[GordonS]

I was just wondering if a no-op AV might work! But I thought perhaps not, as I thought Microsoft insisted on AVs running as PP/PPL (Protected Process / Protected Process Light), which isn't realistic for OSS.

Are you able to point to one please? Would love to try it and see if it works!

[PKop]

Isn't this what this post is about?

[GordonS]

Ach, I think you're right, that looks to be what they're doing.