This sort of thing is why MS implemented 'PatchGuard' on windows 10 to stop AV vendors from patching OS routines and paths. The system will now bugcheck if the checksums of certain pages change. It also does a few other thing allgedly that MS has deliberately declined to go into detail. But regardless even MS has been fighting back against this garbage.