Behavioral Analysis

chcp.com chcp 866

cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\test22\AppData\Local\Temp\RarSFX0\" "

findstr.exe findstr /c:"(" /c:")"

reg.exe reg query "HKU\S-1-5-19"

cmd.exe C:\Windows\system32\cmd.exe /c reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AutoLogonSID" 2>nul

NSudoLC.exe NSudoLC -U:T -P:E -UseCurrentConsole "C:\Users\test22\AppData\Local\Temp\RarSFX0\DefenderKiller.bat"

cmd.exe C:\Windows\system32\cmd.exe /c 2>nul reg query "HKLM\System\CurrentControlSet\Services" /f "webthreatdefusersvc*" /k|findstr H

mode.com Mode 80,45

nircmd.exe nircmd win center process cmd.exe

nircmd.exe nircmd win settext foreground "DK"

reg.exe reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"

find.exe find /i "0x0"

sc.exe sc query WinDefend

sc.exe sc query WdNisSvc

sc.exe sc query Sense

sc.exe sc query wscsvc

sc.exe sc query SgrmBroker

sc.exe sc query SecurityHealthService

sc.exe sc query webthreatdefsvc

sc.exe sc query webthreatdefusersvc

sc.exe sc query WdNisDrv

sc.exe sc query WdBoot

sc.exe sc query WdFilter

sc.exe sc query SgrmAgent

sc.exe sc query wtd

sc.exe sc query MsSecWfp

sc.exe sc query MsSecFlt

sc.exe sc query MsSecCore

cecho.exe cecho.exe {03}Состояние процессов защитника:{\n #}

cecho.exe cecho.exe {0a}SmartScreen{\n #}

cecho.exe cecho.exe {0a}MsMpEng{#} {08} [Antimalware Service Executable]{\n #}

cecho.exe cecho.exe {0a}SgrmBroker{#} {08}[Брокер среды выполнения System Guard]{\n #}

cecho.exe cecho.exe {0a}uhssvc{#} {08} [Microsoft Update Health Service]{\n #}

cecho.exe cecho.exe {0a}NisSrv{#} {08} [Network Realtime Inspection]{\n #}

cecho.exe cecho.exe {0a}MpCmdRun{#} {08} [Microsoft malware protection]{\n #}

cecho.exe cecho.exe {0a}MPSigStub{#}{08} [Malware Protection Signature Update Stub]{\n #}

cecho.exe cecho.exe {0a}SHealthUI{#}{08} [Безопасность Windows]{\n #}

cecho.exe cecho.exe {0a}HealthTray{#}{08} [SecurityHealthSystray иконка в трее]{\n #}

cecho.exe cecho.exe {0a}HealthServ{#}{08} [SecurityHealthService]{\n #}

cecho.exe cecho.exe {0a}HealthHost{#}{08} [SecurityHealthHost]{\n #}{\n #}

cecho.exe cecho.exe {03}Состояние служб и драйверов защитника:{\n #}

cecho.exe cecho.exe {0a}webthreat{#} {08}[Служба защиты от Веб-угроз - webthreatdefsvc]{\n #}

cecho.exe cecho.exe {0a}webthreatu{#} {08}[Служба защиты пользоват. от Веб-угроз - webthreatdefusersvc]{\n #}

cecho.exe cecho.exe {0c}WinDefend{#} {08} [Служба Антивирусная программа Защитника Windows]{\n #}

cecho.exe cecho.exe {0a}WdNisSvc{#} {08} [Служба проверки сети Windows Defender Antivirus]{\n #}

cecho.exe cecho.exe {0a}Sense{#} {08} [Служба Advanced Threat Protection]{\n #}

cecho.exe cecho.exe {0c}wscsvc{#} {08}[Служба Центр обеспечения безопасности]{\n #}

cecho.exe cecho.exe {0a}SgrmBroker{#} {08}[Служба Брокер мониторинга среды выполнения System Guard]{\n #}

