Malware of the Rootkit.Win32.PMax family aims to end all processes initiated by the antivirus software (moreover, a prohibiting DACL (Discretionary Access Control List) set for executable files will block restart of such processes).
