logoalt Hacker News

rcxdudeyesterday at 9:02 AM0 repliesview on HN

Nope, AV hooks into the filesystem layer (the NT kernel has 'filesystem filters' for this) and intercepts all reads and writes on the system.