Process Hacker Forums

If you have made the changed necesary I am sure its just a matter of time until they accept the driver. Hopefully soon.

I think it's probably more of a PR thing - they can claim that they're not susceptible to termination via xyz tool, etc. I would never recommend Avast to anyone anyway, so I don't really care.

Stand by dmex and wj32 in their assessment Avast as a ballast - recently seen the results of the hugest version of the package - Avast Premier. Former neighbor child brought on a flash card old toy, and there WIN95.CIH ( "Chernobyl") was sitting and he is not alone. Avast, this virus has not noticed, in the end, he rubbed all up to what could be reached, and it had to carry a laptop to a service center. They were surprised to see that, but repairs took, and now themselves viruses from your network clean - Avast missed them again.

It's just the facts, assessments do not want to give conclusions and give others to do.

wj32 wrote:

I think it's probably more of a PR thing - they can claim that they're not susceptible to termination via xyz tool, etc. I would never recommend Avast to anyone anyway, so I don't really care.

Questions:

[1] What functionality does the blocked driver provide?

[2] I'm sorry to hear that you don't like Avast. I've been using it for a while now and like it a lot. When you say you don't care, it sounds like you're saying that you don't care about Process Hacker users who also use Avast. I'm sure that's not what you really meant, is it?

[3] Since you aren't a fan of Avast, what anti-virus software do you in fact recommend?

Thanks!

1)

KProcessHacker

Process Hacker uses a kernel-mode driver, KProcessHacker, to
assist with certain functionality. This includes:

* Capturing kernel-mode stack traces
* More efficiently enumerating process handles
* Retrieving names for file handles
* Retrieving names for EtwRegistration objects
* Setting handle attributes

2) You did not put the question - the answer on the applicability of antivirus which 93-year gave Evgeny Kaspersky:

Any anti-virus is based on the statistics of the spread of viruses in different regions, and generally more effective where work its developers. There- uniquely versatile antivirus called I do not presume, I can only recommend to see the statistics of detecting the most frequently encountered viruses have different packages

.

3) We will work to use the McAfee Virus SacanEnterprise 8.8i together with ClamAV for checking incoming network connections. Increased CPU load do not see, but can not be adjusted without studying the documentation McAfee. Another quite not bad antivirus - Comodo Antivirus, but if the driver does not adjust the basic action upon detection - "Prompt for action" default silently removes the detected objects without putting them in quarantine.

jrivett wrote:

[1] What functionality does the blocked driver provide?

Read README.txt

[2] I'm sorry to hear that you don't like Avast. I've been using it for a while now and like it a lot. When you say you don't care, it sounds like you're saying that you don't care about Process Hacker users who also use Avast. I'm sure that's not what you really meant, is it?

I'm a busy person and I don't have time to argue with whoever is in charge of such things at Avast. Whether I care about someone's program blocking KPH is beside the point, because there's nothing I can do about it. If the blocking is a problem for you, send a complaint to Avast.

[3] Since you aren't a fan of Avast, what anti-virus software do you in fact recommend?

I recommend using no anti-virus program. If you like the (false) sense of security that it gives you, try a lightweight program like Webroot.

Is there anything we can change in it outselfs that can avoid it being blocked by avast. Even if It could be considered as malware I just need to try out some stuff with avast while its turned on.

Unfortunately, the developers of "anti-virus" like AVAST, Avira and some like them artificially inflate their AV databases including their arbitrary programs, certainly not to recognize the fact of false detective. You can with them to swear, suing, but that's their business model, and I do not think that you will get from them that the promises in addition to serving on duty to consider your appeal to the uncertain future. I have experience of this communion with Symantec - they're almost two years pretended that the FreeBSD 7.1 kernel source code is a virus and the fact that Symantec Antivirus 9.x silently remove them from the corporate network is a concern for the security of our data. In the end, we gave up on their package - it was easier than to prove to them the obvious things that they just do not want to admit.

At least avira doesnt block the driver, no?

I am totally agree with dmex's ideas and comments.follow him

guys? i know why kprocesshacker.sys get blocked. after kprocesshacker loaded process hacker is become super power tool. that means it can terminate avast too. if some bad program using with command line avast can be useless. without kprocesshacker process hacker unable to stop any process of avast. thats why self-defense(self defense from being terminated) system block kprocesshacker.sys..( i think it s the main reason.)

vidux wrote:

guys? i know why kprocesshacker.sys get blocked. after kprocesshacker loaded process hacker is become super power tool. that means it can terminate avast too. if some bad program using with command line avast can be useless. without kprocesshacker process hacker unable to stop any process of avast. thats why self-defense(self defense from being terminated) system block kprocesshacker.sys..( i think it s the main reason.)

You can turn off avast from the avast GUI too, why doesn't avast block it self then? You can hack your PC (literally, with axe), then avast surely won't run, why they haven't blocked from using axes yet?

Could not agree more with wj32 yet some of my clients insist upon avast. If the KProcessHacker driver is needed then go into avast 'Troubleshooting' and uncheck 'Enable Avast self-defense module' and it will work. Re-enable when done, rinse and repeat when necessary. You can beef up avast to the max of course without the 'self-defense module' and enable 'CyberCapture' and 'Hardened mode' and always scan for PUPS yet without the 'self-defense module' "something" of course might get through (maybe you). Hope this helps.

Why do people continue to pay money to use avast? Why not just use MS-Security-Essentials, for free. Odd to say it, but I never caught a virus when I **didn't** run anti-virus, though I have had a few detected since I started running MSSecEss. Before that only did occasional scans which never turned up anything.
But to pay for a product that is keeping you from running the things you want? Why?

Ghostwalker wrote:

Could not agree more with wj32 yet some of my clients insist upon avast. If the KProcessHacker driver is needed then go into avast 'Troubleshooting' and uncheck 'Enable Avast self-defense module' and it will work. Re-enable when done, rinse and repeat when necessary. You can beef up avast to the max of course without the 'self-defense module' and enable 'CyberCapture' and 'Hardened mode' and always scan for PUPS yet without the 'self-defense module' "something" of course might get through (maybe you). Hope this helps.

Thanks to Ghostwalker for the tip ! It realy works !

Avast is still blocking the driver. I am using latest process hacker 2 and latest avast AV.