I've come across a troublesome process which refuses to allow CreateToolhelp32Snapshot().
I also noticed that in sysinternals process explorer it shows "Access Denied" for other things too, such as file path, even when running as admin or even NT AUTHORITY\SYSTEM.
Does anyone have any idea how they could've achieved this? The only way I could think of would be using some sort of kernel mode driver and doing some voodoo magic.
I'd appreciate any ideas