Skip to content

Commit

Permalink
Add more verbose output for Defender script
Browse files Browse the repository at this point in the history
  • Loading branch information
cschneegans committed Sep 30, 2024
1 parent 17a4ec0 commit 6baa658
Showing 1 changed file with 19 additions and 3 deletions.
22 changes: 19 additions & 3 deletions resource/disable-defender.vbs
Original file line number Diff line number Diff line change
@@ -1,6 +1,20 @@
WScript.Echo "Scanning for newly created SYSTEM registry hive file to disable Windows Defender services..."
Set fso = CreateObject( "Scripting.FileSystemObject" )
Set dic = CreateObject( "Scripting.Dictionary" )
initialized = false

Function Execute( command )
WScript.Echo "Running command '" + command + "'"
Set shell = CreateObject( "WScript.Shell" )
Set exec = shell.Exec( command )
Do While exec.Status = 0
WScript.Sleep 100
Loop
WScript.Echo exec.StdOut.ReadAll
WScript.Echo exec.StdErr.ReadAll
Execute = exec.ExitCode
End Function

Do
For Each drive In fso.Drives
If drive.IsReady Then
Expand All @@ -15,12 +29,14 @@ Do
ret = 1
Do
WScript.Sleep 500
ret = shell.Run( "reg.exe LOAD HKLM\mount " + file, 0, True )
ret = Execute( "reg.exe LOAD HKLM\mount " + file )
Loop While ret > 0
For Each service In Array( "Sense", "WdBoot", "WdFilter", "WdNisDrv", "WdNisSvc", "WinDefend" )
ret = shell.Run( "reg.exe ADD HKLM\mount\ControlSet001\Services\" + service + " /v Start /t REG_DWORD /d 4 /f", 0, True )
ret = Execute( "reg.exe ADD HKLM\mount\ControlSet001\Services\" + service + " /v Start /t REG_DWORD /d 4 /f" )
Next
ret = shell.Run( "reg.exe UNLOAD HKLM\mount", 0, True )
ret = Execute( "reg.exe UNLOAD HKLM\mount" )
WScript.Echo "Found SYSTEM registry hive file at '" + file + "'. This window will now close."
WScript.Sleep 5000
Exit Do
End If
End If
Expand Down

0 comments on commit 6baa658

Please sign in to comment.