cecho.exe cecho.exe {0a}SHealthSer{#} {08}[Служба Центр безопасности Защитника Windows]{\n #}

cecho.exe cecho.exe {0a}WdNisDrv{#} {08}[Драйвер WD Network Inspection Driver]{\n #}

cecho.exe cecho.exe {0a}WdBoot{#} {08}[Драйвер WD Antivirus Boot Driver]{\n #}

cecho.exe cecho.exe {0a}WdFilter{#}{08} [Драйвер WD Antivirus Mini-Filter Driver]{\n #}

cecho.exe cecho.exe {0a}SgrmAgent{#}{08} [Драйвер System Guard Runtime Monitor Agent Driver]{\n #}

cecho.exe cecho.exe {0a}wtd{#}{08} [Драйвер WTD Driver]{\n #}

cecho.exe cecho.exe {0a}MsSecWfp{#}{08} [Драйвер Microsoft Security WFP Callout Driver]{\n #}

cecho.exe cecho.exe {0a}MsSecFlt{#}{08} [Драйвер Security Events Component Minifilter]{\n #}

cecho.exe cecho.exe {0a}MsSecCore{#}{08} [Драйвер Microsoft Security Core Boot Driver]{\n #}

cecho.exe cecho.exe {03}Состояние заданий в планировщике:{\n #}

cecho.exe cecho.exe {0a}Windows Defender Cache Maintenance{\n #}

cecho.exe cecho.exe {0a}Windows Defender Scheduled Scan{\n #}

cecho.exe cecho.exe {0a}Windows Defender Verification{\n #}

cecho.exe cecho.exe {0a}Windows Defender Cleanup{\n #}

cecho.exe cecho.exe {0a}SmartScreenSpecific{\n #}

reg.exe reg delete "HKLM\Software\Microsoft\Windows Script Host\Settings" /v "Enabled" /f

cmd.exe C:\Windows\system32\cmd.exe /c cscript //nologo temp.vbs

cmd.exe C:\Windows\system32\cmd.exe /S /D /c" ver "

findstr.exe findstr /c:"6.3" /c:"6.2" /c:"6.1"

nircmd.exe nircmd win activate process cmd.exe

nhmb.exe nhmb "Создать резервную копию Защитника?\nМожно будет восстановить защитник после удаления с помощью копии.\n\n\nВыбирайте нет, только в том случае, если Вам НЕ нужны обновления Windows, либо у Вас уже есть резервная копия защитника с этой версии Windows." "BackupDefender" "Warning|YesNo|DefButton2"

cecho.exe cecho.exe {03} Добавляем в исключения Защитника{\n #}{\n #}

NSudoLC.exe NSudoLC -U:C -ShowWindowMode:Hide -Wait PowerShell "Get-PSDrive -PSProvider 'FileSystem' | ForEach-Object { Add-MpPreference -ExclusionPath $_.Root }"

timeout.exe timeout /t 2 /nobreak

7z.exe 7z e -aoa -bso0 -bsp1 "ToolsForDK.zip" -p"UnlockerPass" "DefenderStopx64.exe" "Unlocker.exe"

cecho.exe cecho.exe {03} Используем DefenderStop x64 3 раза для отключения служб защитника{\n #}{\n #}

nircmd.exe nircmd exec hide DefenderStopx64

nircmd.exe nircmd exec hide DefenderStopx64

nircmd.exe nircmd exec hide DefenderStopx64

cecho.exe cecho.exe {03} Используем Unlocker для разблокировки папок защитника{\n #}{\n #}

