This method is also better because previous method protected against 3 programs only and caused errors etc... This method is much better and seems stable and protect against any malicious process. It is actually partially good that Admin can close it (in case something goes wrong in progran).
...and it works without driver/DLL injection.
Yes, much better than the last self-defence. But, if malware is run as administrator, it can bypass the method (which is why I don't like it as much), and many people get infected by malware running with administrative privileges, especially people who don't know much about how it all works and securing their system.
The reason I suggested DLL injection (code injection could also be used) is because this method allows you to write to the process memory to overwrite the instructions at the target address and prevent it from even being able to make the request call to the function to terminate your process in the first place. However, this would also protect against processes running as admin. (user-mode based, but injection can occur from kernel-mode as well).
As for a driver, that'd be the most secure option. But it isn't needed for now.
Good work though, it should be all okay.
