---

Write-Host "`n===== 1. WINDOWS SECURITY ====="
Get-MpComputerStatus -ErrorAction SilentlyContinue |
Select-Object AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated |
Format-List

Write-Host "`n===== 2. SCHEDULED TASKS WITH SUSPICIOUS PATHS ====="
Get-ScheduledTask | ForEach-Object {
    $t = $_
    foreach ($a in $t.Actions) {
        if ("$($a.Execute) $($a.Arguments)" -match 'WindowsOptions|AppData\\Local\\Temp|\\Users\\Public\\|\\Downloads\\.*\.(exe|ps1)|-EncodedCommand|FromBase64String') {
            [PSCustomObject]@{
                Task = "$($t.TaskPath)$($t.TaskName)"
                Execute = $a.Execute
                Arguments = $a.Arguments
            }
        }
    }
} | Format-List

Write-Host "`n===== 3. RECENT POWERSHELL FILES ====="
Get-ChildItem "$env:APPDATA\Microsoft\Windows\PowerShell" -Recurse -File -ErrorAction SilentlyContinue |
Select-Object FullName, LastWriteTime |
Sort-Object LastWriteTime -Descending |
Select-Object -First 10 |
Format-Table -AutoSize

Write-Host "`n===== CHECK FINISHED ====="