PDA

View Full Version : is this an Weakless of NOD32 ?


goldapple
May 22nd, 2007, 11:35 PM
I found NOD32 will be killed just only use two command:

sc config nod32krn start= disabled
Taskkill /fi "imagename eq nod32krn.exe" /f

is this a weakless of NOD32 ? why NOD32 don't have process protection mechanism ?

Proactive Services
May 23rd, 2007, 03:56 AM
You'll also find that deleting system files, moving registry hives, breaking security permissions and disabling your firewall will also break your computer.

What our suggestions have in common is that you have to be an Administrator to do so. If you run as an Administrator you must accept that malicious code can do what it wants if it manages to infect your computer.

jftuga
May 23rd, 2007, 03:41 PM
Could Nod32 monitor for events such as it's service being disabled and then present a warning dialog box and/or email warning?

-John

Proactive Services
May 24th, 2007, 07:57 AM
I've known NOD32 to email me a notification when it could not load a driver or experienced other problems but it doesn't seem to do this if the service is disabled - assumedly the service itself is used to send email.

However, upon a system start when the service is disabled NOD32 does provide an on-screen warning informing the user.

lodore
May 24th, 2007, 01:53 PM
some av's have self protection that stop the av from being stopped.
e.g. kaspersky and norton.
i think eset should add it to version 3.0
i know the service restarts if ended but it can still be disabled is the point.
lodore

Marcos
May 24th, 2007, 02:49 PM
Everything can be disabled if you know how to. NOD32 already has a protection mechanism against killing its kernel process.