$a=PS MsMpEng -ea 0
if(!$a){
RP -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender" -Name DisableAntiSpyware -Force
RP -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender" -Name DisableAntiVirus -Force
RP -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Force
RP -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name SettingsPageVisibility
SP -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" -Name TamperProtection -Value 5
SP -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" -Name SmartScreenEnabled -Value On
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name SecurityHealth -PropertyType ExpandString -Value $env:SystemRoot\system32\SecurityHealthSystray.exe
gwmi Win32_BaseService|? Name -Match 'WinDefend|WdBoot|WdFilter|Sense|WdNisDrv|WdNisSvc'|%{$_.ChangeStartMode('Automatic')}
New-Service -Name SecurityHealthService -BinaryPathName $env:SystemRoot\system32\SecurityHealthService.exe
sasv WinDefend
& $env:SystemRoot\system32\SecurityHealthSystray.exe
}
if($a){
'WinDefend','Sense','WdBoot','WdFilter','WdNisSvc','WdNisDrv'|%{(gwmi Win32_BaseService -Filter "Name='$_'").StopService()}
gwmi Win32_Process|? Name -Match 'SecurityHealthService.exe|SecurityHealthSystray.exe|smartscreen.exe|MpCmdRun.exe'|%{$_.Terminate()}
(gwmi Win32_Service -Filter "Name='SecurityHealthService'").Delete()
gwmi Win32_BaseService|? Name -Match 'WinDefend|WdBoot|WdFilter|Sense|WdNisDrv|WdNisSvc'|%{$_.ChangeStartMode('Disabled')}
SP -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" -Name SmartScreenEnabled -Value Off
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name SettingsPageVisibility -PropertyType String -Value hide:windowsdefender
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -PropertyType DWord -Value 1 -Force
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender" -Name DisableAntiSpyware -PropertyType DWord -Value 1 -Force
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender" -Name DisableAntiVirus -PropertyType DWord -Value 1 -Force
RP -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name SecurityHealth
}
exit
