2

Is it because anti viurses runs in 'kernel mode' or do they have a special ACL?

I dind'nt find any thing on Google....

Improve this question
1

2 Answers 2

Reset to default
1

If you would have been able to terminate AV process, then virus process also would have been doing that, thus bypassing AV security.

Improve this answer
1
  • Most anti-virus software will tell Windows not to let it get terminated, so that viruses cannot easily kill the anti-virus.
    – TuxRug
    Jul 12, 2010 at 0:10
0

Consider that the AV program has multiple executables running.

You can easily have each executable monitor each other to see if it's been terminated (not by the AV program, of course) and then relaunch the executable that has been terminated.

Improve this answer

You must log in to answer this question.