Could you tell me which :section of the script gets executed for uninstalling?

[pandaxyz291]

Hello,
I am really sorry for bothering you.
Could you tell me which :sections of the script gets executed for the option 3 uninstall?
I'm tryna evade an AV detection which I can't disable and would like to try to run just the uninstall part.

Thank you.

[abbodi1406]

:RemoveHook + :cCache
but the sections alone will not work, because it depend on previously set variables and detection

you can use this script alone from the traditional pack, and run from command prompt:
AutoRenewal-Setup.cmd /R

or save the following in a script and run (or paste in command prompt directly):

spoiler

WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath="%SystemRoot%\System32\SppExtComObjHook.dll" Force=True 2>nul
del /f /q "%SystemRoot%\System32\SppExtComObjHook.dll" 2>nul
del /f /q "%SystemRoot%\SysWOW64\SppExtComObjHook.dll" 2>nul
schtasks /delete /f /tn "\Microsoft\Windows\SoftwareProtectionPlatform\SvcTrigger" 2>nul
set "_wApp=55c92734-d682-4d71-983e-d6ec3f16059f"
set "_oApp=0ff1ce15-a989-479d-af46-f275c6370663"
set "_oA14=59a52881-a989-479d-af46-f275c6370663"
set "IFEO=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"
set "OPPk=SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform"
set "SPPk=SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform"
2>nul reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoGenTicket /f 2>nul
2>nul reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoAcquireGT /f 2>nul
2>nul reg delete "%IFEO%\SppExtComObj.exe" /f
2>nul reg delete "%IFEO%\sppsvc.exe" /f
2>nul reg delete "%IFEO%\osppsvc.exe" /f
2>nul reg delete "HKLM\%SPPk%" /f /v KeyManagementServiceName
2>nul reg delete "HKLM\%SPPk%" /f /v KeyManagementServicePort
2>nul reg delete "HKLM\%SPPk%" /f /v DisableDnsPublishing
2>nul reg delete "HKLM\%SPPk%" /f /v DisableKeyManagementServiceHostCaching
2>nul reg delete "HKLM\%SPPk%\%_wApp%" /f
2>nul reg delete "HKLM\%SPPk%" /f /v KeyManagementServiceName /reg:32
2>nul reg delete "HKLM\%SPPk%" /f /v KeyManagementServicePort /reg:32
2>nul reg delete "HKLM\%SPPk%\%_oApp%" /f /reg:32
2>nul reg delete "HKLM\%SPPk%\%_oApp%" /f
2>nul reg delete "HKU\S-1-5-20\%SPPk%\%_wApp%" /f
2>nul reg delete "HKU\S-1-5-20\%SPPk%\%_oApp%" /f
2>nul reg delete "HKLM\%OPPk%" /f /v KeyManagementServiceName
2>nul reg delete "HKLM\%OPPk%" /f /v KeyManagementServicePort
2>nul reg delete "HKLM\%OPPk%" /f /v DisableDnsPublishing
2>nul reg delete "HKLM\%OPPk%" /f /v DisableKeyManagementServiceHostCaching
2>nul reg delete "HKLM\%OPPk%\%_oA14%" /f
2>nul reg delete "HKLM\%OPPk%\%_oApp%" /f

[pandaxyz291]

Many thanks for the help and dedication!

[Macleykun]

Many thanks for the help and dedication!

can you close the issue, given your question got answered? :)