Layer 7 is the application layer. Snort is an Intrusion Detection System that also does packet logging and digs at least down to layer 4 so I am having trouble following your logic.....

If what you mean is that you want a daemon to kill off AIM if it starts then you could simply use Win32::Daemon from roth.net to run a search and destroy based on Win32::KillProcess or similar.