@echo off
title [InstanceCheats.com] Step 1 - Disable Windows Defender ^& Antivirus
color 0C
echo.
echo  ============================================================
echo   InstanceCheats.com Fix Tool - Disable Windows Defender ^& Antivirus
echo  ============================================================
echo.

:: Check admin
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo  [ERROR] This script requires Administrator privileges.
    echo  Right-click ^> Run as Administrator.
    echo.
    pause
    exit /b 1
)

echo  [*] Disabling Windows Defender Real-Time Protection...
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f >nul 2>&1
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f >nul 2>&1
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f >nul 2>&1
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f >nul 2>&1
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f >nul 2>&1
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f >nul 2>&1

echo  [*] Disabling Tamper Protection policy...
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f >nul 2>&1

echo  [*] Disabling Cloud-Delivered Protection...
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpynetReporting /t REG_DWORD /d 0 /f >nul 2>&1
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f >nul 2>&1

echo  [*] Disabling Windows Defender scheduled tasks...
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable >nul 2>&1
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable >nul 2>&1
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable >nul 2>&1
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable >nul 2>&1

echo  [*] Disabling Windows Defender services...
sc config WinDefend start= disabled >nul 2>&1
sc stop WinDefend >nul 2>&1
sc config WdNisSvc start= disabled >nul 2>&1
sc stop WdNisSvc >nul 2>&1

echo  [*] Disabling SmartScreen...
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableSmartScreen /t REG_DWORD /d 0 /f >nul 2>&1
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d "Off" /f >nul 2>&1

echo  [*] Adding C:\ to exclusion list...
powershell -Command "Add-MpPreference -ExclusionPath 'C:\' -ErrorAction SilentlyContinue" >nul 2>&1

echo.
echo  ============================================================
echo   [OK] Windows Defender has been disabled.
echo   NOTE: If Tamper Protection was ON, you may need to manually
echo   disable it first in Windows Security ^> Virus ^& Threat
echo   Protection ^> Manage Settings ^> Tamper Protection = OFF
echo  ============================================================
echo.
echo  A reboot is recommended.
echo.
pause