Microsoft → Re: Looking for a faster way to do this

AV is Mcafee enterprise, but it is currently not running. By not running, all of the services are stopped (and have a startup type of disabled), and none of the EXE's (processes) are running for McAfee. In fact, the shield does not even show up in the system tray.

I thought of that too, which is why I turned it off to see if it made a difference.

--Brian

even if the AV is not running, the ring 3 driver still is and all file actions are passed through this.
these low level drivers can be found in device manager > view > show hidden devices > non-plug and player drivers.
im not sure of the driver name for your av though.