chore: remove Khalsa bot-session scratch + gitignore root scratch classes

Winter's auto-sync swept ~2.4MB of Khalsa troubleshooting scratch (SC session dumps,
diag .ps1/.b64, ticket JSON) into repo root via git add -A. Removed those and added
gitignore rules for root dot-.ps1/.b64/.err/.vbs/.tmp + the leaked .json families
(prefix-listed to keep .hosts.json/.devs.json/.mcp.json.example protected).
This commit is contained in:
2026-07-17 05:46:44 -07:00
parent 51b09dacbb
commit 089741b1db
16 changed files with 30 additions and 65207 deletions

30
.gitignore vendored
View File

@@ -155,3 +155,33 @@ temp/
# EDR isolation watcher local state (no secrets, per-host)
.claude/scripts/.edr-watch-state.json
# --- Bot/session scratch that leaks to repo root via `git add -A` (added 2026-07-17) ---
# Root dot-prefixed .ps1/.b64/.err/.vbs are ALWAYS scratch here (real scripts live in
# .claude/scripts/), so blanket them like the existing .*.txt/.*.sh rules.
.*.ps1
.*.b64
.*.err
.*.vbs
.*.tmp
# Scratch .json families — a blanket .*.json is UNSAFE (.hosts.json/.devs.json/.mcp.json.example
# are legit tracked files), so list transient per-session families by prefix/name instead:
.khalsa-*
.glaztech-*
.neptune-*
.unifi-*.json
.uni-*.json
.sy_*.json
.syncro-*.json
.msp-*.json
.bb-*.json
.signins.json
.sc-tps.json
.mon.json
.tkt.json
.rep.json
.uadd.json
.bill.json
.gmeta.json
.oc.json
.hosts2.json

File diff suppressed because one or more lines are too long

View File

@@ -1,28 +0,0 @@
$ErrorActionPreference='SilentlyContinue'
$o=New-Object System.Text.StringBuilder
function W($s){[void]$script:o.AppendLine($s)}
W '=DEFENDER='
$m=Get-MpComputerStatus
W ("mode=$($m.AMRunningMode) rtp=$($m.RealTimeProtectionEnabled) av=$($m.AntivirusEnabled) sig=$($m.AntivirusSignatureLastUpdated)")
W '=DETECTIONS(5)='
Get-MpThreatDetection|Sort-Object InitialDetectionTime -Descending|Select-Object -First 5|ForEach-Object{W ("$($_.InitialDetectionTime) :: $(($_.Resources -join ';'))")}
W '=PUP MATCHES='
$u=@('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*')
$apps=Get-ItemProperty $u|Where-Object DisplayName
$apps|Where-Object{$_.DisplayName -match 'McAfee|WebAdvisor|Norton|Avast|AVG|Avira|Driver|CCleaner|Clean|Optim|ByteFence|Segurazo|OneLaunch|Wave|TotalAV|Restoro|Reimage|Booster|Accelerate'}|ForEach-Object{W ("$($_.DisplayName) | $($_.Publisher)")}
W '=HKLM RUN='
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run').PSObject.Properties|Where-Object{$_.Name -notmatch '^PS'}|ForEach-Object{W ("$($_.Name)=$($_.Value)")}
(Get-ItemProperty 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run').PSObject.Properties|Where-Object{$_.Name -notmatch '^PS'}|ForEach-Object{W ("W64:$($_.Name)=$($_.Value)")}
W '=USER RUN='
Get-ChildItem Registry::HKEY_USERS|Where-Object{$_.Name -match 'S-1-5-21' -and $_.Name -notmatch '_Classes'}|ForEach-Object{
$sid=$_.PSChildName
(Get-ItemProperty ($_.PSPath+'\Software\Microsoft\Windows\CurrentVersion\Run')).PSObject.Properties|Where-Object{$_.Name -notmatch '^PS'}|ForEach-Object{W ("[$sid] $($_.Name)=$($_.Value)")}
}
W '=NONMS TASKS='
Get-ScheduledTask|Where-Object{$_.TaskPath -notlike '\Microsoft*'}|ForEach-Object{W ("$($_.TaskPath)$($_.TaskName) [$($_.State)]")}
W ("=APPTOTAL= $($apps.Count)")
$full=$o.ToString()
$full|Out-File C:\Windows\Temp\acg-diag1.txt -Encoding utf8
$apps|Sort-Object DisplayName|ForEach-Object{"$($_.DisplayName) | $($_.Publisher)"}|Add-Content C:\Windows\Temp\acg-diag1.txt -Encoding utf8
$full
'=DONE STAGE1='

