API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Apr 21st, 2019
90
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 27.86 KB | None | 0 0
raw download clone embed print report
  1. param (
  2. [switch] $ShowAll = $false,
  3. [switch] $RawEvent = $false,
  4. [switch] $ShowServices = $false,
  5. [switch] $ShowRun = $false,
  6. [switch] $HideKnown = $false,
  7. [switch] $ShowProcesses = $false,
  8. [switch] $ShowTasks = $false,
  9. [switch] $ShowLogs = $false
  10. )
  11. # Глубина просмотра истории, знак минус - важен
  12. $day_offset = -14
  13. # Антивирусный сервер, используется для проверки распределения машины
  14. $dest_admserv = "servername"
  15. # Максимальный "возраст" баз, знак минус - важен
  16. $bases_offset = -4
  17.  
  18. $ShowAvEvents = $false
  19. if ($ShowAll) {
  20. $ShowServices = $true
  21. $ShowRun = $true
  22. $ShowProcesses = $true
  23. $ShowTasks = $true
  24. $ShowLogs = $true
  25. }
  26.  
  27.  
  28. # Функция проверки статуса удаленного реестра и запуск, если служба не запущена.
  29. function CheckAndRunRR ([string] $ip) {
  30. try {
  31. Write-Host "Проверка доступности реестра:`t`t`t" -NoNewline
  32. $RR = Get-WmiObject -ComputerName $strpc -Class Win32_service -Filter "Name='RemoteRegistry'"# | Format-Table -Property DisplayName, Pathname
  33. ForEach ($RReg in $RR) {
  34. if (!($RReg.Started)) {
  35. $RunResult = $RReg.StartService()
  36. if ($RunResult = "0")
  37. { Write-Host "Started successfuly" -ForegroundColor Yellow }
  38. else
  39. { Write-Host "Service Error: " $RunResult -ForegroundColor Red }
  40. }
  41. else
  42. { Write-Host "Running" -ForegroundColor Green }
  43. }
  44. }
  45. catch
  46. { Write-Host $_ -ForegroundColor Red }
  47. }
  48.  
  49. # Функция-фильтр "хороших" ключей реестра (они будут окрашены зелёным и могут быть исключены из вывода)
  50. function GoodKeys([string] $key, [string] $value) {
  51. $value = $value.Replace(' (x86)', '')
  52. $value = $value.Replace('sysWOW64', 'system32')
  53. switch ($key) {
  54. #shell & userinit
  55. shell { if ($value -eq "Explorer.exe") { return $true } }
  56. userinit { if ($value -eq "c:\windows\system32\userinit.exe,") { return $true } }
  57.  
  58. #autruns
  59. CTFMON.EXE { if ($value -eq "C:\WINDOWS\system32\CTFMON.EXE") { return $true } }
  60. # REDACTED
  61. default { return $false }
  62. }
  63. }
  64.  
  65. # Функция-фильтр "хороших" служб (они будут окрашены зелёным и могут быть исключены из вывода)
  66.  
  67. function GoodServices([string] $name, [string] $path) {
  68. $path = $path.Replace(' (x86)', '')
  69. $path = $path.Replace('sysWOW64', 'system32')
  70. switch ($name) {
  71. 'atchksrv' { if ($path -eq 'C:\Program Files\Intel\AMT\atchksrv.exe') { return $true } }
  72. # REDACTED
  73. default { return $false }
  74. }
  75. }
  76.  
  77. # Функция-фильтр "хороших" процессов (они будут окрашены зелёным и могут быть исключены из вывода)
  78. function GoodProcesses([string] $name, [string] $path) {
  79. $path = $path.Replace(' (x86)', '')
  80. $path = $path.Replace('sysWOW64', 'system32')
  81. $path = $path.Replace('sysWow64', 'system32')
  82.  
  83. switch ($name) {
  84. 'System Idle Process' { return $true }
  85. 'System' { return $true }
  86. # REDACTED
  87. default { return $false }
  88. }
  89. }
  90.  
  91. $originalcolor = $Host.UI.RawUI.ForegroundColor
  92.  
