How to disable "MsMpEng.exe"

TairikuOkami said:

Microsoft Defender Disable

hello,
i'm trying to download this from google drive link but it's saying the file contains viruses, only owner can download it...
Can you please public share or tell me how to get it?
I've used to use your disable WD.bat early before but with new updates MsMpEng.exe is still there with the old .bat
thanks in advance

TairikuOkami said:

Windows/Microsoft Defender Disable.bat at main . TairikuOokami/Windows . GitHub

Tamper protection has to be disabled manually, so malware could not disable Defender as easily.

Turn On or Off Tamper Protection for Microsoft Defender Antivirus

It works on 21H1, but you have to run it twice to disable services. It should say successful at the end.

Ok thanks for this heads up!
In the meantime i've run it first in normal mode with tamper disabled rebooted and msmpeng still there.
Run it in safe mode worked like a charm! Even the "old" one
Thanks for everything tho!

TairikuOkami said:

Windows/Microsoft Defender Disable.bat at main . TairikuOokami/Windows . GitHub

Tamper protection has to be disabled manually, so malware could not disable Defender as easily.

Turn On or Off Tamper Protection for Microsoft Defender Antivirus

It works on 21H1, but you have to run it twice to disable services. It should say successful at the end.

Hello,
i'm still here...i run said .bat and WD is completely eradicated along with msmpeng.exe.
Now with the latest update i got a different issue and i'm sorry if im off topic but i searched the forum and i didnt find a permanent solution
On this thread: Unblock File in Windows 10
i've done all the stuff to completely remove the "unlock" option from a "weird" extension file like .cs, .ini and stuff since i'm working with guys in a project and we share these files over telegram.
I did the .reg and the gpedit.msc and rebooted but im still having this:

Please help, i'm desperate!

TairikuOkami said:

Code:

rem 1808 - Disable the warning The Publisher could not be verified
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "1808" /f

rem Disable Security warning to unblock the downloaded file
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "1" /f

As said above i've already did it and the gpedit.msc too
i think this time it's telegram...
Can you upload here a null.cs (renamed .txt) to see if i got it even in browser)
thanks for understanding

TairikuOkami said:

The tutorial above does not include DefaultFileTypeRisk.
The forum does not allow to upload .cs extension.

I teamviewered a guy yesterday that had same issue as me and i manually added the reg key, redownloaded the .cs and no unlock option anymore...
Now that i need those (can try only via telegram, right now) i got the .reg, the gpedit.msc one and just run your .bat.
unlock option (from telegram .cs test file) is still there............

- - - Updated - - -

UPDATE: I redownload the .cs test file from telegram again and:

• downloaded to desktop = unlock still there
• cut\paste to Downloads folder in C: = unlock always there
• Cut\paste again in another drive = unlock gone

UPDATE 2: But if i directly save as from telegram to the other above said drive = unlock is there

TairikuOkami said:

Maybe you overdid it, changed something, so it does not have any effect.
When I remove policies Unblock is back and upon using them Unblock is gone.

I'm pretty sure the only thing that can be categorized as "overdid" is the first add reg in your .bat (which is not needed in my case as on the other hand i needed the second reg add line)
And in the meantime i've updated my last post twice
Were you able to read it before replying with this?
Thanks for patience but this thing is making me crazy!

- - - Updated - - -

TairikuOkami said:

Maybe you overdid it, changed something, so it does not have any effect.
When I remove policies Unblock is back and upon using them Unblock is gone.

Another question: when you add .reg keys and\or toggle the polices in gpedit, are the modifications applied at once or you did like:
gpupdate /force
reboot pc?