View File

@@ -1 +0,0 @@
JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJwA9AEEAVgAgAFAAUgBPAEQAVQBDAFQAUwA9ACcACgBHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAByAG8AbwB0AC8AUwBlAGMAdQByAGkAdAB5AEMAZQBuAHQAZQByADIAIAAtAEMAbABhAHMAcwBOAGEAbQBlACAAQQBuAHQAaQBWAGkAcgB1AHMAUAByAG8AZAB1AGMAdAAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAIgAkACgAJABfAC4AZABpAHMAcABsAGEAeQBOAGEAbQBlACkAIABzAHQAYQB0AGUAPQAwAHgAJAAoACcAewAwADoAeAB9ACcAIAAtAGYAIAAkAF8ALgBwAHIAbwBkAHUAYwB0AFMAdABhAHQAZQApACIAIAB9AAoAJwA9AFMARQBDAFUAUgBJAFQAWQAgAEEAUABQAFMAIABJAE4AIABJAE4AVgBFAE4AVABPAFIAWQA9ACcACgBHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIABDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcAGEAYwBnAC0AZABpAGEAZwAxAC4AdAB4AHQAIAB8ACAAUwBlAGwAZQBjAHQALQBTAHQAcgBpAG4AZwAgACcAQgBpAHQAZABlAGYAZQBuAGQAZQByAHwAVwBlAGIAcgBvAG8AdAB8AFMAZQBuAHQAaQBuAGUAbAB8AFMAbwBwAGgAbwBzAHwARABhAHQAdABvAHwASAB1AG4AdAByAGUAcwBzAHwATQBhAGwAdwBhAHIAZQBiAHkAdABlAHMAfABUAHIAZQBuAGQAfABLAGEAcwBwAGUAcgBzAGsAeQB8AEUAUwBFAFQAfABNAGMAQQBmAGUAZQB8AE4AbwByAHQAbwBuAHwAQQB2AGEAcwB0AHwAQQBWAEcAfABTAGUAYwB1AHIAaQB0AHkAfABDAEMAbABlAGEAbgBlAHIAfABEAGUAZgBlAG4AZABlAHIAJwAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATABpAG4AZQAuAFQAcgBpAG0AKAApACAAfQAKACcAPQBOAE8AVABJAEYASQBDAEEAVABJAE8ATgAgAEEATABMAE8AVwBTAD0AJwAKAGYAbwByAGUAYQBjAGgAKAAkAGIAIABpAG4AIAAnAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAJwAsACcATQBpAGMAcgBvAHMAbwBmAHQAXABFAGQAZwBlACcAKQB7AAoAIAAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcACoAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAJABiAFwAVQBzAGUAcgAgAEQAYQB0AGEAXAAqAFwAUAByAGUAZgBlAHIAZQBuAGMAZQBzACIAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAKACAAIAAgACAAJAB3AGgAbwA9ACQAXwAuAEYAdQBsAGwATgBhAG0AZQAgAC0AcgBlAHAAbABhAGMAZQAgACcAXgBDADoAXABcAFUAcwBlAHIAcwBcAFwAKABbAF4AXABcAF0AKwApAC4AKgAnACwAJwAkADEAJwAKACAAIAAgACAAJABwAHIAbwBmAD0AJABfAC4ARABpAHIAZQBjAHQAbwByAHkALgBOAGEAbQBlAAoAIAAgACAAIAAkAGoAPQBHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAF8ALgBGAHUAbABsAE4AYQBtAGUAIAAtAFIAYQB3ACAAfAAgAEMAbwBuAHYAZQByAHQARgByAG8AbQAtAEoAcwBvAG4ACgAgACAAIAAgACQAZQB4AD0AJABqAC4AcAByAG8AZgBpAGwAZQAuAGMAbwBuAHQAZQBuAHQAXwBzAGUAdAB0AGkAbgBnAHMALgBlAHgAYwBlAHAAdABpAG8AbgBzAC4AbgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAKACAAIAAgACAAaQBmACgAJABlAHgAKQB7ACAAJABlAHgALgBQAFMATwBiAGoAZQBjAHQALgBQAHIAbwBwAGUAcgB0AGkAZQBzACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBWAGEAbAB1AGUALgBzAGUAdAB0AGkAbgBnACAALQBlAHEAIAAxAH0AIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACIAQQBMAEwATwBXACAAJAB3AGgAbwAgACgAJABiACAAJABwAHIAbwBmACkAIAA6ADoAIAAkACgAJABfAC4ATgBhAG0AZQApACIAIAB9ACAAfQAKACAAIAB9AAoAfQAKACcAPQBFAFgAVABFAE4AUwBJAE8ATgBTAD0AJwAKAGYAbwByAGUAYQBjAGgAKAAkAGIAIABpAG4AIAAnAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAJwAsACcATQBpAGMAcgBvAHMAbwBmAHQAXABFAGQAZwBlACcAKQB7AAoAIAAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcACoAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAJABiAFwAVQBzAGUAcgAgAEQAYQB0AGEAXAAqAFwARQB4AHQAZQBuAHMAaQBvAG4AcwBcACoAIgAgAC0ARABpAHIAZQBjAHQAbwByAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAKACAAIAAgACAAJABtAGYAPQBHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAIgAkACgAJABfAC4ARgB1AGwAbABOAGEAbQBlACkAXAAqAFwAbQBhAG4AaQBmAGUAcwB0AC4AagBzAG8AbgAiACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAgACAAIAAgAGkAZgAoACQAbQBmACkAewAgACQAbQA9AEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgACQAbQBmAC4ARgB1AGwAbABOAGEAbQBlACAALQBSAGEAdwB8AEMAbwBuAHYAZQByAHQARgByAG8AbQAtAEoAcwBvAG4AOwAgACQAbgBtAD0AJABtAC4AbgBhAG0AZQA7ACAAaQBmACgAJABuAG0AIAAtAGwAaQBrAGUAIAAnAF8AXwBNAFMARwAqACcAKQB7ACQAbgBtAD0AIgBpAGQAOgAkACgAJABfAC4ATgBhAG0AZQApACIAfQA7ACAAIgAkAGIAIAA6ADoAIAAkAG4AbQAiACAAfQAKACAAIAB9ACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAC0AVQBuAGkAcQB1AGUACgB9AAoAJwA9AEQATwBOAEUAIABTAFQAQQBHAEUAMgA9ACcACgA=

