Legitimate versions of RemoveWAT 2.2.6 trigger 30+ antivirus detections (HackTool:Win32/WatRemover). While early versions were false positives caused by the patching behavior, modern antivirus correctly identifies it as a "Removal Tool" for Microsoft DRM.

Unlike "loaders" that emulate a BIOS to trick Windows, RemoveWAT uses a more aggressive "hacking" method: Disables Protection