Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is it because anti viurses runs in 'kernel mode' or do they have a special ACL?

I dind'nt find any thing on Google....

share|improve this question

migrated from stackoverflow.com Jul 11 '10 at 21:21

This question came from our site for professional and enthusiast programmers.

    
This is a programming forum. Try superuser.com –  nickf Jul 11 '10 at 21:18

2 Answers 2

If you would have been able to terminate AV process, then virus process also would have been doing that, thus bypassing AV security.

share|improve this answer
    
Most anti-virus software will tell Windows not to let it get terminated, so that viruses cannot easily kill the anti-virus. –  TuxRug Jul 12 '10 at 0:10

Consider that the AV program has multiple executables running.

You can easily have each executable monitor each other to see if it's been terminated (not by the AV program, of course) and then relaunch the executable that has been terminated.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.