View File

@@ -1,23 +0,0 @@
$ErrorActionPreference='SilentlyContinue'
'=AV PRODUCTS='
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | ForEach-Object { "$($_.displayName) state=0x$('{0:x}' -f $_.productState)" }
'=SECURITY APPS IN INVENTORY='
Get-Content C:\Windows\Temp\acg-diag1.txt | Select-String 'Bitdefender|Webroot|Sentinel|Sophos|Datto|Huntress|Malwarebytes|Trend|Kaspersky|ESET|McAfee|Norton|Avast|AVG|Security|CCleaner|Defender' | ForEach-Object { $_.Line.Trim() }
'=NOTIFICATION ALLOWS='
foreach($b in 'Google\Chrome','Microsoft\Edge'){
Get-ChildItem "C:\Users\*\AppData\Local\$b\User Data\*\Preferences" | ForEach-Object {
$who=$_.FullName -replace '^C:\\Users\\([^\\]+).*','$1'
$prof=$_.Directory.Name
$j=Get-Content $_.FullName -Raw | ConvertFrom-Json
$ex=$j.profile.content_settings.exceptions.notifications
if($ex){ $ex.PSObject.Properties | Where-Object {$_.Value.setting -eq 1} | ForEach-Object { "ALLOW $who ($b $prof) :: $($_.Name)" } }
}
}
'=EXTENSIONS='
foreach($b in 'Google\Chrome','Microsoft\Edge'){
Get-ChildItem "C:\Users\*\AppData\Local\$b\User Data\*\Extensions\*" -Directory | ForEach-Object {
$mf=Get-ChildItem "$($_.FullName)\*\manifest.json" | Select-Object -First 1
if($mf){ $m=Get-Content $mf.FullName -Raw|ConvertFrom-Json; $nm=$m.name; if($nm -like '__MSG*'){$nm="id:$($_.Name)"}; "$b :: $nm" }
} | Sort-Object -Unique
}
'=DONE STAGE2='

