编程把cmd.exe替换遇到了ＸＰ的文件保护对话框，怎么能让这个对话框不出现呢？

[lovememememe]

rt

[token0801]

有何企图

[lovememememe]

替换cmd.exe，监视文件操作．

[KeSummer]

注册表:

Hive: HKEY_LOCAL_MACHINE
Key: Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Name: SFCDisable
Data Type: REG_DWORD
Value: FFFFFF9D

[KeSummer]

利用Sfc.dll实现关闭文件保护:
文件保护主要是Winlogon.exe调用Sfc.dll（XP在Sfc_os.dll）实现，那么我们一定要把进程注入到Winlogon.exe中，而且需要提升自身的权限到Debug权限。

HANDLEhToken;
LUIDDebugNameValue;
TOKEN_PRIVILEGESPrivileges;
DWORDdwRet;

OpenProcessToken(GetCurrentProcess()，
TOKEN_ADJUST_PRIVILEGES&line;TOKEN_QUERY，hToken);
LookupPrivilegeValue(NULL，"SeDebugPrivilege"，&DebugNameValue);
Privileges.PrivilegeCount=1;
Privileges.Privileges[0].Luid=DebugNameValue;
Privileges.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken，FALSE，&Privileges，sizeof(Privileges)，
NULL，&dwRet);
CloseHandle(hToken);


//如何得到进程的ID我就不说了，不会的话就再学两年吧！
DWORDdwPid=GetProcessIdFromName(“Winlogon.exe”);
HANDLEProcess=OpenProcess(，FALSE，dwPid);
DWORDdwVersion;
HMODULEhSfc;
dwVersion=GetVersion();
//判断操作系统的类型
if((DWORD)(LOBYTE(LOWORD(dwVersion)))==5)
{//Windows2000/XP
if((DWORD)(HIBYTE(LOWORD(dwVersion)))==0)//Windows2000
hSfc=LoadLibrary("sfc.dll";
elseif((DWORD)(HIBYTE(LOWORD(dwVersion)))=1)//WindowsXP
hSfc=LoadLibrary("sfc_os.dll";
}
//得到函数的地址
FARPROCdwAddress=GerProcAddress(hSfc，MAKEINTRESOURCE(2));
DWORDdwThreadId;
HANDLEhThread;
//创建远线程
hThread=CreateRemoteThread(hProcess，0，0，/
(DWORD(__stdcall*)(void*))dwAddress，0，0，&dwThreadId);
WaitForSingleObject(hThread，4000);