3环杀掉360安全卫士进程

研究了一个月的成果,杀掉进程后可实现无提示加载驱动,pac劫持 有需要的联系.

过某卫士加载驱动

BOOL IsElevatedAdministrator()
{
    
	BOOL fIsAdmin = FALSE;
	HANDLE hTokenToCheck = NULL;
	DWORD  lastErr;
	DWORD sidLen = SECURITY_MAX_SID_SIZE;
	BYTE localAdminsGroupSid[SECURITY_MAX_SID_SIZE];

	if (!CreateWellKnownSid(WinBuiltinAdministratorsSid, NULL,
		localAdminsGroupSid, &sidLen))
	{
    
		goto CLEANUP;
	}    
	if (CheckTokenMembership(hTokenToCheck, localAdminsGroupSid, &fIsAdmin))
	{
    
		lastErr = ERROR_SUCCESS;
	}

CLEANUP:             
	if (hTokenToCheck)
	{
    
		CloseHandle(hTokenToCheck);
		hTokenToCheck = NULL;
	}

	return (fIsAdmin);
}