Just thought I would post a suggestion;
What I do and I find quite useful is making my task engine start my AV Software as SYSTEM at log-on of any user. So even if he user disables it it is still running in the background
Im not sure if this works, as far as I can see it does. I tried to let a virus into my computer before. I killed the AV that started but when I went to taskmgr I seen it still running as SYSTEM. That would explain why it keep stopping the virus
Good for users who try to install spyware on your computer with physical access. Even another admin would not realise what was wrong