docs: update GuruScan README and module comments for current state

- README: remove AdwCleaner from scanner chain and exit code/licensing
  tables; add AdwCleaner note explaining why it is temporarily excluded;
  fix Headless description (WindowStyle=Hidden, not NoNewWindow); add
  GuruRMM integration section with example JSON output structure
- GuruScan.psm1: fix Headless param docstring; update whitelist comment
  (Emsisoft + HitmanPro only); remove C:\AdwCleaner from Defender
  exclusion list; fix Invoke-Remediation example (-Scanners Emsisoft,MSERT)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
2026-05-27 06:55:38 -07:00
parent d5614ce558
commit 47517e93bf
2 changed files with 72 additions and 34 deletions

View File

@@ -377,7 +377,8 @@ function Invoke-ScanPass {
.PARAMETER TimeoutMinOverride
If > 0, overrides the per-scanner timeout_min for all scanners.
.PARAMETER Headless
When set, suppress scanner UI windows (NoNewWindow).
When set, launches scanner processes with WindowStyle=Hidden so no UI
windows appear. Use when dispatching from an RMM agent with no desktop.
.OUTPUTS
[System.Collections.Generic.List[pscustomobject]] of result objects.
#>
@@ -771,7 +772,7 @@ function Invoke-GuruScan {
)
# Whitelist -- written to C:\GuruScan\whitelist.txt before any scanner runs.
# Emsisoft and HitmanPro honour this; RKill and AdwCleaner do not.
# Emsisoft (/wl=) and HitmanPro (/excludelist=) honour this; RKill does not.
$whitelist = @('C:\GuruScan')
# ForceRemove blacklist -- items removed after all scanners complete.
@@ -849,7 +850,7 @@ function Invoke-GuruScan {
# Add Windows Defender exclusions for scanner paths so Defender does not
# quarantine scanner EXEs or log files mid-run.
$defenderExclusions = @($script:Base, $script:LogRoot, 'C:\EmsisoftCmd', 'C:\AdwCleaner')
$defenderExclusions = @($script:Base, $script:LogRoot, 'C:\EmsisoftCmd')
try {
Add-MpPreference -ExclusionPath $defenderExclusions -ErrorAction SilentlyContinue
Write-Host "[INFO] Windows Defender exclusions added for scanner paths" -ForegroundColor Cyan
@@ -1014,7 +1015,7 @@ function Invoke-Remediation {
successfully are re-run.
.EXAMPLE
Invoke-Remediation -LogRoot "C:\ScanLogs\DESKTOP-20260523-143000"
Invoke-Remediation -LogRoot "C:\ScanLogs\DESKTOP-20260523-143000" -Scanners AdwCleaner,MSERT
Invoke-Remediation -LogRoot "C:\ScanLogs\DESKTOP-20260523-143000" -Scanners Emsisoft,MSERT
#>
[CmdletBinding()]
param(