Process Hacker Forums

Hi.
Some times ago (about 2 weeks) ProcessHacker have stoped load KProcessHacker.sys driver.
I use ProcessHacker 2.36 (r61530. Tried on Windows 7 SP1 (x86 and x54) and Windows 10 x64. Driver does not loaded on all systems.
Also I try to start it from "Create service..." and got error too.

Please, check it.

You need to select the Hacker menu > Show details for all processes.

The + symbol in the window title indicates if KPH has been loaded and connected

Thank you for reply.

I'm sorry, but I can't find "Show details for all processes" in Hacker menu: Also, on Win 7 x86, when I selected menu Tools > Hidden processes, I got error: Before I saw KProcessHacker in Services list, now it is not there.

To install the driver need administrator rights and knowledge, or use the installer. Version without installation (zip) does not install the driver.

viksoftru wrote:

Version without installation (zip) does not install the driver.

It does.

viksoftru wrote:

To install the driver need administrator rights and knowledge, or use the installer. Version without installation (zip) does not install the driver.

I know about it and it has administrator rights.
The most strange thing is that it work good (load driver) all time until middle of August and then stop loaded driver on all systems (Win 7 32/64 and Win 10 x64). The ProcessHacker version stay the same and systems was the same.
I think, maybe Microsoft made same updates which block KProcessHacker driver. May developer check it?

gh05t wrote:

I think, maybe Microsoft made same updates which block KProcessHacker driver. May developer check it?

We haven't found issues that could have been caused by any Microsoft updates. Do you still have this problem?

dmex wrote:

gh05t wrote:

I think, maybe Microsoft made same updates which block KProcessHacker driver. May developer check it?

We haven't found issues that could have been caused by any Microsoft updates. Do you still have this problem?

Yes, I still not see kprocesshacker in Services list and can not start it manually.

My system: Win 7 SP1 x86. UAC is switched off. I run ProcessHacker "as Administrator".

I noticed in your screenshot that you have Avast running. I performed some tests and discovered that Avast is silently blocking our driver.

I have contacted Avast about this and I'll update the thread if there's any new information.

Microsoft is not likely to do such a thing.

You should switch to x64 ASAP and uninstall Avast (or any other security software you have). 32-bit is very outdated.

wj32 wrote:

Microsoft is not likely to do such a thing.

You should switch to x64 ASAP and uninstall Avast (or any other security software you have). 32-bit is very outdated.

On my other system (Win 10 Pro, x64) situation the same. I think problem in Avast, if it block driver it do it silently (no warning about virus or other other security reasons). I'll try uninstall Avast to check it, because switch off protection does not help.

The next version of KPH will implement image verification, and will not be blocked by Avast.

dmex wrote:

I have contacted Avast about this and I'll update the thread if there's any new information.

We have been discussing this with Avast over the last few weeks... Avast has agreed to notify users when our driver has been blocked but will not be unblocking our driver.

When I run Proccess Hacker avast say to me "Blocked by Avast self-defense: kprocesshacker.sys (path to \ProcessHacker.exe).

Are you using the latest version of PH?

Hi. I've the same issue here: I'm runnung PH 2.39.124 and latest Avast (11.2.2261 but it returned the same pop-up even with 11.2.2260 if I remember correctly).
With Windows XP 32bit (on my old notebook) everything is fine but when I try PH on Windows 10 both on my notebook and desktop, here we go with Avast pop-up.
Thanks!

Same here. Just updated Avast to latest version and now when I run Process Hacker 2.39.124, Avast pops up this message:
"Blocked by Avast self-defence. kprocesshacker.sys (C:\Program Files\Process Hacker 2\ProcessHacker.exe)"
I've added kprocesshacker.sys and ProcessHacker.exe to the global excludes, and to the File System Shield excludes, but it didn't help.
Process Hacker still works, but with limited functionality.
Windows 8.1 64 bit.

Same here I cant use PH on my laptop that has avast.. Well I can use it but without the driver.

When I had installed avast on my machine (in order to attempt bypass its HIPS) it also used to block kprocesshacker for self defense reasons. In avast 2015 it created named devices named the same as kprocesshacker's devices.
Since avast was SERVICE_BOOT_START but kprocesshacker.sys only SERVICE_SYSTEM_START kproceshacker.sys could not create its device, because it was already there created by avast.
Funny idea.. But do these guys think kprocesshacker is the only thing which could be "dangerous" to avast?

Kind regards,
Microwave89

I think its quite stupid of them to be honest. They have bigger fish to catch than not letting a signed driver to be installed...