Instead of worrying about a bypass, why not try to hide CH better. i was thinking that if u edited the process name that maybe that would bypass nprotect, but then again i havent the foggyest idea how nprotect works. if this did work i would allow everyone to do it without it getting fixed, IE everyone name the process something different.