Skip to main content

Disable Antimalware Scan Interface (AMSI)

Overview​

About this category

This category contains privacy scripts for Windows.

These changes use Windows system commands to update your settings.

This category contains scripts that disable various components of the Antimalware Scan Interface (AMSI) in Windows.

AMSI is a standard interface that allows applications and services to integrate with antimalware products on Windows systems 1 2 3 4 5. It functions as an interception engine, enabling software to work with Defender and other antivirus solutions to detect potentially malicious scripts and content 1 2 3 5.

Key features of AMSI include:

  • Scanning scripts and macros for malicious content before execution 1 2 3 5
  • Providing an additional layer of security against script-based attacks 1 2 3 5
  • Allowing different antivirus vendors to conduct scanning operations 1 3 4 5

Disabling AMSI components may enhance privacy by:

  • Reducing the amount of data collected and analyzed by antimalware services 1 3 5
  • Limiting the sharing of potentially sensitive information with security providers 1 2 3 4 5

It may also improve system performance by:

  • Reducing script scanning overhead 5
  • Decreasing background scanning activities

However, disabling AMSI carries significant security risks:

  • Reduced protection against malicious scripts, including PowerShell commands and Microsoft Office macros 1 2 3 5
  • Weakened ability to detect and prevent malware, especially obfuscated threats 2 3 5
  • Increased vulnerability to script-based attacks and potentially harmful software gaining control over the system
Caution

Disabling AMSI components may significantly reduce your system's security. It weakens defenses against malware and script-based threats, potentially exposing your system to various security risks.

Not Advised

This category should only be used by advanced users. None of its scripts are recommended for daily use as it breaks important functionality. Do not run it without having backups and system snapshots.

Apply now​

These scripts are written using Batch (batchfile) scripting language.

Choose one of two ways to apply:

  1. Automatically via privacy.sexy: The easiest and safest option.
  2. Manually by downloading: Requires downloading a file.

Alternative 1. Apply with Privacy.sexy​

privacy.sexy is free and open-source application that lets securely apply this action easily.

Open privacy.sexy

It allows selectively choose parts of this action to conduct. You can fully restore this action (revert back to the original behavior) using the application.

privacy.sexy instructions
  1. Open or download the desktop application
  2. Search for the category name: Disable Antimalware Scan Interface (AMSI).
  3. Check the category by clicking on the checkbox of the category.
  4. Click on Run button at the bottom of the page.

Alternative 2. Download​

Consider restarting your computer for all changes to take affect.

Reversible

This action is completely reversible, you can restore your changes to the initial/default state. The restore/revert methods provided here can help you fix issues.

If something goes wrong, use the Revert script provided above.

All​

This script includes Standard, Strict recommendation levels along with unrecommended scripts.

Not Advised

This script should only be used by advanced users. Some of these changes are NOT recommended for daily use as it breaks important functionality. Do not run it without having backups and system snapshots.

Download all scripts:

Download script

Restore these changes if you decide to revert them by downloading the restore script:

Download restore script

Explore further​

This category includes total of 3 scripts but no subcategories.

Explore its 3 scripts:

Disable Defender Antivirus AMSI provider

This script disables the Antimalware Scan Interface (AMSI) provider for Defender. The AMSI provider is part of the Antimalware Scan Interface (AMSI). AMSI adds security against malicious scripts in Windows. It enables various antivirus programs to scan for script-based attacks. AMSI provides interface to integrate antimalware modules. By default, Defender uses AMSI to block potentially harmful PowerShell scripts, JavaScript, and VBA macros. Windows registers an AMSI provider for Defender A...

Disable Defender Antivirus UAC AMSI provider

This script disables the Defender UAC (User Account Control) AMSI (Antimalware Scan Interface) provider. The UAC AMSI provider allows Defender to scan and analyze UAC elevation requests for potential security threats. UAC manages the elevation of privileges for executables, COM objects, MSI packages, and ActiveX installations. UAC elevation on Windows is a security feature that asks for permission before allowing changes that could affect the system's operation. Disabling this provider may enhan...

Disable Antimalware Scan Interface (AMSI) for current user

This script disables the Antimalware Scan Interface (AMSI) for the current user, preventing the integration of applications and services with antimalware products. AMSI is a standard interface that integrates applications and services with antimalware products on Windows machines. It helps detect potentially malicious scripts, such as harmful PowerShell commands or Microsoft Office macros, even if they are obfuscated. When AMSI is enabled, antivirus programs can scan scripts before they run. If ...

Explore Categories​

This action belongs to Disable Defender scans category. This category configures Windows using 29 scripts. These scripts are organized in 8 categories. The category includes 6 subcategories that include more scripts and categories. Read more on category page ▶

Support​

This website relies on your support.

Support now

Your donation helps keep the project alive and improves its content ❤️.

Share this page:

EmailLinkedInRedditPinterestWhatsAppTelegramWeiboVK