3 ring kill 360 security guard process

After a month of research , After killing the process, the driver can be loaded silently ,pac hijacked Contact in need .

Load the driver through a guard

BOOL IsElevatedAdministrator()
{
    
	BOOL fIsAdmin = FALSE;
	HANDLE hTokenToCheck = NULL;
	DWORD  lastErr;
	DWORD sidLen = SECURITY_MAX_SID_SIZE;
	BYTE localAdminsGroupSid[SECURITY_MAX_SID_SIZE];

	if (!CreateWellKnownSid(WinBuiltinAdministratorsSid, NULL,
		localAdminsGroupSid, &sidLen))
	{
    
		goto CLEANUP;
	}    
	if (CheckTokenMembership(hTokenToCheck, localAdminsGroupSid, &fIsAdmin))
	{
    
		lastErr = ERROR_SUCCESS;
	}

CLEANUP:             
	if (hTokenToCheck)
	{
    
		CloseHandle(hTokenToCheck);
		hTokenToCheck = NULL;
	}

	return (fIsAdmin);
}