Re:MS Windows Defender and DeCSS
by AnIdiotOnTheNet on Thursday July 22, 2021 @12:09PM
(#27920626)
I think application whitelisting by signature is a better fit for that use case. If for some reason you are required to allow arbitrary applications then the malware protection is probably going to cause more problems than it solves anyway.
And yeah they do boot from a readonly C: with some magic to make it appear writable per session. But re-infection is quick, especially when you have extra writable data partitions.