Unlocker.exe Unlocker /unlock "C:\ProgramData\Microsoft\Windows Defender" "C:\Program Files\Windows Defender" "C:\Program Files (x86)\Windows Defender"

cecho.exe cecho.exe {02} Создаём резервную копию папок из C:\ProgramData{\n #}

xcopy.exe xcopy /s /e /h /y /i "C:\ProgramData\Microsoft\Windows Defender" "C:\WDefenderBackup\Folder\ProgramData\Microsoft\Windows Defender"

xcopy.exe xcopy /s /e /h /y /i "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection" "C:\WDefenderBackup\Folder\ProgramData\Microsoft\Windows Defender Advanced Threat Protection"

xcopy.exe xcopy /s /e /h /y /i "C:\ProgramData\Microsoft\Windows Security Health" "C:\WDefenderBackup\Folder\ProgramData\Microsoft\Windows Security Health"

xcopy.exe xcopy /s /e /h /y /i "C:\ProgramData\Microsoft\Storage Health" "C:\WDefenderBackup\Folder\ProgramData\Microsoft\Storage Health"

timeout.exe timeout /t 2 /nobreak

cmd.exe C:\Windows\system32\cmd.exe /c ver

cmd.exe C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\WDefenderBackup\Folder\ProgramData\Microsoft\Windows Defender" "

findstr.exe findstr /r "^"

cecho.exe cecho.exe {02} Создаём резервную копию папок из C:\Program Files (x86) и C:\Program Files (x86){\n #}

reg.exe reg add "HKLM\Software\DefenderKiller" /f

xcopy.exe xcopy /s /e /h /y /i "C:\Program Files\Windows Defender" "C:\WDefenderBackup\Folder\Program Files\Windows Defender"

xcopy.exe xcopy /s /e /h /y /i "C:\Program Files\Windows Defender Sleep" "C:\WDefenderBackup\Folder\Program Files\Windows Defender Sleep"

xcopy.exe xcopy /s /e /h /y /i "C:\Program Files\Windows Defender Advanced Threat Protection" "C:\WDefenderBackup\Folder\Program Files\Windows Defender Advanced Threat Protection"

xcopy.exe xcopy /s /e /h /y /i "C:\Program Files\Windows Security" "C:\WDefenderBackup\Folder\Program Files\Windows Security"

xcopy.exe xcopy /s /e /h /y /i "C:\Program Files\PCHealthCheck" "C:\WDefenderBackup\Folder\Program Files\PCHealthCheck"

xcopy.exe xcopy /s /e /h /y /i "C:\Program Files\Microsoft Update Health Tools" "C:\WDefenderBackup\Folder\Program Files\Microsoft Update Health Tools"

xcopy.exe xcopy /s /e /h /y /i "C:\Program Files (x86)\Windows Defender" "C:\WDefenderBackup\Folder\Program Files (x86)\Windows Defender"

xcopy.exe xcopy /s /e /h /y /i "C:\Program Files (x86)\Windows Defender Advanced Threat Protection" "C:\WDefenderBackup\Folder\Program Files (x86)\Windows Defender Advanced Threat Protection"

cecho.exe cecho.exe {02} Создаём резервную копию папок из System32 и SysWOW64{\n #}

xcopy.exe xcopy /s /e /h /y /i "C:\Windows\security\database" "C:\WDefenderBackup\Folder\Windows\security\database"

xcopy.exe xcopy /s /e /h /y /i "C:\Windows\System32\HealthAttestationClient" "C:\WDefenderBackup\Folder\System32\HealthAttestationClient"

xcopy.exe xcopy /s /e /h /y /i "C:\Windows\System32\SecurityHealth" "C:\WDefenderBackup\Folder\System32\SecurityHealth"

xcopy.exe xcopy /s /e /h /y /i "C:\Windows\System32\WebThreatDefSvc" "C:\WDefenderBackup\Folder\System32\WebThreatDefSvc"

xcopy.exe xcopy /s /e /h /y /i "C:\Windows\System32\Sgrm" "C:\WDefenderBackup\Folder\System32\Sgrm"

xcopy.exe xcopy /s /e /h /y /i "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Defender" "C:\WDefenderBackup\Folder\System32\WindowsPowerShell\v1.0\Modules\Defender"

xcopy.exe xcopy /s /e /h /y /i "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DefenderPerformance" "C:\WDefenderBackup\Folder\System32\WindowsPowerShell\v1.0\Modules\DefenderPerformance"

