---

@echo off
setlocal EnableExtensions

rem Read-only diagnostic collector for Windows 10/11.
rem It does not delete drivers, routes, services, firewall rules, or registry data.

fltmc >nul 2>&1
if not "%errorlevel%"=="0" (
    echo Administrator rights are required. Requesting elevation...
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
    exit /b
)

for /f "usebackq delims=" %%D in (`powershell.exe -NoProfile -Command "[Environment]::GetFolderPath('Desktop')"`) do set "DESKTOP=%%D"
if not defined DESKTOP set "DESKTOP=%USERPROFILE%\Desktop"

set "OUT=%DESKTOP%\NETWORK_DIAG.txt"
set "WFP=%DESKTOP%\NETWORK_WFP_STATE.xml"
set "WINSOCK=%TEMP%\NETWORK_WINSOCK.txt"
set "RX=amnez^|amnesia^|wireguard^|wintun^|openvpn^|tap0901^|tap-windows^|360 total^|qihu^|qhactive^|bapidrv^|vpn"

>"%OUT%" echo NETWORK DIAGNOSTIC REPORT
>>"%OUT%" echo Created: %date% %time%
>>"%OUT%" echo Computer: %COMPUTERNAME%
>>"%OUT%" echo User: %USERNAME%
>>"%OUT%" echo This script made no system changes.

call :section "BASIC SYSTEM"
ver >>"%OUT%" 2>&1
whoami /all >>"%OUT%" 2>&1

call :section "QUICK CONNECTIVITY TESTS"
ping -n 2 127.0.0.1 >>"%OUT%" 2>&1
ping -n 2 192.168.10.1 >>"%OUT%" 2>&1
ping -n 2 1.1.1.1 >>"%OUT%" 2>&1
nslookup ya.ru >>"%OUT%" 2>&1
tracert -d -h 3 -w 1000 1.1.1.1 >>"%OUT%" 2>&1
powershell.exe -NoProfile -Command "Test-NetConnection 1.1.1.1 -Port 443 -InformationLevel Detailed" >>"%OUT%" 2>&1

call :section "IP CONFIGURATION"
ipconfig /all >>"%OUT%" 2>&1

call :section "IPV4 ROUTES"
route print -4 >>"%OUT%" 2>&1
powershell.exe -NoProfile -Command "Get-NetRoute -AddressFamily IPv4 -ErrorAction SilentlyContinue | Sort-Object InterfaceIndex,DestinationPrefix,RouteMetric | Format-Table InterfaceIndex,InterfaceAlias,DestinationPrefix,NextHop,RouteMetric,PolicyStore -AutoSize" >>"%OUT%" 2>&1

call :section "ALL NETWORK ADAPTERS INCLUDING HIDDEN"
powershell.exe -NoProfile -Command "Get-NetAdapter -IncludeHidden -ErrorAction SilentlyContinue | Sort-Object ifIndex | Format-Table Name,InterfaceDescription,Status,ifIndex,MacAddress -AutoSize" >>"%OUT%" 2>&1

call :section "ENABLED ADAPTER BINDINGS"
powershell.exe -NoProfile -Command "Get-NetAdapterBinding -Name '*' -ErrorAction SilentlyContinue | Where-Object { $_.Enabled -eq $true } | Format-Table Name,DisplayName,ComponentID,Enabled -AutoSize" >>"%OUT%" 2>&1

call :section "SUSPICIOUS RUNNING OR INSTALLED SERVICES"
powershell.exe -NoProfile -Command "$rx='%RX%'; Get-CimInstance Win32_Service -ErrorAction SilentlyContinue | Where-Object { $_.Name -match $rx -or $_.DisplayName -match $rx -or $_.PathName -match $rx } | Format-Table Name,DisplayName,State,StartMode,PathName -Wrap -AutoSize" >>"%OUT%" 2>&1

call :section "SUSPICIOUS SYSTEM DRIVERS"
powershell.exe -NoProfile -Command "$rx='%RX%'; Get-CimInstance Win32_SystemDriver -ErrorAction SilentlyContinue | Where-Object { $_.Name -match $rx -or $_.DisplayName -match $rx -or $_.PathName -match $rx } | Format-Table Name,DisplayName,State,StartMode,PathName -Wrap -AutoSize" >>"%OUT%" 2>&1

call :section "SUSPICIOUS PROCESSES"
powershell.exe -NoProfile -Command "$rx='%RX%'; Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object { $_.Name -match $rx -or $_.ExecutablePath -match $rx -or $_.CommandLine -match $rx } | Format-Table ProcessId,Name,ExecutablePath,CommandLine -Wrap -AutoSize" >>"%OUT%" 2>&1