  93. $strpc = $args[0]
  94. if ($args.length -eq 0) {
  95. Write-Host "ИМЯ"
  96. Write-Host " Get-AVInfo"
  97. Write-Host ""
  98. Write-Host "ОПИСАНИЕ"
  99. Write-Host " Извлекает данные об обнаруженных вирусах из системных логов удалённого ПК"
  100. Write-Host ""
  101. Write-Host "СИНТАКСИС"
  102. Write-Host " Get-AVInfo <string> [-ShowAll] [-ShowServices] [-ShowRun] [-ShowProcesses] [-RawEvent] [-HideKnown]"
  103. Write-Host ""
  104. Write-Host ""
  105. }
  106. else {
  107. $isvalid = ($strpc -As [IPAddress] -As [Bool])
  108. #$isvalod
  109. if (!($isvalid)) {
  110. Write-Host "Неверный IP адрес. Проверка по имени ПК не производится." -ForegroundColor Red
  111. }
  112. else {
  113. Write-Host "Проверка доступности ПК"$strpc":`t`t" -NoNewline
  114.  
  115. if (!(Test-Connection -ComputerName $strpc -Count 2 -Quiet)) {
  116. Write-Host "FAIL" -ForegroundColor Red
  117. }
  118. else {
  119. Write-Host "OK" -ForegroundColor Green
  120. $OS = (Get-WmiObject -ComputerName $strpc -Class win32_operatingsystem).Version
  121. #статус антивируса
  122. CheckAndRunRR($strpc)
  123. try {
  124. Write-Host "Время последней загрузки`t`t`t" -NoNewline
  125. $boottime = Get-WmiObject -ComputerName $strpc -Class Win32_operatingsystem | ForEach-Object { $_.ConvertToDateTime($_.lastbootuptime) }
  126. Write-Host $boottime
  127. }
  128. catch { Write-Host $_ -ForegroundColor Red }
  129. try {
  130. Write-Host "Поиск агента администрирования:`t`t`t" -NoNewline
  131. $agent = Get-Process -ComputerName $strpc | Where-Object { $_.ProcessName -eq "klnagent" } | Measure-Object
  132. $agent = $agent.Count
  133. if ($agent -eq 0)
  134. { Write-Host "FAIL" -ForegroundColor Red }
  135. else
  136. { Write-Host "Ok" -ForegroundColor Green }
  137. }
  138. catch
  139. { Write-Host $_ -ForegroundColor Red }
  140.  
  141. try {
  142. Write-Host "Поиск антивирусного монитора:`t`t`t" -NoNewline
  143. $mon = Get-Process -ComputerName $strpc | Where-Object { $_.ProcessName -eq "avp" -or $_.ProcessName -eq "kavfs" -or $_.ProcessName -eq "kavfswp" } | Measure-Object
  144. $mon = $mon.Count
  145. if ($mon -eq 0)
  146. { Write-Host "FAIL" -ForegroundColor Red }
  147. else
  148. { Write-Host "Ok" -ForegroundColor Green }
  149. }
  150. catch
  151. { Write-Host $_ -ForegroundColor Red }
  152.  
  153. try {
  154. $avrunning = ""
  155. $avstate = ""
  156. $avbases = ""
  157. $admServer = ""
  158. $lastConnected = ""
  159. $knaver = ""
  160. $kesver = ""
  161. $Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $strpc)
  162. try {
  163. $RegKey = $Reg.OpenSubkey("SOFTWARE\\KasperskyLab\\Components\\34\\1103\\1.0.0.0\\Statistics\\AVState")
  164. if (!$RegKey) { $RegKey = $Reg.OpenSubkey("SOFTWARE\\Wow6432Node\\KasperskyLab\\Components\\34\\1103\\1.0.0.0\\Statistics\\AVState") }
  165. $avrunning = $RegKey.GetValue("Protection_AvRunning")
  166. $avstate = $RegKey.GetValue("Protection_RtpState")
  167. $avbases = $Regkey.GetValue("Protection_BasesDate")
  168. $admServer = $Regkey.GetValue("Protection_AdmServer")
  169. $lastConnected = $RegKey.GetValue("Protection_LastConnected")
  170. $knaver = $RegKey.GetValue("Protection_NagentVersion")
  171. }
  172. catch { }
  173.  
  174. try {
  175. $RegKey2 = $Reg.OpenSubkey("SOFTWARE\\KasperskyLab\\SetupFolders")
  176. if (!$RegKey2) { $RegKey2 = $Reg.OpenSubkey("SOFTWARE\\Wow6432Node\\KasperskyLab\\SetupFolders") }
  177. $kesver = $RegKey2.GetValueNames()
  178. }
  179. catch { }
  180.  
  181. Write-Host "Версия антивирусного агента:`t`t`t" -NoNewline
  182. Write-Host $knaver
  183. Write-Host "Версия антивирусного ПО:`t`t`t" -NoNewline
  184. Write-Host $kesver
  185.  
