Defender ships a driver built to delete locked files at boot — and its encryption key has been the same since Windows 7
2026-08-22Security
Check Point's Jiří Vinopal reverse-engineered BTR.sys, the Boot Time Removal Tool inside Defender, and showed it can be loaded to delete Defender itself in the window after the filesystem comes up but before the antivirus does. Microsoft says it needs admin rights already, so no patch is planned.