How to: manually create Winutil shortcut

[NotYourAverageGamer]

The option to add a shortcut was removed due to anti-virus programs flagging and removing it.

E.g. #3074, #2965

This IS NOT a bypass/workaround/fix for Anti-Virus software flagging it.

I previously posted how to manually add the shortcut yourself, if you choose to do so:
#2487 (comment)

You can manually create the shortcut by doing the following: (this is for win10 but win11 should be the same)

• Right-click on your desktop and go to New -> Shortcut

• It should ask for the location of the item, copy and paste the following:

Default powershell install:

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Start-Process powershell.exe -verb runas -ArgumentList '-Command "irm https://christitus.com/win | iex"'

Powershell 7:

"C:\Program Files\PowerShell\7\pwsh.exe" -ExecutionPolicy Bypass -Command "Start-Process pwsh.exe -verb runas -ArgumentList '-Command "irm https://christitus.com/win | iex"'

• Press Next/Enter

• It should ask what you want to name the shortcut, enter WinUtil

• Right-Click the new WinUtil shortcut on your desktop, and select Properties

• In the Shortcut tab, select Advanced...

• Tick the box for Run as administrator

• Press OK, then press OK again.

You should now be able to run WinUtil from that shortcut.

To fix the missing icon:

• Right-Click the shortcut -> Properties -> Change Icon...

• Below "Look for icons in this file:", replace everything there with:

%USERPROFILE%\AppData\Local\winutil\cttlogo.ico

Press Enter twice, then click OK

You should now have a manually created version of the shortcut that WinUtil would usually make. :)

WinUtil icon:

i found it in: %USERPROFILE%\AppData\Local\winutil\cttlogo.png (note that it's a .png now). it's likely only there if WinUtil has created the shortcut previously.

[FatBastard0]

hey I want to thank you for taking the time and effort to begin this to us! please and thanks

[NotYourAverageGamer]

you're welcome! thanks for the kind words.
I cleaned it up a little by removing the quotes, they were messing with my formatting.
hopefully that should be easier to read/understand now

[NitroSniper]

Issue of pwsh.exe doesn't exist. Instead you can just use powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Start-Process powershell.exe -verb runas -ArgumentList '-Command "irm https://christitus.com/win | iex"'

[Aarnav-Tech]

Or you could just download the .exe version 🫠

Here

[NotYourAverageGamer]

Chris already has his own executable available. However, it is a paid option available from his website, which I understand is not an option for everyone.

[Aarnav-Tech]

No, I have created an executable from the code he has posted. Check the link.

[rex099]

This is sketch AF.

Win says Trojan:Win32/Wacatac.B!ml

[JustTooKrul]

How would one "failover" to a local version of the script? I guess you would need to add a line fetching the script and then a second running it, ignoring if the first one failed or not?

[FatBastard0]

uses shortcut this shortcut protocol and I like it also use it to set bit defender exemption list

[Sneffel]

That shortcut command didn't work for me, so I used this one instead
powershell.exe -NoExit -Command "irm christitus.com/win | iex"

[NotYourAverageGamer]

Do you not have powershell 7 installed perhaps?

[Jmkrnet]

As described in issue #2965 and this discussion #3127 various antivirus software flags WINUTIL shortcuts as false positives. Last year I discovered a relatively nice method of preventing these stupid false positive detections by antivirus software. It works for 5 or 6 months now with various "irm WEB-LINK | iex" shortcuts (at least Windows Defender no longer blocks any such shortcuts on my systems).

The idea is to split the "irm WEB-LINK | iex" part into 2 (or more) strings that are autotyped by "SendKeys()":
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoExit -Command "$wScriptShell = New-Object -ComObject WScript.Shell; $wScriptShell.SendKeys('irm https://christitus.com'); $wScriptShell.SendKeys('/win | iex')"

This launches POWERSHELL window and autotypes "irm https://christitus.com/win | iex" at the prompt but it is up to the user to hit ENTER to actually run the command. This way it is safe as one can remember to check if the web site is working properly (i.e. it is not hacked for example). Also Windows Defender and hopefully other antivirus software is not able to actually understand POWERSHELL language to find out that it produces otherwise banned "irm WEB-LINK | iex" string. Thus, we avoid the false positive detections and users win and can easily start WINUTIL to win even more control over their PCs:).

[DustDiesel]

As described in issue #2965 and this discussion #3127 various antivirus software flags WINUTIL shortcuts as false positives. Last year I discovered a relatively nice method of preventing these stupid false positive detections by antivirus software. It works for 5 or 6 months now with various "irm WEB-LINK | iex" shortcuts (at least Windows Defender no longer blocks any such shortcuts on my systems).

The idea is to split the "irm WEB-LINK | iex" part into 2 (or more) strings that are autotyped by "SendKeys()": C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoExit -Command "$wScriptShell = New-Object -ComObject WScript.Shell; $wScriptShell.SendKeys('irm https://christitus.com'); $wScriptShell.SendKeys('/win | iex')"

This lauches POWERSHELL window and autotypes "irm https://christitus.com/win | iex" at the prompt but it is up to the user to hit ENTER to actually run the command. This way it is safe as one can remember to check if the web site is working properly (i.e. it is not hacked for example). Also Windows Defender and hopefully other antivirus software is not able to actually understand POWERSHELL language to find out that it produces otherwise banned "irm WEB-LINK | iex" string. Thus, we avoid the false positive detections and users win and can easily start WINUTIL to win even more control over their PCs:).

Can you help me, somewhat a newbie who relies on specific step by step instructions on how I can create a file that I can launch from Windows 11 which will launch terminal as admin and input the string for WinUtil?

[Jmkrnet]

Instructions on how to create the shortcut LNK file are in the initial post, but here is what I did:

• Right-click on your desktop and go to "New -> Shortcut".

• It should ask for the location of the item, copy and paste the command from my previous post:
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoExit -Command "$wScriptShell = New-Object -ComObject WScript.Shell; $wScriptShell.SendKeys('irm https://christitus.com'); $wScriptShell.SendKeys('/win | iex')"

• Press "Next". It should ask what you want to name the shortcut, enter the shortcut name (for example "WINUTIL").

Then the shortcut should work, but you can right-click the new shortcut on your desktop, and select "Properties" to further customize it. For example select your preferred icon and if the window should start maximized and so on. There is no need to tick "Run as administrator" for the shortcut on my system (WINUTIL elevates the privilege in its POWERSHELL script i guess).