View File

@@ -1 +0,0 @@
JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJwA9AE8ARgBGAEkAQwBFAC8ATQBDAEEARgBFAEUAIABJAE4AIABJAE4AVgBFAE4AVABPAFIAWQA9ACcACgBHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIABDADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcAGEAYwBnAC0AZABpAGEAZwAxAC4AdAB4AHQAIAB8ACAAUwBlAGwAZQBjAHQALQBTAHQAcgBpAG4AZwAgACcATwBmAGYAaQBjAGUAfAAzADYANQB8AE0AYwBBAGYAZQBlACcAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATABpAG4AZQAuAFQAcgBpAG0AKAApAH0AIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAewAkAF8AIAAtAG4AbwB0AG0AYQB0AGMAaAAgACcAXgBTAGUAYwB1AHIAaQB0AHkAIABVAHAAZABhAHQAZQB8AF4AVQBwAGQAYQB0AGUAIABmAG8AcgAgAE0AaQBjAHIAbwBzAG8AZgB0AHwAXgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAVQBwAGQAYQB0AGUAJwB9ACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAC0AVQBuAGkAcQB1AGUACgAnAD0AUABFAFIALQBVAFMARQBSACAASQBOAFMAVABBAEwATABFAEQAIABBAFAAUABTAD0AJwAKAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIABSAGUAZwBpAHMAdAByAHkAOgA6AEgASwBFAFkAXwBVAFMARQBSAFMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAewAkAF8ALgBOAGEAbQBlACAALQBtAGEAdABjAGgAIAAnAFMALQAxAC0ANQAtADIAMQAnACAALQBhAG4AZAAgACQAXwAuAE4AYQBtAGUAIAAtAG4AbwB0AG0AYQB0AGMAaAAgACcAXwBDAGwAYQBzAHMAZQBzACcAfQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAewAKACAAIAAkAHMAaQBkAD0AJABfAC4AUABTAEMAaABpAGwAZABOAGEAbQBlAAoAIAAgAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAoACQAXwAuAFAAUwBQAGEAdABoACsAJwBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAKgAnACkAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIABEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAIAAiAFsAJABzAGkAZABdACAAJAAoACQAXwAuAEQAaQBzAHAAbABhAHkATgBhAG0AZQApACAAfAAgACQAKAAkAF8ALgBQAHUAYgBsAGkAcwBoAGUAcgApACIAIAB9AAoAfQAKACcAPQBFAEQARwBFACAARQBYAFQARQBOAFMASQBPAE4AUwA9ACcACgBHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAIgBDADoAXABVAHMAZQByAHMAXAAqAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQBkAGcAZQBcAFUAcwBlAHIAIABEAGEAdABhAFwAKgBcAEUAeAB0AGUAbgBzAGkAbwBuAHMAXAAqACIAIAAtAEQAaQByAGUAYwB0AG8AcgB5ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AAoAIAAgACQAbQBmAD0ARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgACIAJAAoACQAXwAuAEYAdQBsAGwATgBhAG0AZQApAFwAKgBcAG0AYQBuAGkAZgBlAHMAdAAuAGoAcwBvAG4AIgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxAAoAIAAgAGkAZgAoACQAbQBmACkAewAgACQAbQA9AEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgACQAbQBmAC4ARgB1AGwAbABOAGEAbQBlACAALQBSAGEAdwB8AEMAbwBuAHYAZQByAHQARgByAG8AbQAtAEoAcwBvAG4AOwAgACQAbgBtAD0AJABtAC4AbgBhAG0AZQA7ACAAaQBmACgAJABuAG0AIAAtAGwAaQBrAGUAIAAnAF8AXwBNAFMARwAqACcAKQB7ACQAbgBtAD0AIgBpAGQAOgAkACgAJABfAC4ATgBhAG0AZQApACIAfQA7ACAAJABuAG0AIAB9AAoAfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIAAtAFUAbgBpAHEAdQBlAAoAJwA9AEMASABSAE8ATQBFACAARQBYAFQAIABJAEQAUwA9ACcACgBHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAIgBDADoAXABVAHMAZQByAHMAXAAqAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXABVAHMAZQByACAARABhAHQAYQBcACoAXABFAHgAdABlAG4AcwBpAG8AbgBzAFwAKgAiACAALQBEAGkAcgBlAGMAdABvAHIAeQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAewAkAF8ALgBOAGEAbQBlAH0AIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAALQBVAG4AaQBxAHUAZQAKACcAPQBEAE8ATgBFACAAUwBUAEEARwBFADMAPQAnAAoA