  186. Write-Host "Статус постоянной защиты:`t`t`t" -NoNewline
  187. if ($avrunning -eq 0)
  188. { Write-Host "Disabled" -ForegroundColor Red }
  189. else
  190. { Write-Host "Enabled" -ForegroundColor Green }
  191.  
  192. Write-Host "Состояние постоянной защиты:`t`t`t" -NoNewline
  193.  
  194. switch ($avstate) {
  195. 0 { Write-Host "Неизвестно" -ForegroundColor Red }
  196. 1 { Write-Host "Не включена" -ForegroundColor Red }
  197. 2 { Write-Host "Приостановлена" -ForegroundColor Yellow }
  198. 3 { Write-Host "Запускается" -ForegroundColor yellow }
  199. 4 { Write-Host "Включена" -ForegroundColor Green }
  200. 5 { Write-Host "Включена. Высокий уровень" -ForegroundColor Green }
  201. 6 { Write-Host "Включена. Низкий уровень" -ForegroundColor Green }
  202. 7 { Write-Host "Включена. Рекомендуемые настройки" -ForegroundColor Green }
  203. 8 { Write-Host "Включена. Настройки пользователя" -ForegroundColor Green }
  204. 9 { Write-Host "Сбой в работе" -ForegroundColor Red }
  205. default { Write-Host "Неизвестно (NaN)" -ForegroundColor Red }
  206. }
  207.  
  208. Write-Host "Сервер администрирования`t`t`t" -NoNewline
  209. if ($admserver.tolower().startswith($dest_admserv))
  210. { Write-Host $admserver -ForegroundColor Green }
  211. else
  212. { Write-Host $admserver -ForegroundColor Red }
  213.  
  214. $critical = Get-Date
  215. $critical = $critical.AddDays($bases_offset)
  216. $critical = $critical.ToUniversalTime()
  217. try {
  218. $avbases = [datetime]::ParseExact($avbases, "dd-MM-yyyy HH-mm-ss", $null)
  219. Write-Host "Дата выпуска антивирусных баз:`t`t`t" -NoNewline
  220. if ($avbases -lt $critical)
  221. { Write-Host $avbases.ToLocalTime() -ForegroundColor Red }
  222. else
  223. { Write-Host $avbases.ToLocalTime() -ForegroundColor Green }
  224. }
  225. catch {
  226. Write-Host "Дата выпуска антивирусных баз:`t`t`t" -NoNewline
  227. Write-Host "Нет данных" -ForegroundColor Red
  228. }
  229.  
  230. try {
  231. $critical_conn = Get-Date
  232. $critical_conn = $critical_conn.AddHours("-2")
  233. $critical_conn = $critical_conn.ToUniversalTime()
  234. $lastConnected = [datetime]::ParseExact($lastConnected, "dd-MM-yyyy HH-mm-ss", $null)
  235. Write-Host "Дата последнего соединения:`t`t`t" -NoNewline
  236. if ($lastConnected -lt $critical_conn)
  237. { Write-Host $lastConnected.ToLocalTime() -ForegroundColor Red }
  238. else
  239. { Write-Host $lastConnected.ToLocalTime() -ForegroundColor Green }
  240. }
  241. catch {
  242. Write-Host "Дата последнего соединения:`t`t`t" -NoNewline
  243. Write-Host "Нет данных" -ForegroundColor Red
  244. }
  245. }
  246. catch
  247. { Write-Host "Ошибка: " $_ -ForegroundColor Red }
  248. if (!$ShowLogs) { }
  249. else {
  250.  
  251. try {
  252. Write-Host "Подсчёт количества записей от антивируса:`t" -NoNewline
  253. $monthbefore = Get-Date
  254. $monthbefore = $monthbefore.AddDays($day_offset)
  255. # $logs = "Application", "Kaspersky Event Log", "Kaspersky Anti-Virus"
  256. #$events = ""
  257. #foreach ($log in $logs)
  258. #{ try
  259. # { $event = Get-EventLog -ComputerName $strpc -LogName $log -EntryType Error -After $monthbefore | where {$_.eventID -eq 4660}}
  260. # catch {$event = ""}
  261. # $events = $events + $event
  262. # }
  263.  
