Limit KVRT scan to Users and ProgramData folders

This commit is contained in:
2Shirt 2023-02-04 17:20:06 -08:00
parent 4f89656edc
commit f371a4cb83
Signed by: 2Shirt
GPG key ID: 152FAC923B0E132C

View file

@ -88,6 +88,7 @@ GPUPDATE_SUCCESS_STRINGS = (
)
IN_CONEMU = 'ConEmuPID' in os.environ
MENU_PRESETS = Menu()
PROGRAMDATA = os.environ.get('{ALLUSERSPROFILE}', r'C:\ProgramData')
PROGRAMFILES_32 = os.environ.get(
'PROGRAMFILES(X86)', os.environ.get(
'PROGRAMFILES', r'C:\Program Files (x86)',
@ -1031,12 +1032,18 @@ def run_kvrt():
log_path.parent.mkdir(parents=True, exist_ok=True)
quarantine_path = set_quarantine_path('KVRT')
quarantine_path.mkdir(parents=True, exist_ok=True)
report_path = quarantine_path.joinpath('Reports')
report_path.mkdir(parents=True, exist_ok=True)
scan_list = log_path.with_suffix('.lst')
scan_list.write_text(
f'{PROGRAMDATA}\n{SYSTEMDRIVE}\\Users', encoding='utf-8',
)
cmd_args = (
'-accepteula',
'-d', str(quarantine_path),
'-dontencrypt', '-fixednames',
'-processlevel', '1',
'-custom', SYSTEMDRIVE,
'-customlist', str(scan_list),
'-silent', '-adinsilent',
)