Could you tell me which :section of the script gets executed for uninstalling?

[pandaxyz291]

Hello, I am really sorry for bothering you. Could you tell me which :sections of the script gets executed for the option 3 uninstall? I'm tryna evade an AV detection which I can't disable and would like to try to run just the uninstall part.

Thank you.

[abbodi1406]

:RemoveHook + :cCache but the sections alone will not work, because it depend on previously set variables and detection

you can use this script alone from the traditional pack, and run from command prompt: AutoRenewal-Setup.cmd /R

or save the following in a script and run (or paste in command prompt directly):

spoiler

``` WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="%SystemRoot%\System32\SppExtComObjHook.dll" Force=True 2>nul del /f /q "%SystemRoot%\System32\SppExtComObjHook.dll" 2>nul del /f /q "%SystemRoot%\SysWOW64\SppExtComObjHook.dll" 2>nul schtasks /delete /f /tn "\Microsoft\Windows\SoftwareProtectionPlatform\SvcTrigger" 2>nul set "_wApp=55c92734-d682-4d71-983e-d6ec3f16059f" set "_oApp=0ff1ce15-a989-479d-af46-f275c6370663" set "_oA14=59a52881-a989-479d-af46-f275c6370663" set "IFEO=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" set "OPPk=SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" set "SPPk=SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" 2>nul reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoGenTicket /f 2>nul 2>nul reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoAcquireGT /f 2>nul 2>nul reg delete "%IFEO%\SppExtComObj.exe" /f 2>nul reg delete "%IFEO%\sppsvc.exe" /f 2>nul reg delete "%IFEO%\osppsvc.exe" /f 2>nul reg delete "HKLM\%SPPk%" /f /v KeyManagementServiceName 2>nul reg delete "HKLM\%SPPk%" /f /v KeyManagementServicePort 2>nul reg delete "HKLM\%SPPk%" /f /v DisableDnsPublishing 2>nul reg delete "HKLM\%SPPk%" /f /v DisableKeyManagementServiceHostCaching 2>nul reg delete "HKLM\%SPPk%\%_wApp%" /f 2>nul reg delete "HKLM\%SPPk%" /f /v KeyManagementServiceName /reg:32 2>nul reg delete "HKLM\%SPPk%" /f /v KeyManagementServicePort /reg:32 2>nul reg delete "HKLM\%SPPk%\%_oApp%" /f /reg:32 2>nul reg delete "HKLM\%SPPk%\%_oApp%" /f 2>nul reg delete "HKU\S-1-5-20\%SPPk%\%_wApp%" /f 2>nul reg delete "HKU\S-1-5-20\%SPPk%\%_oApp%" /f 2>nul reg delete "HKLM\%OPPk%" /f /v KeyManagementServiceName 2>nul reg delete "HKLM\%OPPk%" /f /v KeyManagementServicePort 2>nul reg delete "HKLM\%OPPk%" /f /v DisableDnsPublishing 2>nul reg delete "HKLM\%OPPk%" /f /v DisableKeyManagementServiceHostCaching 2>nul reg delete "HKLM\%OPPk%\%_oA14%" /f 2>nul reg delete "HKLM\%OPPk%\%_oApp%" /f ```

[pandaxyz291]

Many thanks for the help and dedication!

[Macleykun]

Many thanks for the help and dedication!

can you close the issue, given your question got answered? :)