You'll have to disable WFP.
WFP may be disabled by undocumented registry value. Go to
hxxp://www.collakesoftware.com/aboutwfp.htm
and read it carefully.
Then you have to patch sfc/sfc_os.dll and replace it using ERD. After it you can do anything you want. If you just replace kernel32.dll even using ERD, you'll see the result very soon Either Windows silently will replace it back, or you'll have to reinstall your Windows machine.