xcopy.exe xcopy /s /e /h /y /i "C:\Windows\System32\Tasks_Migrated\Microsoft\Windows\Windows Defender" "C:\WDefenderBackup\Folder\System32\Tasks_Migrated\Microsoft\Windows\Windows Defender"

xcopy.exe xcopy /s /e /h /y /i "C:\Windows\System32\drivers\wd" "C:\WDefenderBackup\Folder\System32\drivers\wd"

xcopy.exe xcopy /s /e /h /y /i "C:\Windows\System32\Tasks\Microsoft\Windows\Windows Defender" "C:\WDefenderBackup\Folder\System32\Tasks\Microsoft\Windows\Windows Defender"

xcopy.exe xcopy /s /e /h /y /i "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender" "C:\WDefenderBackup\Folder\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender"

xcopy.exe xcopy /s /e /h /y /i "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance" "C:\WDefenderBackup\Folder\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance"

cecho.exe cecho.exe {02} Создаём резервную копию файлов из System32 и SysWOW64{\n #}

cecho.exe cecho.exe {02} Создаём резервную копию папок из WinSxS{\n #}

xcopy.exe xcopy "C:\Windows\WinSxS\amd64_security-malware-windows-defender-events_31bf3856ad364e35_6.1.7600.16385_none_118cf1dcd54a3dea" "C:\WDefenderBackup\Folder\WinSxS\amd64_security-malware-windows-defender-events_31bf3856ad364e35_6.1.7600.16385_none_118cf1dcd54a3dea" /I /E /H /Y

xcopy.exe xcopy "C:\Windows\WinSxS\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306" "C:\WDefenderBackup\Folder\WinSxS\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306" /I /E /H /Y

xcopy.exe xcopy "C:\Windows\WinSxS\wow64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_be064cc3a640e167" "C:\WDefenderBackup\Folder\WinSxS\wow64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_be064cc3a640e167" /I /E /H /Y

reg.exe reg export "HKLM\System\CurrentControlSet\Services\EventLog\System\WinDefend" "C:\WDefenderBackup\ServicesDrivers\WinDefendEvent.reg"

reg.exe reg export "HKLM\System\CurrentControlSet\Services\SecurityHealthService" "C:\WDefenderBackup\ServicesDrivers\SecurityHealthService.reg"

reg.exe reg export "HKLM\System\CurrentControlSet\Services\Sense" "C:\WDefenderBackup\ServicesDrivers\Sense.reg"

reg.exe reg export "HKLM\System\CurrentControlSet\Services\WdNisSvc" "C:\WDefenderBackup\ServicesDrivers\WdNisSvc.reg"

reg.exe reg export "HKLM\System\CurrentControlSet\Services\WinDefend" "C:\WDefenderBackup\ServicesDrivers\WinDefend.reg"

reg.exe reg export "HKLM\System\CurrentControlSet\Services\wscsvc" "C:\WDefenderBackup\ServicesDrivers\wscsvc.reg"

reg.exe reg export "HKLM\System\CurrentControlSet\Services\SgrmBroker" "C:\WDefenderBackup\ServicesDrivers\SgrmBroker.reg"

reg.exe reg export "HKLM\System\CurrentControlSet\Services\webthreatdefsvc" "C:\WDefenderBackup\ServicesDrivers\webthreatdefsvc.reg"

reg.exe reg export "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc" "C:\WDefenderBackup\ServicesDrivers\webthreatdefusersvc.reg"

reg.exe reg export "HKLM\System\CurrentControlSet\Services\WdNisDrv" "C:\WDefenderBackup\ServicesDrivers\WdNisDrv.reg"

reg.exe reg export "HKLM\System\CurrentControlSet\Services\WdBoot" "C:\WDefenderBackup\ServicesDrivers\WdBoot.reg"

