github.com / ionuttbara

ionuttbara/windows-defender-remover

Batchfile·43 files·commit 6126092·scanned 3h ago·cached ✓

25/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

verdict accurate?

threat-state: lowlive

FINDINGS ░▒▓

warningSuspicious Windows batch commandBatch file contains commands commonly used to download and execute remote payloads (powershell, certutil, bitsadmin, curl to pipe, etc.).script/Script_Run.cmd

    echo Requesting Administrator privileges...
    powershell -Command "Start-Process cmd -Verb RunAs -ArgumentList '/c \"%~f0\" %*'"
    exit /b
)

warningSuspicious Windows batch commandBatch file contains commands commonly used to download and execute remote payloads (powershell, certutil, bitsadmin, curl to pipe, etc.).script/verify.bat

call :section "3) Windows Security App (SecHealthUI)"
powershell -NoProfile -ExecutionPolicy Bypass -Command "$a = Get-AppxPackage -AllUsers *SecHealthUI* -ErrorAction SilentlyContinue; $p = Get-AppxP...

infoSuspicious file in repoExecutable file (UUPIntegrator.cmd) in repositoryISO_Maker/UUPIntegrator.cmd+2

infoSuspicious file in repoExecutable file (Build.ps1) in repositoryscript/Build.ps1+2

infoSuspicious file in repoExecutable file (PowerRun.exe) in repositoryscript/PowerRun.exe+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

3 files scanned @ 6126092 | 10/30/2026 | heuristic scan — always review manually

risk by category

code execution10

network & exfiltration0

file system access0

obfuscation0

supply chain15

owasp / injection0

telemetry

files 3/43rules hit 5engine v10commit 6126092

github

ionuttbara/windows-defender-remover

A tool which is uses to remove Windows Defender in Windows 8.x, Windows 10 (every version) and Windows 11.

Batchfile

8630

547

1904d

43 files

3 scanned(7%)

6126092

architecture░▒▓

No architecture graph available. This usually happens when the repo contains no scannable JS/TS/Python files or only a single file was analyzed.