Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have antivirus service (Kaspersky) that occasionally becomes unresponsive to the normal stop/stop gui interface provided by said vendor. I would like to find a way to kill the service for a restart without rebooting, however all attempts I have tried result in failure with an 'Access is Denied' error. These include:

  • Services Control Panel (grayed out stop button)
  • Task Manager
  • Killing Process Explorer Killing
  • command line net and sc stopping
  • runas with domain admin using net stop

Some details include:

  • Machine: Windows Vista
  • Service Type: 10 WIN32_OWN_PROCESS
  • Service State: 4 Running (NOT_STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
share|improve this question

migrated from stackoverflow.com Nov 2 '09 at 7:12

This question came from our site for professional and enthusiast programmers.

add comment

4 Answers 4

If Process Explorer is unable to kill the process when running as administrator (this is important, non-admins can only kill their own processes), then it is really unkillable (Process Explorer will use all methods including debug APIs).

As an AV system it seems likely that it is unkillable because threads are blocked in the kernel (these have to return before they and their process can be terminated).

This is probably a problem in Kaspersky's driver mode code, check with them for updated software or consider a different anti-malware solution.

share|improve this answer
add comment

A solution might be found in supershell, or the later grootshell from the same site:

A rootshell for nt/2k/xp. Well, actually a shell that runs in the security context of the NT SYSTEM/AUTHORITY, which means the user has ie. the right to use task manager to kill running services. Yipee! Idea originally from some MS sample sourcecode from the MSDN, NT only, adapted to work on both 2000 and XP. Whole lotta fun!

Note: You already need administrative (ie. debug) privileges to run it. The whole point is that you run a shell in the security context of the NT SYSTEM/AUTHORITY (the context a System service sees) not the context of an Administrator with GUI login. If that doesn't make sense to you, don't use supershell.

share|improve this answer
1  
"psexec -s" will run any process (including cmd or PowerShell) as a system process, and has existed for years. This saves learning a new shell. –  Richard Nov 2 '09 at 11:34
1  
@Richard: absolutely right. Why don't you put it up as an answer? –  harrymc Nov 2 '09 at 11:39
add comment

@richard states:

If Process Explorer is unable to kill the process ... then it is really unkillable.

Not correct, there are certain processes I couldn't kill with Process Explorer but with other tools like rootkitunhooker.exe.

Also Process Explorer does not show RootKit processes, so it also can not kill them.

I usually use the "psexec -s" approach.

pskill.exe may not work within psexec -s, but I have described a workaround for that.

share|improve this answer
add comment

Kaspersky is protecting itself from viruses like this.

Go into the settings of Kaspersky and remove the check at a setting, which is called somewhat like "Protect service from closing". I don't know the exact phrase, because I use the german UI.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.