reg.exe reg export "HKLM\System\CurrentControlSet\Services\WdFilter" "C:\WDefenderBackup\ServicesDrivers\WdFilter.reg"

reg.exe reg export "HKLM\System\CurrentControlSet\Services\SgrmAgent" "C:\WDefenderBackup\ServicesDrivers\SgrmAgent.reg"

reg.exe reg export "HKLM\System\CurrentControlSet\Services\wtd" "C:\WDefenderBackup\ServicesDrivers\wtd.reg"

reg.exe reg export "HKLM\System\CurrentControlSet\Services\MsSecWfp" "C:\WDefenderBackup\ServicesDrivers\MsSecWfp.reg"

reg.exe reg export "HKLM\System\CurrentControlSet\Services\MsSecFlt" "C:\WDefenderBackup\ServicesDrivers\MsSecFlt.reg"

reg.exe reg export "HKLM\System\CurrentControlSet\Services\MsSecCore" "C:\WDefenderBackup\ServicesDrivers\MsSecCore.reg"

reg.exe reg export "HKCR\*\shellex\ContextMenuHandlers\EPP" "C:\WDefenderBackup\RegEdit\1.reg"

reg.exe reg export "HKCR\Directory\shellex\ContextMenuHandlers\EPP" "C:\WDefenderBackup\RegEdit\2.reg"

reg.exe reg export "HKCR\Drive\shellex\ContextMenuHandlers\EPP" "C:\WDefenderBackup\RegEdit\3.reg"

reg.exe reg export "HKLM\Software\Classes\CLSID\{09A47860-11B0-4DA5-AFA5-26D86198A780}" "C:\WDefenderBackup\RegEdit\4.reg"

reg.exe reg export "HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" "C:\WDefenderBackup\RegEdit\5.reg"

reg.exe reg export "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" "C:\WDefenderBackup\RegEdit\6.reg"

reg.exe reg export "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" "C:\WDefenderBackup\RegEdit\7.reg"

reg.exe reg export "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Windows Defender" "C:\WDefenderBackup\RegEdit\8.reg"

reg.exe reg export "HKLM\System\CurrentControlset\Control\WMI\Autologger\DefenderApiLogger" "C:\WDefenderBackup\RegEdit\9.reg"

reg.exe reg export "HKLM\System\CurrentControlset\Control\WMI\Autologger\DefenderAuditLogger" "C:\WDefenderBackup\RegEdit\10.reg"

reg.exe reg export "HKLM\Software\Microsoft\Windows Defender" "C:\WDefenderBackup\RegEdit\11.reg"

reg.exe reg export "HKLM\Software\Microsoft\Windows Defender Security Center" "C:\WDefenderBackup\RegEdit\12.reg"

reg.exe reg export "HKLM\Software\Microsoft\Windows Advanced Threat Protection" "C:\WDefenderBackup\RegEdit\13.reg"

reg.exe reg export "HKLM\Software\Microsoft\Windows Security Health" "C:\WDefenderBackup\RegEdit\14.reg"

reg.exe reg export "HKLM\Software\Microsoft\SystemSettings\SettingId\SystemSettings_WindowsDefender_UseWindowsDefender" "C:\WDefenderBackup\RegEdit\15.reg"

reg.exe reg export "HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational" "C:\WDefenderBackup\RegEdit\16.reg"

reg.exe reg export "HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC" "C:\WDefenderBackup\RegEdit\17.reg"

reg.exe reg export "HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\NIS-Driver-WFP/Diagnostic" "C:\WDefenderBackup\RegEdit\18.reg"

reg.exe reg export "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{D8559EB9-20C0-410E-BEDA-7ED416AECC2A}" "C:\WDefenderBackup\RegEdit\19.reg"

reg.exe reg export "HKCR\CLSID\{D8559EB9-20C0-410E-BEDA-7ED416AECC2A}" "C:\WDefenderBackup\RegEdit\20.reg"

cecho.exe cecho.exe {08} Резервная копия создана в {09}C:\WDefenderBackup{\n #}{\n #}

reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d 5 /f

nircmd.exe nircmd killprocess SecHealthUI.exe

cecho.exe cecho.exe {03} Отключаем защитник [групповые политики] >

taskkill.exe taskkill /f /im mmc.exe

cecho.exe cecho.exe {04} Применение ГП{\n #}{\n #}

LGPO.exe LGPO.exe /t "LGPO-temp.txt" /q

nircmd.exe nircmd win activate process cmd.exe

reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t REG_SZ /d "Off" /f

NSudoLC.exe NSudoLC -U:C -ShowWindowMode:Hide cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t REG_DWORD /d "0" /f

reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f

NSudoLC.exe NSudoLC -U:C -ShowWindowMode:Hide cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f

reg.exe reg add "HKLM\Software\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t REG_DWORD /d "1" /f

reg.exe reg add "HKLM\Software\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t REG_DWORD /d "1" /f

cecho.exe cecho.exe {08} Пропуск добавления в исключения Защитника [уже добавлено]{\n #}{\n #}

nircmd.exe nircmd killprocess MpCmdRun.exe

nircmd.exe nircmd killprocess MsMpEng.exe

nircmd.exe nircmd killprocess SecurityHealthSystray.exe

nircmd.exe nircmd killprocess SecurityHealthService.exe

nircmd.exe nircmd killprocess SecurityHealthHost.exe

nircmd.exe nircmd killprocess smartscreen.exe

nircmd.exe nircmd killprocess SgrmBroker.exe

nircmd.exe nircmd killprocess SecHealthUI.exe

nircmd.exe nircmd killprocess uhssvc.exe

nircmd.exe nircmd killprocess NisSrv.exe

nircmd.exe nircmd killprocess MPSigStub.exe

nircmd.exe nircmd killprocess MSASCuiL.exe

nircmd.exe nircmd killprocess MRT.exe

7z.exe 7z x -aoa -bso0 -bsp1 "ToolsForDK.zip" -p"UnlockerPass"

cecho.exe cecho.exe {03} Используем DefenderStop x64 для отключения служб защитника{\n #}{\n #}

nircmd.exe nircmd exec hide DefenderStopx64.exe

nircmd.exe nircmd exec hide DefenderStopx64.exe

cecho.exe cecho.exe {0c} Выполняем удаление с помощью Unlocker by Eject{\n #}

nircmd.exe nircmd win settext foreground "DK"

NSudoLC.exe NSudoLC -U:C -ShowWindowMode:Hide -Wait cmd.exe /c taskkill /f /im explorer.exe

timeout.exe timeout /t 1 /nobreak

Unlocker.exe Unlocker /DeleteDefender

cecho.exe cecho.exe {08} Папка "C:\ProgramData\Microsoft\Windows Defender" не удалилась с 1 раза{\n #}

cecho.exe cecho.exe {0c} Повторное удаление Защитника с помощью Unlocker{\n #}{\n #}

timeout.exe timeout /t 2 /nobreak

Unlocker.exe Unlocker /DeleteDefender

NSudoLC.exe NSudoLC -U:C -ShowWindowMode:Hide cmd.exe /c start explorer.exe

taskkill.exe taskkill /f /im mmc.exe

cecho.exe cecho.exe {04} Применение ГП{\n #}{\n #}

LGPO.exe LGPO.exe /t "LGPO-temp.txt" /q

nircmd.exe nircmd win activate process cmd.exe

cecho.exe cecho.exe {03} Удаляем папки и файлы Защитника{\n #}{\n #}

taskkill.exe taskkill /f /im smartscreen.exe

cecho.exe cecho.exe {03} Удаляем службы{\n #}

cecho.exe cecho.exe {0a} WinDefend, SecurityHealthService, Sense, WdNisSvc, wscsvc, webthreatdefsvc{\n #}

cecho.exe cecho.exe {0a} webthreatdefusersvc{\n #}{\n #}

sc.exe sc stop WinDefend