title: Terminating a protected antivirus process
body: <p>I am using the ESet antivirus, and recently its GUI front-end egui.exe hung and was taking 50% CPU (i.e. 100% of one core). Amazingly, I found that I cannot kill it, even with debug privilege enabled. </p>
  
  <p>Now I am curious: how do they implement such defense, and is there a way to kill it short of writing a kernel driver?</p>
  
  <p>The egui.exe process runs under a regular user (non-admin), and I try to kill it in various ways using an administrative account. Here's what I tried. </p>
  
  <ul>
  <li>you cannot kill it from task manager</li>
  <li>you cannot kill it using pskill</li>
  <li>you cannot kill it using process explorer, nor can you attach a debugger to it</li>
  </ul>
  
  <p>Then I started some programming and found that:</p>
  
  <ul>
  <li><p>under non-privileged user you can open it with PROSESS_TERMINATE access, but actual call to TerminateProcess() fails with error 5.</p></li>
  <li><p>under admin account you can open it with any access rights you want (after enabling debug privilege of course), but then calls to TerminateProcess(), GetKernelObjectSecurity(), SetKernelObjectSecurity() all fail with error 5.</p></li>
  </ul>
  
  <p>This definitely points to some kind of fiddling beyond just setting the process DACL, since if Terminate were not in the DACL, you would not be able to open the process with PROCESS_TERMINATE right in the first place. Are they actually intercepting Win32 API calls? If yes, then how? It's been a while since I did low level system programming, so pardon my ignorance.</p>