29 lines
2.1 KiB
PowerShell
29 lines
2.1 KiB
PowerShell
$ErrorActionPreference='SilentlyContinue'
|
|
$o=New-Object System.Text.StringBuilder
|
|
function W($s){[void]$script:o.AppendLine($s)}
|
|
W '=DEFENDER='
|
|
$m=Get-MpComputerStatus
|
|
W ("mode=$($m.AMRunningMode) rtp=$($m.RealTimeProtectionEnabled) av=$($m.AntivirusEnabled) sig=$($m.AntivirusSignatureLastUpdated)")
|
|
W '=DETECTIONS(5)='
|
|
Get-MpThreatDetection|Sort-Object InitialDetectionTime -Descending|Select-Object -First 5|ForEach-Object{W ("$($_.InitialDetectionTime) :: $(($_.Resources -join ';'))")}
|
|
W '=PUP MATCHES='
|
|
$u=@('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*')
|
|
$apps=Get-ItemProperty $u|Where-Object DisplayName
|
|
$apps|Where-Object{$_.DisplayName -match 'McAfee|WebAdvisor|Norton|Avast|AVG|Avira|Driver|CCleaner|Clean|Optim|ByteFence|Segurazo|OneLaunch|Wave|TotalAV|Restoro|Reimage|Booster|Accelerate'}|ForEach-Object{W ("$($_.DisplayName) | $($_.Publisher)")}
|
|
W '=HKLM RUN='
|
|
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run').PSObject.Properties|Where-Object{$_.Name -notmatch '^PS'}|ForEach-Object{W ("$($_.Name)=$($_.Value)")}
|
|
(Get-ItemProperty 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run').PSObject.Properties|Where-Object{$_.Name -notmatch '^PS'}|ForEach-Object{W ("W64:$($_.Name)=$($_.Value)")}
|
|
W '=USER RUN='
|
|
Get-ChildItem Registry::HKEY_USERS|Where-Object{$_.Name -match 'S-1-5-21' -and $_.Name -notmatch '_Classes'}|ForEach-Object{
|
|
$sid=$_.PSChildName
|
|
(Get-ItemProperty ($_.PSPath+'\Software\Microsoft\Windows\CurrentVersion\Run')).PSObject.Properties|Where-Object{$_.Name -notmatch '^PS'}|ForEach-Object{W ("[$sid] $($_.Name)=$($_.Value)")}
|
|
}
|
|
W '=NONMS TASKS='
|
|
Get-ScheduledTask|Where-Object{$_.TaskPath -notlike '\Microsoft*'}|ForEach-Object{W ("$($_.TaskPath)$($_.TaskName) [$($_.State)]")}
|
|
W ("=APPTOTAL= $($apps.Count)")
|
|
$full=$o.ToString()
|
|
$full|Out-File C:\Windows\Temp\acg-diag1.txt -Encoding utf8
|
|
$apps|Sort-Object DisplayName|ForEach-Object{"$($_.DisplayName) | $($_.Publisher)"}|Add-Content C:\Windows\Temp\acg-diag1.txt -Encoding utf8
|
|
$full
|
|
'=DONE STAGE1='
|