threatfire warning

[Lisandro]

Still want to know why does this happen…

[DavidR]

@j.m.reid post:20

Have restored files quarantined by Threatfire as suggested , updated Avast and now , like " Northeast " have 6 out of 7 running once more .As “DavidR” states , the one not running is Outlook/Exchange which is not required . All back to normal , many thanks to all for help given.

You’re welcome.

@Tech post:21

Still want to know why does this happen…

Well security applications will to a certain extent have the power to kill processes even with avast’s self-defence enabled (after all some malware can) or similar to some security software it could be removed on the next boot, etc.

I don’t know if Alwil would know how MBAM removed the ashDisp.exe file and presumably the associated registry entries as MBAM would I’m sure not divulge how they do it.

[igor0]

As Vlk surely said somewhere, the self-defense is effective against user-mode code only.
Once you allow an application to load a kernel code (i.e. a driver), there isn’t much you can do to fight it.

[DavidR]

Thanks Igor.

[Lisandro]

@igor post:23

As Vlk surely said somewhere, the self-defense is effective against user-mode code only.
Once you allow an application to load a kernel code (i.e. a driver), there isn’t much you can do to fight it.

Are you sure that this happen with other antivirus also?
I’ve heard that some of them claim to be invulnerable even at driver level. Is it possible?

[system]

I’ve been using Avast with Threatfire for quite some time and this just started. I’ve been working with PCTools as well. I sent a link to this threadyesterday as well as a PM. They have yet to reply. They’re always prompt. This tells me they are working on it as well.