  264. #if ($OS.StartsWith("5.1"))
  265. # {$events = Get-EventLog -ComputerName $strpc -LogName Application -EntryType Error -After $monthbefore | where {$_.eventID -eq 4660}}
  266. #else
  267. # {$events = Get-EventLog -ComputerName $strpc -LogName "Kaspersky Event Log" -EntryType Error -After $monthbefore | where {$_.eventID -eq 4660}}
  268. switch -Wildcard ($OS) {
  269. "5.1*" { $events = Get-EventLog -ComputerName $strpc -LogName Application -EntryType Error -After $monthbefore | Where-Object { $_.eventID -eq 4660 } }
  270. "5.2*" { $events = Get-EventLog -ComputerName $strpc -LogName "Kaspersky Anti-Virus" -EntryType Error -After $monthbefore | Where-Object { $_.eventID -eq 4660 } }
  271. default { $events = Get-EventLog -ComputerName $strpc -LogName "Kaspersky Event Log" -EntryType Error -After $monthbefore | Where-Object { $_.eventID -eq 4660 } }
  272. #default {}
  273. }
  274. $event_measure = $events | Measure-Object
  275. if ($event_measure.Count -eq 0)
  276. { Write-Host "0" -ForegroundColor Green }
  277. else {
  278. Write-Host $event_measure.Count -ForegroundColor Red
  279. $ShowAvEvents = $true
  280. }
  281. }
  282.  
  283. catch
  284. { Write-Host $_ -ForegroundColor Red }
  285. }
  286. if ($HideKnown) { Write-Host "`nВнимание, все 'известные' записи и процессы будут скрыты." -ForegroundColor "Green" }
  287.  
  288. if ($ShowRun) {
  289. Write-Host "`nСписок автозагрузки:"
  290. try {
  291. $Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('Users', $strpc)
  292. Write-Host "`nHKCU:Run"
  293. foreach ($User in $Reg.GetSubKeyNames()) {
  294. switch ($user) {
  295. ".DEFAULT" { }
  296. "S-1-5-19" { }
  297. "S-1-5-19_Classes" { }
  298. "S-1-5-20" { }
  299. "S-1-5-20_Classes" { }
  300. "S-1-5-18" { }
  301. default {
  302. if ($User.EndsWith("_Classes")) { }
  303. else {
  304. $RegKey = $Reg.OpenSubKey($User + "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run")
  305. $RunNodes = $Regkey.GetValueNames()
  306. ForEach ($key in $RunNodes) {
  307. $value = $RegKey.GetValue($Key)
  308. if (GoodKeys -key $Key -value $value) {
  309. $Host.UI.RawUI.ForegroundColor = "Green"
  310. if ($HideKnown) { }
  311. else { "{0,-33}{1,-20}" -f $key, $value }
  312. }
  313. else {
  314. $Host.UI.RawUI.ForegroundColor = "Red"
  315. "{0,-33}{1,-20}" -f $key, $value
  316. }
  317. $host.UI.RawUI.ForegroundColor = $originalcolor
  318. }
  319. }
  320.  
  321. }
  322. }
  323. }
  324.  
  325. $Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $strpc)
  326. Write-Host "`nHKLM:Run"
  327. $RegKey = $Reg.OpenSubkey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run")
  328. $RunNodes = $Regkey.GetValueNames()
  329. ForEach ($key in $RunNodes) {
  330. $value = $RegKey.GetValue($Key)
  331. if (GoodKeys -key $Key -value $value) {
  332. $Host.UI.RawUI.ForegroundColor = "Green"
  333. if ($HideKnown) { }
  334. else { "{0,-33}{1,-20}" -f $key, $value }
  335. }
  336. else {
  337. $Host.UI.RawUI.ForegroundColor = "Red"
  338. "{0,-33}{1,-20}" -f $key, $value
  339. }
  340. $host.UI.RawUI.ForegroundColor = $originalcolor
  341. }
  342.  
  343.  
  344. $RegKey = $Reg.OpenSubkey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Polices\\Explorer\\Run")
  345. if ($RegKey) {
  346. Write-Host "`nHKLM:Polices\Explorer\Run"
  347. $RunNodes = $Regkey.GetValueNames()
  348. ForEach ($key in $RunNodes) {
  349. $value = $RegKey.GetValue($Key)
  350. if (GoodKeys -key $Key -value $value) {
  351. $Host.UI.RawUI.ForegroundColor = "Green"
  352. if ($HideKnown) { }
  353. else { "{0,-33}{1,-20}" -f $key, $value }
  354. }
  355. else {
  356. $Host.UI.RawUI.ForegroundColor = "Red"
  357. "{0,-33}{1,-20}" -f $key, $value
  358. }
  359. $host.UI.RawUI.ForegroundColor = $originalcolor
  360. }
  361. }
  362.  
