further thought:

Under Windows "Direct I/O" is used - I suspect this does not allow any virus checker to get its hooks in: http://www.ixora.com.au/notes/direct_io.htm