View File

@@ -1,16 +0,0 @@
$ErrorActionPreference='SilentlyContinue'
'=OFFICE/MCAFEE IN INVENTORY='
Get-Content C:\Windows\Temp\acg-diag1.txt | Select-String 'Office|365|McAfee' | ForEach-Object{$_.Line.Trim()} | Where-Object{$_ -notmatch '^Security Update|^Update for Microsoft|^Definition Update'} | Sort-Object -Unique
'=PER-USER INSTALLED APPS='
Get-ChildItem Registry::HKEY_USERS | Where-Object{$_.Name -match 'S-1-5-21' -and $_.Name -notmatch '_Classes'} | ForEach-Object{
$sid=$_.PSChildName
Get-ItemProperty ($_.PSPath+'\Software\Microsoft\Windows\CurrentVersion\Uninstall\*') | Where-Object DisplayName | ForEach-Object{ "[$sid] $($_.DisplayName) | $($_.Publisher)" }
}
'=EDGE EXTENSIONS='
Get-ChildItem "C:\Users\*\AppData\Local\Microsoft\Edge\User Data\*\Extensions\*" -Directory | ForEach-Object{
$mf=Get-ChildItem "$($_.FullName)\*\manifest.json" | Select-Object -First 1
if($mf){ $m=Get-Content $mf.FullName -Raw|ConvertFrom-Json; $nm=$m.name; if($nm -like '__MSG*'){$nm="id:$($_.Name)"}; $nm }
} | Sort-Object -Unique
'=CHROME EXT IDS='
Get-ChildItem "C:\Users\*\AppData\Local\Google\Chrome\User Data\*\Extensions\*" -Directory | ForEach-Object{$_.Name} | Sort-Object -Unique
'=DONE STAGE3='

