. While this is a bit less complex than true polymorphism, it's also very difficult to actually deploy, and requires a very large leap of trust on the users part. It would also be very difficult to impliment in Vista64 due to the Microsoft PatchGuard driver.
I haven't used C# enough to say if polymorphism is possible to impliment with it, but I can say that with the exception of WUDF based drivers, you are limited to C, and with some compiler tweaks, C++.
The best scenario for implimenting a polymorphic design would be to morph the code on a per user basis, before the user even received the file. This would have to be done using PHP/ASP on a web server, and would probably be rather difficult to impliment. If the code modifies itself at runtime it will still leave itself open to detection for a breif time in which the pre-morph code is visible. Even if the offending processes are frozen via SuspendThread, there will always be a small window of opportunity in which an external program could be detected.
All of this, of course, is based on the idea that Blizzard will actually impliment external process scanning as a form of detection, and being as they have had the ability to impliment it since the start of 1.11, I highly doubt it will be used anytime soon.