PowerShell/scripts/scan-folder.ps1

46 lines
1.6 KiB
PowerShell
Raw Normal View History

2024-11-08 08:50:37 +01:00
<#
.SYNOPSIS
2024-11-25 14:32:02 +01:00
Scans a folder for malware
2024-11-08 08:50:37 +01:00
.DESCRIPTION
2024-11-25 14:32:02 +01:00
This PowerShell script scans a folder for malware (including subfolders). Requires ESET Endpoint Security or Windows Defender.
2024-11-08 08:50:37 +01:00
.PARAMETER path
Specifies the file path to the folder (default is working directory).
.EXAMPLE
PS> ./scan-folder.ps1 C:\Windows
2024-11-25 14:32:02 +01:00
Scanning C:\Windows with ESET Endpoint Security...
2024-11-08 08:50:37 +01:00
...
.LINK
https://github.com/fleschutz/PowerShell
.NOTES
Author: Markus Fleschutz | License: CC0
#>
param([string]$path = "$PWD")
try {
$stopWatch = [system.diagnostics.stopwatch]::startNew()
if (-not(Test-Path $path -pathType container)) { throw "Invalid file path: $path" }
$path = Resolve-Path $path
if (Test-Path "C:\Program Files\ESET\ESET Security\ecls.exe" -pathType leaf) {
2024-11-25 14:32:02 +01:00
Write-Host "⏳ Scanning $path with ESET Endpoint Security..."
2024-11-08 08:50:37 +01:00
& "C:\Program Files\ESET\ESET Security\ecls.exe" $path
2024-11-25 14:32:02 +01:00
if ($lastExitCode -ne 0) { throw "ESET Endpoibnt Security exited with code $lastExitCode - POTENTIAL THREAT !!!" }
2024-11-08 08:50:37 +01:00
} elseif (Test-Path "C:\Program Files\Windows Defender\MpCmdRun.exe" -pathType leaf) {
2024-11-25 14:32:02 +01:00
Write-Host "⏳ Scanning $path with Windows Defender..."
2024-11-08 08:50:37 +01:00
& "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 2 -File $path
2024-11-25 14:32:02 +01:00
if ($lastExitCode -ne 0) { throw "Windows Defender exited with code $lastExitCode - POTENTIAL THREAT !!!" }
2024-11-08 08:50:37 +01:00
} else {
2024-11-25 14:32:02 +01:00
throw "No ESET Endpoint Security or Windows Defender available - please install one."
2024-11-08 08:50:37 +01:00
}
[int]$elapsed = $stopWatch.Elapsed.TotalSeconds
2024-11-25 14:32:02 +01:00
Write-Host "✅ Scanned $path in $($elapsed)s: No malware found."
2024-11-08 08:50:37 +01:00
exit 0 # success
} catch {
"⚠️ Error: $($Error[0])"
exit 1
}