Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it because anti viurses runs in 'kernel mode' or do they have a special ACL?

I dind'nt find any thing on Google....

share|improve this question

migrated from Jul 11 '10 at 21:21

This question came from our site for professional and enthusiast programmers.

This is a programming forum. Try – nickf Jul 11 '10 at 21:18

If you would have been able to terminate AV process, then virus process also would have been doing that, thus bypassing AV security.

share|improve this answer
Most anti-virus software will tell Windows not to let it get terminated, so that viruses cannot easily kill the anti-virus. – TuxRug Jul 12 '10 at 0:10

Consider that the AV program has multiple executables running.

You can easily have each executable monitor each other to see if it's been terminated (not by the AV program, of course) and then relaunch the executable that has been terminated.

share|improve this answer

You must log in to answer this question.