3 ms·
These files cannot be deleted or modified by the user, even with admin privs. That would make it trivial to disable the antivirus. It's only possible by mountin
by mr_mitm 2y ago
These files cannot be deleted or modified by the user, even with admin privs. That would make it trivial to disable the antivirus. It's only possible by mounting the file system in a different OS, which is typically prevented by Bitlocker.
- jonhohle 2y agoThe files are deletable through safe mode, no? I’m assuming they are writable by a program outside of the driver, right?
- mr_mitm 2y agoYes, but you need the Bitlocker key to get into safe mode
- discostrings 2y agoNot in the BitLocker configurations I've seen over the last few days. The file is deletable as a local administrator in safe mode without the BitLocker recovery key in at least some configurations.