3 Commits

Author SHA1 Message Date
es3n1n
0c9be5724f chore: bump to 1.5.0 2025-11-23 19:06:47 +01:00
es3n1n
a46fdf49ab fix(task-scheduler): properly delete defendnot task on --disable
Co-authored-by: Alessandro Bellia <casildaserrano@yahoo.it>
2025-11-23 18:59:20 +01:00
Arsenii es3n1n
2d0badd5cb docs: update readme 2025-10-17 13:23:33 +02:00
3 changed files with 13 additions and 18 deletions

View File

@@ -1,11 +1,9 @@
# defendnot
<img src="https://i.imgur.com/F9gWA92.png" align="right" width="50%"/>
An even funnier way to disable windows defender.
Defendnot is a successor of [no-defender](https://github.com/es3n1n/no-defender).
![](https://i.imgur.com/F9gWA92.png)
> [!CAUTION]
> **Permitted Use Notice**:
>
@@ -17,7 +15,7 @@ Defendnot is a successor of [no-defender](https://github.com/es3n1n/no-defender)
## Installation
> [!TIP]
> [!WARNING]
> You may need to temporarily disable realtime and tamper protection before proceeding, otherwise defender will block `defendnot` binaries due to the `VirTool:Win64/Defnot.A` detection.
### One-liner
@@ -33,14 +31,11 @@ irm https://dnot.sh/ | iex
# Example 3: Without allocating console
& ([ScriptBlock]::Create((irm https://dnot.sh/))) --silent
# Example 4: Run once, without allocating console
& ([ScriptBlock]::Create((irm https://dnot.sh/))) --silent --disable-autorun
```
> [!NOTE]
> As seen in examples 2 and 3, you can pass the commandline arguments to the installer script and it will forward them to `defendnot-loader`. For reference what commandline arguments are allowed, see the `Usage` section below.
> [!NOTE]
> You can also directly use the 'longer' version of installer script url, which is `https://raw.githubusercontent.com/es3n1n/defendnot/refs/heads/master/install.ps1`
### Manual
Download the [latest](https://github.com/es3n1n/defendnot/releases/latest) release, extract it somewhere and launch `defendnot-loader`.
@@ -71,13 +66,13 @@ The initial implementation of [no-defender](https://github.com/es3n1n/no-defende
## Limitations
- **Needs to stay on disk:**
To keep the AV registration persistent after reboot, `defendnot` adds itself to autorun. That means the binaries have to remain on your system for the Defender "disable" to stick. (Yeah, I wish it were more elegant too.)
To keep the AV registration persistent after reboot, `defendnot` adds itself to autorun. That means the binaries have to remain on your system for the Defender "disable" to stick.
- **No support for Windows Server:**
The Windows Security Center (WSC) service doesnt exist on Windows Server editions, so `defendnot` *wont* work there. See [#17](https://github.com/es3n1n/defendnot/issues/17).
The Windows Security Center (WSC) service doesn't exist on Windows Server editions, so `defendnot` *won't* work there. See [#17](https://github.com/es3n1n/defendnot/issues/17).
- **Defender Detection:**
Not surprisingly, Windows Defender really doesnt like `defendnot` and will flag or remove it as `VirTool:Win64/Defnot.A`. Youll need to (temporarily) disable Defenders real-time and tamper protection to install.
Windows Defender really doesn't like `defendnot` and will flag or remove it as `VirTool:Win64/Defnot.A`. You'll need to (temporarily) disable Defender's real-time and tamper protection to install.
## Legitimate Use Cases

View File

@@ -5,7 +5,7 @@
namespace strings {
constexpr std::string_view kProjectName = "defendnot";
constexpr std::string_view kRepoUrl = "https://github.com/es3n1n/defendnot";
constexpr std::string_view kVersion = "1.4.0";
constexpr std::string_view kVersion = "1.5.0";
constexpr std::string_view kDefaultAVName = "dnot.sh";

View File

@@ -42,19 +42,19 @@ namespace loader {
return false;
}
hr = service->Connect(VARIANT{}, VARIANT{}, VARIANT{}, VARIANT{});
hr = service->Connect(variant_t{}, variant_t{}, variant_t{}, variant_t{});
if (FAILED(hr)) {
return false;
}
com::Ptr<ITaskFolder> root_folder;
hr = service->GetFolder(BSTR(L"\\"), root_folder.ref_to_ptr());
hr = service->GetFolder(bstr_t(L"\\"), root_folder.ref_to_ptr());
if (FAILED(hr)) {
return false;
}
/// Cleanup our task, we will recreate it in the callback if needed
root_folder->DeleteTask(BSTR(kTaskName.data()), 0);
root_folder->DeleteTask(bstr_t(kTaskName.data()), 0);
return callback(service.get(), root_folder.get());
}
} // namespace