View File

@@ -1 +0,0 @@
JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJwA9AEgATwBTAFQAUwAgACgAbgBvAG4ALQBjAG8AbQBtAGUAbgB0ACkAPQAnAAoARwBlAHQALQBDAG8AbgB0AGUAbgB0ACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAGQAcgBpAHYAZQByAHMAXABlAHQAYwBcAGgAbwBzAHQAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAgAC0AbQBhAHQAYwBoACAAJwBcAFMAJwAgAC0AYQBuAGQAIAAkAF8AIAAtAG4AbwB0AG0AYQB0AGMAaAAgACcAXgBcAHMAKgAjACcAfQAKACcAPQBXAEkATgBIAFQAVABQACAAUABSAE8AWABZAD0AJwAKAG4AZQB0AHMAaAAgAHcAaQBuAGgAdAB0AHAAIABzAGgAbwB3ACAAcAByAG8AeAB5ACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfACAALQBtAGEAdABjAGgAIAAnAFwAUwAnAH0ACgAnAD0AVQBTAEUAUgAgAFAAUgBPAFgAWQA9ACcACgBHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAUgBlAGcAaQBzAHQAcgB5ADoAOgBIAEsARQBZAF8AVQBTAEUAUgBTACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJwBTAC0AMQAtADUALQAyADEAJwAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAG8AdABtAGEAdABjAGgAIAAnAF8AQwBsAGEAcwBzAGUAcwAnAH0AIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsACgAgACAAJABwAD0ARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACgAJABfAC4AUABTAFAAYQB0AGgAKwAnAFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwASQBuAHQAZQByAG4AZQB0ACAAUwBlAHQAdABpAG4AZwBzACcAKQAKACAAIAAiAFsAJAAoACQAXwAuAFAAUwBDAGgAaQBsAGQATgBhAG0AZQApAF0AIABlAG4AYQBiAGwAZQA9ACQAKAAkAHAALgBQAHIAbwB4AHkARQBuAGEAYgBsAGUAKQAgAHMAZQByAHYAZQByAD0AJAAoACQAcAAuAFAAcgBvAHgAeQBTAGUAcgB2AGUAcgApACAAYQB1AHQAbwBjAGYAZwA9ACQAKAAkAHAALgBBAHUAdABvAEMAbwBuAGYAaQBnAFUAUgBMACkAIgAKAH0ACgAnAD0ARABOAFMAPQAnAAoARwBlAHQALQBEAG4AcwBDAGwAaQBlAG4AdABTAGUAcgB2AGUAcgBBAGQAZAByAGUAcwBzACAALQBBAGQAZAByAGUAcwBzAEYAYQBtAGkAbAB5ACAASQBQAHYANAAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAFMAZQByAHYAZQByAEEAZABkAHIAZQBzAHMAZQBzAH0AIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAIAAiACQAKAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBBAGwAaQBhAHMAKQA6ACAAJAAoACQAXwAuAFMAZQByAHYAZQByAEEAZABkAHIAZQBzAHMAZQBzACAALQBqAG8AaQBuACAAJwAsACcAKQAiACAAfQAKACcAPQBCAFIATwBXAFMARQBSACAAUwBFAEEAUgBDAEgALwBTAFQAQQBSAFQAVQBQAD0AJwAKAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcACoAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAFUAcwBlAHIAIABEAGEAdABhAFwAKgBcAFAAcgBlAGYAZQByAGUAbgBjAGUAcwAiACwAIgBDADoAXABVAHMAZQByAHMAXAAqAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQBkAGcAZQBcAFUAcwBlAHIAIABEAGEAdABhAFwAKgBcAFAAcgBlAGYAZQByAGUAbgBjAGUAcwAiACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AAoAIAAgACQAdwBoAG8APQAkAF8ALgBGAHUAbABsAE4AYQBtAGUAIAAtAHIAZQBwAGwAYQBjAGUAIAAnAF4AQwA6AFwAXABVAHMAZQByAHMAXABcACgAWwBeAFwAXABdACsAKQAuACoAJwAsACcAJAAxACcACgAgACAAJABqAD0ARwBlAHQALQBDAG8AbgB0AGUAbgB0ACAAJABfAC4ARgB1AGwAbABOAGEAbQBlACAALQBSAGEAdwAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuAAoAIAAgACQAcwBwAD0AJABqAC4AZABlAGYAYQB1AGwAdABfAHMAZQBhAHIAYwBoAF8AcAByAG8AdgBpAGQAZQByAF8AZABhAHQAYQAuAHQAZQBtAHAAbABhAHQAZQBfAHUAcgBsAF8AZABhAHQAYQAuAGsAZQB5AHcAbwByAGQACgAgACAAJABzAHUAPQAoACQAagAuAHMAZQBzAHMAaQBvAG4ALgBzAHQAYQByAHQAdQBwAF8AdQByAGwAcwAgAC0AagBvAGkAbgAgACcAOwAnACkACgAgACAAJABoAHAAPQAkAGoALgBoAG8AbQBlAHAAYQBnAGUACgAgACAAaQBmACgAJABzAHAAIAAtAG8AcgAgACQAcwB1ACAALQBvAHIAIAAkAGgAcAApAHsAIAAiAFsAJAB3AGgAbwAgACQAKAAkAF8ALgBEAGkAcgBlAGMAdABvAHIAeQAuAE4AYQBtAGUAKQBdACAAcwBlAGEAcgBjAGgAPQAkAHMAcAAgAHMAdABhAHIAdAB1AHAAPQAkAHMAdQAgAGgAbwBtAGUAPQAkAGgAcAAiACAAfQAKAH0ACgAnAD0AQgBSAE8AVwBTAEUAUgAgAFMASABPAFIAVABDAFUAVABTAD0AJwAKACQAcwBoAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AQwBvAG0ATwBiAGoAZQBjAHQAIABXAFMAYwByAGkAcAB0AC4AUwBoAGUAbABsAAoARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgACcAQwA6AFwAVQBzAGUAcgBzAFwAKgBcAEQAZQBzAGsAdABvAHAAXAAqAC4AbABuAGsAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABEAGUAcwBrAHQAbwBwAFwAKgAuAGwAbgBrACcALAAnAEMAOgBcAFUAcwBlAHIAcwBcACoAXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAUQB1AGkAYwBrACAATABhAHUAbgBjAGgAXABVAHMAZQByACAAUABpAG4AbgBlAGQAXABUAGEAcwBrAEIAYQByAFwAKgAuAGwAbgBrACcAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsACgAgACAAJABsAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAkAF8ALgBGAHUAbABsAE4AYQBtAGUAKQAKACAAIABpAGYAKAAkAGwALgBUAGEAcgBnAGUAdABQAGEAdABoACAALQBtAGEAdABjAGgAIAAnAGMAaAByAG8AbQBlAHwAbQBzAGUAZABnAGUAfABmAGkAcgBlAGYAbwB4AHwAaQBlAHgAcABsAG8AcgBlACcAIAAtAGEAbgBkACAAJABsAC4AQQByAGcAdQBtAGUAbgB0AHMAIAAtAG0AYQB0AGMAaAAgACcAXABTACcAKQB7ACAAIgAkACgAJABfAC4ARgB1AGwAbABOAGEAbQBlACkAIAAtAD4AIAAkACgAJABsAC4AVABhAHIAZwBlAHQAUABhAHQAaAApACAAQQBSAEcAUwA6ACAAJAAoACQAbAAuAEEAcgBnAHUAbQBlAG4AdABzACkAIgAgAH0ACgB9AAoAJwA9AEQATwBOAEUAIABTAFQAQQBHAEUANAA9ACcACgA=

