---

$ErrorActionPreference = "SilentlyContinue"

$desktop = [Environment]::GetFolderPath("Desktop")
$out = Join-Path $desktop "SFT_FAST_DIAG.txt"

"===== SFT / GAZPROMBANK FAST DIAGNOSTICS =====" | Out-File $out -Encoding UTF8
"Computer: $env:COMPUTERNAME" | Out-File $out -Append
"User: $env:USERDOMAIN\$env:USERNAME" | Out-File $out -Append
"Date: $(Get-Date)" | Out-File $out -Append


# -------------------------------------------------
# 1. УСТАНОВЛЕННЫЕ КОМПОНЕНТЫ
# -------------------------------------------------

"`r`n===== INSTALLED SOFTWARE =====" | Out-File $out -Append

$roots = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*"
)

Get-ItemProperty $roots |
Where-Object {
    "$($_.DisplayName) $($_.Publisher) $($_.InstallLocation)" -match
    '(?i)SFT|СФТ|Synactis|Gazprom|Газпром|Bank.?Client|Клиент.?Банк|CBS'
} |
Select-Object DisplayName,DisplayVersion,Publisher,InstallLocation |
Format-List |
Out-String |
Out-File $out -Append


# -------------------------------------------------
# 2. БЫСТРЫЙ ПОИСК COM / ACTIVEX
# native reg.exe намного быстрее PowerShell-перебора
# -------------------------------------------------

"`r`n===== COM / ACTIVEX REGISTRY SEARCH =====" | Out-File $out -Append

$terms = @(
    "Synactis",
    "SFT",
    "СФТ",
    "Gazprom",
    "BankClient",
    "Bank Client"
)

$regRoots = @(
    "HKCR\CLSID",
    "HKCR\WOW6432Node\CLSID"
)

foreach ($r in $regRoots) {
    foreach ($term in $terms) {

        "`r`n--- $r : $term ---" | Out-File $out -Append

        & reg.exe query $r /s /f $term /d 2>&1 |
            Out-File $out -Append
    }
}


# -------------------------------------------------
# 3. BHO
# -------------------------------------------------

"`r`n===== BROWSER HELPER OBJECTS =====" | Out-File $out -Append

$bhos = @(
    "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects",
    "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects"
)

foreach ($bho in $bhos) {
    "`r`n--- $bho ---" | Out-File $out -Append
    & reg.exe query $bho /s 2>&1 | Out-File $out -Append
}


# -------------------------------------------------
# 4. EDGE IE MODE
# -------------------------------------------------

"`r`n===== EDGE IE MODE =====" | Out-File $out -Append

& reg.exe query "HKLM\SOFTWARE\Policies\Microsoft\Edge" /s 2>&1 |
    Out-File $out -Append

& reg.exe query "HKCU\SOFTWARE\Policies\Microsoft\Edge" /s 2>&1 |
    Out-File $out -Append


# -------------------------------------------------
# 5. ACTIVE-X БЛОКИРОВКИ
# -------------------------------------------------

"`r`n===== ACTIVEX COMPATIBILITY =====" | Out-File $out -Append

& reg.exe query "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility" /s 2>&1 |
    Select-String -Pattern "Compatibility Flags|CLSID|Synactis|SFT|Bank" |
    Out-File $out -Append

& reg.exe query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility" /s 2>&1 |
    Select-String -Pattern "Compatibility Flags|CLSID|Synactis|SFT|Bank" |
    Out-File $out -Append


# -------------------------------------------------
# 6. СВЕЖИЕ REPORT.*
# -------------------------------------------------

"`r`n===== REPORT CACHE =====" | Out-File $out -Append

$files = Get-ChildItem "$env:LOCALAPPDATA\Microsoft\Windows\INetCache" `
    -Recurse -Force -File -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match '(?i)^report\.(asp|tmp|pdf)$' } |
    Sort-Object LastWriteTime -Descending |
    Select-Object -First 10

foreach ($f in $files) {

    "`r`n$($f.FullName)" | Out-File $out -Append
    "Size: $($f.Length)" | Out-File $out -Append
    "Modified: $($f.LastWriteTime)" | Out-File $out -Append

    if ($f.Length -gt 0) {

        $b = [IO.File]::ReadAllBytes($f.FullName)

        $n = [Math]::Min(16,$b.Length)

        "HEX: $(($b[0..($n-1)] | ForEach-Object {$_.ToString('X2')}) -join ' ')" |
            Out-File $out -Append

        $searchLength = [Math]::Min(1024,$b.Length)
        $s = [Text.Encoding]::ASCII.GetString($b,0,$searchLength)

        $pdfOffset = $s.IndexOf("%PDF-")

        "PDF offset: $pdfOffset" | Out-File $out -Append
    }
}


# -------------------------------------------------
# 7. PDF / TMP ASSOCIATIONS
# -------------------------------------------------

"`r`n===== ASSOCIATIONS =====" | Out-File $out -Append

cmd /c "assoc .pdf" 2>&1 | Out-File $out -Append
cmd /c "assoc .tmp" 2>&1 | Out-File $out -Append
cmd /c "assoc .asp" 2>&1 | Out-File $out -Append


"`r`n===== DONE =====" | Out-File $out -Append

Write-Host ""
Write-Host "ГОТОВО:" -ForegroundColor Green
Write-Host $out -ForegroundColor Yellow
Write-Host ""
Write-Host "Пришли мне файл SFT_FAST_DIAG.txt с рабочего стола."