It turns out that the AVP installation package is installed after the installation of the mandatory shutdown, it does not send a WM_QUERYENDSESSION message with the form, and there is no way to hook this message, and the installation package production has fallen into a dilemma. By the way, you can take the following ideas. 1. Detailed description of the SETUP package to the AVP (you can try to contact Russia) 2. After the existing AVP installation package is installed, it is first set up the SETUP process permission, then runs the exitwindowsex ewx_force parameter, you can debug the setup.exe file, remove its exitWindowsex parameters so that he will send a WM_QueryEndSession message, then use hook, Intercepted this message. 3. Go back to the previous production method, after the installation is complete, then find the Reload to its virus library. It should be able to solve tomorrow. . . hope so