  363. Write-Host "`nHRLM: Shell, userinit"
  364. $RegKey = $Reg.OpenSubkey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon")
  365. $shell = $RegKey.GetValue("Shell")
  366. $userinit = $RegKey.GetValue("userinit")
  367. if (GoodKeys -key "shell" -value $shell) {
  368. $Host.UI.RawUI.ForegroundColor = "Green"
  369. if ($HideKnown) { }
  370. else { "{0,-33}{1,-20}" -f "Shell", $shell }
  371. }
  372. else {
  373. $Host.UI.RawUI.ForegroundColor = "Red"
  374. "{0,-33}{1,-20}" -f "Shell", $shell
  375. }
  376.  
  377. $host.UI.RawUI.ForegroundColor = $originalcolor
  378.  
  379. if (GoodKeys -key "userinit" -value $userinit) { $Host.UI.RawUI.ForegroundColor = "Green" }
  380. else { $Host.UI.RawUI.ForegroundColor = "Red" }
  381. if ($HideKnown) { }
  382. else { "{0,-33}{1,-20}" -f "userinit", $userinit }
  383. $host.UI.RawUI.ForegroundColor = $originalcolor
  384. }
  385. catch
  386. { Write-Host $_ -ForegroundColor Red }
  387.  
  388. Write-Host "`nCommon Autoruns"
  389. try {
  390. $dir_found = $false
  391. $baseDisk = "\\" + $strpc + "\c$"
  392. $win7cprofile = "\\" + $strpc + "\c$\ProgramData\Microsoft\Windows\"
  393. $winxcprofile = "\\" + $strpc + "\c$\Documents and Settings\All Users\"
  394. if ($OS.StartsWith("6")) {
  395. $commonprofile = $win7cprofile
  396. $autorunsdir = $commonprofile + "Start Menu\Programs\Startup"
  397. if (Test-Path $autorunsdir) {
  398. $dir_found = $true
  399. }
  400.  
  401. }
  402. if ($OS.StartsWith("5")) {
  403. $commonprofile = $winxcprofile
  404. $rudir = $commonprofile + "\Главное меню\Программы\Автозагрузка"
  405. if (Test-Path $rudir) {
  406. $autorunsdir = $rudir
  407. $dir_found = $true
  408. }
  409. else {
  410. $endir = $commonprofile + "\Start Menu\Programs\Startup"
  411. if (Test-Path $rudir) {
  412. $autorunsdir = $endir
  413. $dir_found = $true
  414. }
  415. }
  416. }
  417. if ($dir_found) {
  418. $commonaut = Get-ChildItem -Path $autorunsdir
  419. Write-Host $commonaut.Name -ForegroundColor Red
  420. }
  421. }
  422.  
  423. catch
  424. { Write-Host $_ -ForegroundColor Red }
  425.  
  426.  
  427. Write-Host "`nUser Autoruns"
  428. try {
  429. #$win7 = $false
  430. $baseDisk = "\\" + $strpc + "\c$"
  431. $winxpprofile = $baseDisk + "\Documents and Settings"
  432. $win7profile = $baseDisk + "\users"
  433. if ($OS.StartsWith("5"))
  434. { $currentprofile = $winxpprofile }
  435. if ($OS.StartsWith("6")) {
  436. $currentprofile = $win7profile
  437. #$win7 = $true
  438. }
  439. $users = Get-ChildItem -Path $currentprofile | Where-Object { $_.Attributes -eq "Directory" } #| Where-Object {$_.Attributes -ne "Hidden"}
  440. ForEach ($user in $users) {
  441. switch ($user) {
  442. "All Users" { }
  443. "UpdatusUser" { }
  444. default {
  445. if ($OS.StartsWith("6")) {
  446. $autorunsdir = $currentprofile + "\" + $user + "\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
  447. }
  448. else {
  449. $rudir = $currentprofile + "\" + $user + "\Главное меню\Программы\Автозагрузка"
  450. if (Test-Path $rudir) {
  451. $autorunsdir = $rudir
  452. $dir_found = $true
  453. }
  454. else {
  455. $endir = $commonprofile + "\Start Menu\Programs\Startup"
  456. if (Test-Path $rudir) {
  457. $autorunsdir = $endir
  458. $dir_found = $true
  459. }
  460. }
  461. }
  462. Write-Host $user
  463. $useraut = Get-ChildItem -Path $autorunsdir
  464. Write-Host $useraut.Name -ForegroundColor Red
  465. }
  466. }
  467. }
  468. }
  469. catch
  470. { Write-Host $_ -ForegroundColor Red }
  471. }
  472.  