call :section "SUSPICIOUS STARTUP ITEMS AND SCHEDULED TASKS"
powershell.exe -NoProfile -Command "$rx='%RX%'; Get-CimInstance Win32_StartupCommand -ErrorAction SilentlyContinue | Where-Object { $_.Name -match $rx -or $_.Command -match $rx -or $_.Location -match $rx } | Format-Table Name,Command,Location,User -Wrap -AutoSize" >>"%OUT%" 2>&1
powershell.exe -NoProfile -Command "$rx='%RX%'; Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.TaskName -match $rx -or $_.TaskPath -match $rx } | Format-Table TaskName,TaskPath,State -AutoSize" >>"%OUT%" 2>&1

call :section "SUSPICIOUS INSTALLED SOFTWARE REMNANTS"
powershell.exe -NoProfile -Command "$rx='%RX%'; $p=@('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'); Get-ItemProperty $p -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -match $rx -or $_.Publisher -match $rx -or $_.InstallLocation -match $rx } | Format-Table DisplayName,DisplayVersion,Publisher,InstallLocation,UninstallString -Wrap -AutoSize" >>"%OUT%" 2>&1

call :section "WINDOWS FIREWALL PROFILES"
powershell.exe -NoProfile -Command "Get-NetFirewallProfile -ErrorAction SilentlyContinue | Format-Table Name,Enabled,DefaultInboundAction,DefaultOutboundAction,PolicyStoreSourceType -AutoSize" >>"%OUT%" 2>&1

call :section "ACTIVE OUTBOUND BLOCK RULES"
powershell.exe -NoProfile -Command "Get-NetFirewallRule -PolicyStore ActiveStore -ErrorAction SilentlyContinue | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Outbound' -and $_.Action -eq 'Block' } | Format-Table DisplayName,Name,PolicyStoreSource,PolicyStoreSourceType -Wrap -AutoSize" >>"%OUT%" 2>&1

call :section "AMNEZIA OR 360 FIREWALL RULE NAMES"
powershell.exe -NoProfile -Command "$rx='%RX%'; Get-NetFirewallRule -PolicyStore ActiveStore -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -match $rx -or $_.Name -match $rx -or $_.PolicyStoreSource -match $rx } | Format-List DisplayName,Name,Enabled,Direction,Action,PolicyStoreSource,PolicyStoreSourceType" >>"%OUT%" 2>&1

call :section "ACTIVE IPSEC RULES"
powershell.exe -NoProfile -Command "Get-NetIPsecRule -PolicyStore ActiveStore -ErrorAction SilentlyContinue | Where-Object { $_.Enabled -eq 'True' } | Format-Table DisplayName,Name,Mode,InboundSecurity,OutboundSecurity,PolicyStoreSource -Wrap -AutoSize" >>"%OUT%" 2>&1

call :section "SYSTEM AND USER PROXY"
netsh winhttp show proxy >>"%OUT%" 2>&1
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable >>"%OUT%" 2>&1
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer >>"%OUT%" 2>&1
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL >>"%OUT%" 2>&1

call :section "INSTALLED NETWORK COMPONENTS"
netcfg -s n >>"%OUT%" 2>&1

call :section "THIRD-PARTY NETSERVICE DRIVER PACKAGES"
pnputil /enum-drivers /class NetService >>"%OUT%" 2>&1

call :section "WINSOCK SUSPICIOUS MATCHES"
netsh winsock show catalog >"%WINSOCK%" 2>&1
findstr /i /c:"amnez" /c:"amnesia" /c:"wireguard" /c:"wintun" /c:"openvpn" /c:"tap" /c:"360" /c:"qihu" /c:"qh" /c:"vpn" "%WINSOCK%" >>"%OUT%" 2>&1

call :section "WFP SUSPICIOUS MATCHES"
netsh wfp show state file="%WFP%" >nul 2>&1
findstr /i /c:"amnez" /c:"amnesia" /c:"wireguard" /c:"wintun" /c:"360" /c:"qihu" /c:"qh" /c:"killswitch" /c:"kill switch" /c:"block internet" "%WFP%" >>"%OUT%" 2>&1

call :section "NETWORK POLICY REGISTRY"
reg query "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall" /s >>"%OUT%" 2>&1
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\NetworkConnections" /s >>"%OUT%" 2>&1

call :section "END OF REPORT"
>>"%OUT%" echo Main report: %OUT%
>>"%OUT%" echo Full WFP state: %WFP%
>>"%OUT%" echo.
>>"%OUT%" echo Please send NETWORK_DIAG.txt first. Keep NETWORK_WFP_STATE.xml for deeper analysis if requested.

start "" notepad.exe "%OUT%"
echo.
echo Diagnostic collection is complete.
echo Report: "%OUT%"
echo No settings were changed.
echo.
pause
exit /b

:section
>>"%OUT%" echo.
>>"%OUT%" echo ============================================================
>>"%OUT%" echo %~1
>>"%OUT%" echo ============================================================
exit /b