Hm doesnt AV/FW killers remove the tray icon? Then the user would notice this and maybe shut off the internet accsses.

Is this possible:
A plugin or whatever that kills the AV/FW but instead of fully removing the tray, place a dummy tray icon.