# Scan-Kaspersky.ps1
# Checks for Kaspersky products in registry, services, and drivers
# Output: results to screen and to a UTF-8 text file

$Date = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"
$LogFile = "C:\Temp\Kaspersky_Detect_$Date.txt"

# Ensure output folder exists
if (-not (Test-Path "C:\Temp")) {
    New-Item -Path "C:\Temp" -ItemType Directory | Out-Null
}

# Function to write results
function Write-Result {
    param([string]$Message)
    $Message | Tee-Object -FilePath $LogFile -Append
}

Write-Result "==== Kaspersky Detection Report ===="
Write-Result "Run Time: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
Write-Result ""

# --- 1. Registry Uninstall Keys ---
$UninstallPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall"
)

foreach ($path in $UninstallPaths) {
    if (Test-Path $path) {
        Get-ChildItem $path | ForEach-Object {
            $dispName = (Get-ItemProperty $_.PsPath).DisplayName -ErrorAction SilentlyContinue
            if ($dispName -and $dispName -match "Kaspersky") {
                Write-Result "Registry Product: $dispName"
                Write-Result "  Key: $($_.Name)"
                Write-Result "  Version: $((Get-ItemProperty $_.PsPath).DisplayVersion)"
                Write-Result ""
            }
        }
    }
}

# --- 2. Direct Kaspersky Registry Keys ---
$KasperskyReg = @(
    "HKLM:\SOFTWARE\KasperskyLab",
    "HKLM:\SOFTWARE\WOW6432Node\KasperskyLab"
)

foreach ($reg in $KasperskyReg) {
    if (Test-Path $reg) {
        Write-Result "Found Kaspersky registry hive: $reg"
    }
}

# --- 3. Services ---
$Services = Get-Service | Where-Object { $_.Name -match "kl|kaspersky|avp" }
if ($Services) {
    Write-Result "`nDetected Kaspersky-related services:"
    $Services | ForEach-Object {
        Write-Result ("  Service: {0} ({1}) Status: {2}" -f $_.Name, $_.DisplayName, $_.Status)
    }
}

# --- 4. Drivers ---
$Drivers = Get-ChildItem "C:\Windows\System32\drivers" -Filter "kl*.sys" -ErrorAction SilentlyContinue
if ($Drivers) {
    Write-Result "`nDetected Kaspersky driver files:"
    foreach ($d in $Drivers) {
        Write-Result ("  {0} - Version: {1}" -f $d.Name, (Get-Item $d.FullName).VersionInfo.FileVersion)
    }
}

Write-Result "`n==== Scan Complete ===="
Write-Result "Results saved to $LogFile"