Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ограничение <==== ВНИМАНИЕ
GroupPolicy: Ограничение ? <==== ВНИМАНИЕ
Policies: C:\ProgramData\NTUSER.pol: Ограничение <==== ВНИМАНИЕ
Task: {3A7ACC18-6F4B-4258-B72C-80529FA17212} - \Microsoft\Windows\WindowsBackup\RealtekCheck -> Нет файла <==== ВНИМАНИЕ
Task: {6DE78182-59F3-4435-968B-489308A930B0} - \Microsoft\Windows\WindowsBackup\OnlogonCheck -> Нет файла <==== ВНИМАНИЕ
Task: {A6D5721D-9C80-4D6B-94BE-27EBE13BFED3} - \Microsoft\Windows\WindowsBackup\WinlogonCheck -> Нет файла <==== ВНИМАНИЕ
Task: {EB888D3C-55C6-4AB8-A0E8-C4FC79D1431D} - \Microsoft\Windows\WindowsBackup\TaskCheck -> Нет файла <==== ВНИМАНИЕ
AV: Kaspersky Total Security (Enabled - Up to date) {4F76F112-43EB-40E8-11D8-F7BD1853EA23}
FW: Kaspersky Total Security (Disabled) {774D7037-0984-41B0-3A87-5E88E680AD58}
ContextMenuHandlers1_S-1-5-21-4051196029-3347874616-3046436787-1001: [ kwpsshellext] -> {28A80003-18FD-411D-B0A3-3C81F618E22B} => -> Нет файла
ContextMenuHandlers4_S-1-5-21-4051196029-3347874616-3046436787-1001: [ kwpsshellext] -> {28A80003-18FD-411D-B0A3-3C81F618E22B} => -> Нет файла
cmd: DISM.exe /Online /Cleanup-image /Restorehealth
cmd: sfc /scannow
cmd: winmgmt /salvagerepository
cmd: winmgmt /verifyrepository
cmd: "%WINDIR%\SYSTEM32\lodctr.exe" /R
cmd: "%WINDIR%\SysWOW64\lodctr.exe" /R
cmd: "%WINDIR%\SYSTEM32\lodctr.exe" /R
cmd: "%WINDIR%\SysWOW64\lodctr.exe" /R
StartPowerShell:
# Function to manage Windows Defender, remove exclusions, run scan, report on status
Function Manage-WindowsDefender {
Get-MpComputerStatus
echo "Listing of exclusions"
Get-MpPreference | Select-Object -Expand ExclusionPath | Out-String -width 4096
$Paths=(Get-MpPreference).ExclusionPath
$Extensions=(Get-MpPreference).ExclusionExtension
$Processes=(Get-MpPreference).ExclusionProcess
foreach ($Path in $Paths) { Remove-MpPreference -ExclusionPath $Path -Force}
foreach ($Extension in $Extensions) { Remove-MpPreference -ExclusionExtension $Extension -Force}
foreach ($Process in $Processes) { Remove-MpPreference -ExclusionProcess $Process -Force}
Set-MpPreference -DisableAutoExclusions $true -Force
Set-MpPreference -CheckForSignaturesBeforeRunningScan $true -Force
Set-MpPreference -DisableArchiveScanning $false -Force
Set-MpPreference -DisableBehaviorMonitoring $false -Force
Set-MpPreference -DisableEmailScanning $False -Force
Set-MpPreference -DisableIOAVProtection $false -Force
Set-MpPreference -DisablePrivacyMode $true -Force
Set-MpPreference -DisableRealtimeMonitoring $false -Force
Set-MpPreference -MAPSReporting Advanced -Force
Set-MpPreference -PUAProtection enabled -Force
Set-MpPreference -SignatureScheduleDay Everyday -Force
Set-MpPreference -DisableRemovableDriveScanning $false -Force
Set-MpPreference -SubmitSamplesConsent SendSafeSamples
# Reset and check Secure Health status
Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage
Get-AppxPackage Microsoft.SecHealthUI -AllUsers|select Name, Status
# Check if these services are running
Get-Service Windefend, SecurityHealthService, wscsvc, mpsdrv, mpssvc, WdNisSvc | Select Name,DisplayName, Status
# Check for signature updates
Update-MpSignature
Start-MpScan -ScanType QuickScan
Remove-MpThreat
# Check computer status again after setting to make sure changes were applied
Get-MpComputerStatus
Get-MpPreference
Get-MpThreatDetection
}
EndPowerShell:
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
EmptyTemp:
Reboot:
End::
