NIFO: remove AV/EDR with physical access