  473. if ($ShowTasks) {
  474. Write-Host "`nЗадачи"
  475. try {
  476. $fullpath = "\\" + $strpc + "\admin$\Tasks"
  477. $tasks = Get-ChildItem -Path $fullpath | Where-Object { $_.Extension -eq ".job" }
  478. foreach ($task in $tasks) {
  479. Write-Host $task.Name -ForegroundColor Red
  480. }
  481. }
  482. catch
  483. { Write-Host $_ -ForegroundColor Red }
  484.  
  485.  
  486. }
  487.  
  488. if ($ShowServices) {
  489. Write-Host "`nАвтозапускаемые сервисы"
  490. try {
  491. $services = Get-WmiObject -ComputerName $strpc -Class Win32_service -Filter "StartMode='Auto'"# | Format-Table -Property DisplayName, Pathname
  492. ForEach ($service in $services) {
  493. if (GoodServices -name $service.Name -path $service.Pathname) {
  494. $Host.UI.RawUI.ForegroundColor = "Green"
  495. if ($HideKnown) { }
  496. else { "{0,-33}{1,-20}" -f $service.DisplayName, $service.Pathname }
  497. }
  498. else {
  499. $Host.UI.RawUI.ForegroundColor = "Red"
  500. "{0,-33}{1,-20}" -f $service.DisplayName, $service.Pathname
  501. }
  502.  
  503. $host.UI.RawUI.ForegroundColor = $originalcolor
  504. }
  505. }
  506. catch
  507. { Write-Host $_ -ForegroundColor Red }
  508. }
  509.  
  510. if ($ShowProcesses) {
  511. Write-Host "`nСписок процессов"
  512. try {
  513. #Get-WmiObject -ComputerName $strpc win32_process | Format-Table -Property Name, ExecutablePath
  514.  
  515. $processes = Get-WmiObject -ComputerName $strpc -Class win32_process
  516. ForEach ($process in $processes) {
  517. if (GoodProcesses -name $process.Name -path $process.ExecutablePath) {
  518. $Host.UI.RawUI.ForegroundColor = "Green"
  519. if ($HideKnown) { }
  520. else { "{0,-33}{1,-20}" -f $process.Name, $process.ExecutablePath }
  521. }
  522. else {
  523. $Host.UI.RawUI.ForegroundColor = "Red"
  524. "{0,-33}{1,-20}" -f $process.Name, $process.ExecutablePath
  525. }
  526.  
  527. $host.UI.RawUI.ForegroundColor = $originalcolor
  528. }
  529. }
  530.  
  531. catch
  532. { Write-Host $_ -ForegroundColor Red }
  533. }
  534.  
  535. if ($ShowAvEvents) {
  536. try {
  537. Write-Host "`nСписок обнаруженныех вирусов"
  538. if ($RawEvent)
  539. { Write-Host "Выводятся все сообщения от антивируса`n" -ForegroundColor Red }
  540. foreach ($event in $events) {
  541. if ($RawEvent) {
  542. Write-Host $event.TimeGenerated
  543. Write-Host $event.message
  544. }
  545. else {
  546. $msgfiltred = $event | Where-Object { $_.Message -like '*Обнаружен вредоносный объект*' } | Select-Object -ExpandProperty message
  547. $virname = $msgfiltred -split "`n" | Select-String "Результат\\Название:"
  548. $virname = $virname -replace "Результат\\Название: ", ""
  549. $virbody = $msgfiltred -split "`n" | Select-String "Объект:"
  550. $virbody = $virbody -replace "Объект:"
  551. if (!($virname.length -eq 0))
  552. { "{0,-20}{1,-30}{2,-30}" -f $event.TimeGenerated, $virname, $virbody }
  553. }
  554. }
  555. }
  556. catch
  557. { Write-Host $_ -ForegroundColor Red }
  558. }
  559.  
  560. try {
  561. Write-Host "`n`nТекущий пользователь: "@(Get-WmiObject -ComputerName $strpc -Namespace root\cimv2 -Class Win32_ComputerSystem)[0].UserName;
  562. }
  563. catch
  564. { Write-Host "`n`n" }
  565. Write-Host "Конец собранной информации об IP:"$strpc
  566. #$x = $Host.UI.RawUI.ReadKey("NoEcho, IncludeKeyDown")
  567. }
  568. }
  569. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!