View File

@@ -1,28 +0,0 @@
$ErrorActionPreference='SilentlyContinue'
'=HOSTS (non-comment)='
Get-Content C:\Windows\System32\drivers\etc\hosts | Where-Object{$_ -match '\S' -and $_ -notmatch '^\s*#'}
'=WINHTTP PROXY='
netsh winhttp show proxy | Where-Object{$_ -match '\S'}
'=USER PROXY='
Get-ChildItem Registry::HKEY_USERS | Where-Object{$_.Name -match 'S-1-5-21' -and $_.Name -notmatch '_Classes'} | ForEach-Object{
$p=Get-ItemProperty ($_.PSPath+'\Software\Microsoft\Windows\CurrentVersion\Internet Settings')
"[$($_.PSChildName)] enable=$($p.ProxyEnable) server=$($p.ProxyServer) autocfg=$($p.AutoConfigURL)"
}
'=DNS='
Get-DnsClientServerAddress -AddressFamily IPv4 | Where-Object{$_.ServerAddresses} | ForEach-Object{ "$($_.InterfaceAlias): $($_.ServerAddresses -join ',')" }
'=BROWSER SEARCH/STARTUP='
Get-ChildItem "C:\Users\*\AppData\Local\Google\Chrome\User Data\*\Preferences","C:\Users\*\AppData\Local\Microsoft\Edge\User Data\*\Preferences" | ForEach-Object{
$who=$_.FullName -replace '^C:\\Users\\([^\\]+).*','$1'
$j=Get-Content $_.FullName -Raw | ConvertFrom-Json
$sp=$j.default_search_provider_data.template_url_data.keyword
$su=($j.session.startup_urls -join ';')
$hp=$j.homepage
if($sp -or $su -or $hp){ "[$who $($_.Directory.Name)] search=$sp startup=$su home=$hp" }
}
'=BROWSER SHORTCUTS='
$sh=New-Object -ComObject WScript.Shell
Get-ChildItem 'C:\Users\*\Desktop\*.lnk','C:\Users\Public\Desktop\*.lnk','C:\Users\*\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\*.lnk' | ForEach-Object{
$l=$sh.CreateShortcut($_.FullName)
if($l.TargetPath -match 'chrome|msedge|firefox|iexplore' -and $l.Arguments -match '\S'){ "$($_.FullName) -> $($l.TargetPath) ARGS: $($l.Arguments)" }
}
'=DONE STAGE4='

View File

File diff suppressed because one or more lines are too long

File diff suppressed because one or more lines are too long

File diff suppressed because one or more lines are too long

File diff suppressed because one or more lines are too long

File diff suppressed because one or more lines are too long

File diff suppressed because one or more lines are too long