sync: auto-sync from HOWARD-HOME at 2026-06-21 10:50:27
Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-06-21 10:50:27
This commit is contained in:
@@ -316,10 +316,19 @@ if(-not (Test-Path $root)){ Write-Output 'NO-SCANLOGS'; return }
|
||||
$dir=Get-ChildItem $root -Directory | Sort-Object LastWriteTime -Descending | Select-Object -First 1
|
||||
if(-not $dir){ Write-Output 'NO-SCAN-DIR'; return }
|
||||
Write-Output ("SCANDIR=" + $dir.FullName)
|
||||
Get-ChildItem $dir.FullName -File | ForEach-Object {
|
||||
$b=[Convert]::ToBase64String([IO.File]::ReadAllBytes($_.FullName))
|
||||
Write-Output ("===FILE===" + $_.Name + "===")
|
||||
Write-Output $b
|
||||
# EICAR sanity: is the planted test file still on disk after a clean-mode scan?
|
||||
$eicar='C:\GuruScanTest\eicar_test.com'
|
||||
if(Test-Path $eicar){ Write-Output ("EICAR-STILL-PRESENT (" + (Get-Item $eicar).Length + " bytes) - NOT quarantined") }
|
||||
else { Write-Output 'EICAR-GONE - a scanner removed/quarantined it' }
|
||||
# whitelist that was handed to the engines
|
||||
if(Test-Path 'C:\GuruScan\whitelist.txt'){ Write-Output '===FILE===whitelist.txt==='; Write-Output ([Convert]::ToBase64String([IO.File]::ReadAllBytes('C:\GuruScan\whitelist.txt'))) }
|
||||
# recurse: pull every log file under the scan dir (logs live in *_Logs subdirs), cap each at 512KB
|
||||
Get-ChildItem $dir.FullName -File -Recurse | ForEach-Object {
|
||||
$bytes=[IO.File]::ReadAllBytes($_.FullName)
|
||||
if($bytes.Length -gt 524288){ $bytes=$bytes[0..524287] }
|
||||
$rel=$_.FullName.Substring($dir.FullName.Length).TrimStart('\') -replace '\\','__'
|
||||
Write-Output ("===FILE===" + $rel + "===")
|
||||
Write-Output ([Convert]::ToBase64String($bytes))
|
||||
}
|
||||
Write-Output "===END==="
|
||||
PS
|
||||
|
||||
Reference in New Issue
Block a user