Databases
StackOverflow2013
Postsdbo
POTerminating a protected antivirus process
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POTerminating a protected antivirus process
    primarykey
    data
    text
    <p>I am using the ESet antivirus, and recently its GUI front-end egui.exe hung and was taking 50% CPU (i.e. 100% of one core). Amazingly, I found that I cannot kill it, even with debug privilege enabled. </p> <p>Now I am curious: how do they implement such defense, and is there a way to kill it short of writing a kernel driver?</p> <p>The egui.exe process runs under a regular user (non-admin), and I try to kill it in various ways using an administrative account. Here's what I tried. </p> <ul> <li>you cannot kill it from task manager</li> <li>you cannot kill it using pskill</li> <li>you cannot kill it using process explorer, nor can you attach a debugger to it</li> </ul> <p>Then I started some programming and found that:</p> <ul> <li><p>under non-privileged user you can open it with PROSESS_TERMINATE access, but actual call to TerminateProcess() fails with error 5.</p></li> <li><p>under admin account you can open it with any access rights you want (after enabling debug privilege of course), but then calls to TerminateProcess(), GetKernelObjectSecurity(), SetKernelObjectSecurity() all fail with error 5.</p></li> </ul> <p>This definitely points to some kind of fiddling beyond just setting the process DACL, since if Terminate were not in the DACL, you would not be able to open the process with PROCESS_TERMINATE right in the first place. Are they actually intercepting Win32 API calls? If yes, then how? It's been a while since I did low level system programming, so pardon my ignorance.</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. This table or related slice is empty.
    1. USIvan Krivyakov
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POTerminating a protected antivirus process
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POTerminating a protected antivirus process
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POTerminating a protected antivirus process
      1. This table or related slice is empty.
      1. VTUpMod
    1. COWhy would you want to know that? :)
      singulars
      1. POTerminating a protected antivirus process
      1. USuser703016
    2. COAVs typically do have kernel-mode components. If you could kill it just by giving yourself highest privileges, it would be lousy protection.
      singulars
      1. POTerminating a protected antivirus process
      1. USCat Plus Plus
    3. COCan you kill it when it runs normally, or is it just when it hung that you cannot kill it ?
      singulars
      1. POTerminating a protected antivirus process
      1. USnos
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload