From 9b1555e12469acfd771efb4fbed2799e189a62c9 Mon Sep 17 00:00:00 2001 From: oleg Date: Wed, 16 Sep 2026 10:11:20 +0000 Subject: [PATCH] =?UTF-8?q?sergey-filter:=20=D1=84=D0=B8=D0=BB=D1=8C=D1=82?= =?UTF-8?q?=D1=80=20=D0=BA=D0=BE=D0=BD=D1=82=D0=B5=D0=BD=D1=82=D0=B0=20Win?= =?UTF-8?q?dows?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- sergey-filter.ps1 | 124 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 124 insertions(+) create mode 100644 sergey-filter.ps1 diff --git a/sergey-filter.ps1 b/sergey-filter.ps1 new file mode 100644 index 0000000..fa68307 --- /dev/null +++ b/sergey-filter.ps1 @@ -0,0 +1,124 @@ +# sergey-filter.ps1 — фильтр контента на Windows: AdGuard DNS (DoH) + браузеры без своего DoH + hosts + удаление Telegram/MAX + запрет запуска +# Запуск (PowerShell от администратора), ПЕРЕД запуском задать ID профиля AdGuard DNS: +# $AGID='abcdef'; [Net.ServicePointManager]::SecurityProtocol='Tls12'; irm https://git.dttb.ru/oleg/scripts/raw/branch/main/sergey-filter.ps1 | iex +# Откат: $UNDO=1; ... | iex — снимает политики DNS/браузеров, hosts и запреты запуска (программы не восстанавливает) + +$ErrorActionPreference = 'Continue' +if (-not $AGID -and -not $UNDO) { Write-Host 'Не задан $AGID (ID профиля AdGuard DNS). Пример: $AGID=''abcdef''' -ForegroundColor Red; return } + +$DohTemplate = "https://d.adguard-dns.com/dns-query/$AGID" +$DnsIPs = @('94.140.14.14','94.140.15.15') +$BlockDomains = @('telegram.org','www.telegram.org','desktop.telegram.org','t.me','telegram.me','web.telegram.org','tdesktop.com','telegram.dog', + 'max.ru','www.max.ru','web.max.ru','download.max.ru','oneme.ru','www.oneme.ru') +$BlockExe = @('Telegram.exe','Max.exe','MAX.exe','Unigram.exe') + +function Step($t){ Write-Host "`n=== $t ===" -ForegroundColor Cyan } +function RegSet($path,$name,$value,$type='DWord'){ if(-not (Test-Path $path)){ New-Item -Path $path -Force | Out-Null }; New-ItemProperty -Path $path -Name $name -Value $value -PropertyType $type -Force | Out-Null; Write-Host " $path\$name = $value" } + +$os = Get-CimInstance Win32_OperatingSystem +$build = [int]$os.BuildNumber +$isPro = $os.Caption -notmatch 'Home|Домашняя' +Step "Система" +Write-Host " $($os.Caption) build $build ($(if($isPro){'Pro-ветка: SRP доступен'}else{'Home: только DisallowRun'}))" + +if ($UNDO) { + Step "ОТКАТ" + Remove-Item 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient' -Recurse -Force -EA SilentlyContinue + foreach($k in 'HKLM:\SOFTWARE\Policies\Google\Chrome','HKLM:\SOFTWARE\Policies\Microsoft\Edge','HKLM:\SOFTWARE\Policies\YandexBrowser','HKLM:\SOFTWARE\Policies\Mozilla\Firefox'){ + foreach($n in 'DnsOverHttpsMode','BuiltInDnsClientEnabled','ForceGoogleSafeSearch','ForceYouTubeRestrict'){ Remove-ItemProperty $k -Name $n -EA SilentlyContinue } } + Remove-Item 'HKLM:\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS' -Recurse -Force -EA SilentlyContinue + Remove-Item 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer' -Recurse -Force -EA SilentlyContinue + Remove-Item 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun' -Recurse -Force -EA SilentlyContinue + Remove-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name DisallowRun -EA SilentlyContinue + $h = "$env:SystemRoot\System32\drivers\etc\hosts"; (Get-Content $h) | Where-Object { $_ -notmatch '# sergey-filter' } | Set-Content $h -Encoding ASCII + Get-NetAdapter -Physical | Where-Object Status -eq 'Up' | ForEach-Object { Set-DnsClientServerAddress -InterfaceIndex $_.ifIndex -ResetServerAddresses } + Write-Host "Откат выполнен. Перезагрузить." -ForegroundColor Green; return +} + +Step "1. DNS системы → AdGuard DNS" +$adapters = Get-NetAdapter -Physical | Where-Object Status -eq 'Up' +foreach($a in $adapters){ Set-DnsClientServerAddress -InterfaceIndex $a.ifIndex -ServerAddresses $DnsIPs; Write-Host " $($a.Name): $($DnsIPs -join ', ')" } +if ($build -ge 22000) { + foreach($ip in $DnsIPs){ + Remove-DnsClientDohServerAddress -ServerAddress $ip -EA SilentlyContinue + Add-DnsClientDohServerAddress -ServerAddress $ip -DohTemplate $DohTemplate -AllowFallbackToUdp $false -AutoUpgrade $true | Out-Null + Write-Host " DoH: $ip → $DohTemplate" + } + # Политика: DoH обязателен (3). Если DoH недоступен — DNS не работает, это осознанно (иначе фильтр обходится сменой DNS). + RegSet 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient' 'DoHPolicy' 3 +} else { + Write-Host " Windows 10: системного DoH нет. Стоит обычный DNS AdGuard (публичный, без профиля!)." -ForegroundColor Yellow + Write-Host " Для профиля на Win10 нужен AdGuard DNS Client или привязка IP (Linked IP) в панели — решить вручную." -ForegroundColor Yellow +} + +Step "2. Браузеры: свой DoH выключен, SafeSearch принудительно" +foreach($k in 'HKLM:\SOFTWARE\Policies\Google\Chrome','HKLM:\SOFTWARE\Policies\Microsoft\Edge','HKLM:\SOFTWARE\Policies\YandexBrowser'){ + RegSet $k 'DnsOverHttpsMode' 'off' 'String' + RegSet $k 'BuiltInDnsClientEnabled' 0 + RegSet $k 'ForceGoogleSafeSearch' 1 + RegSet $k 'ForceYouTubeRestrict' 1 +} +RegSet 'HKLM:\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS' 'Enabled' 0 +RegSet 'HKLM:\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS' 'Locked' 1 +$opera = Get-ChildItem "$env:LOCALAPPDATA\Programs\Opera*","$env:APPDATA\Opera Software" -EA SilentlyContinue +if($opera){ Write-Host " ВНИМАНИЕ: найден Opera — политиками не управляется, встроенный VPN обходит фильтр. Удалить вручную." -ForegroundColor Yellow } + +Step "3. hosts: веб-версии и загрузка Telegram/MAX" +$h = "$env:SystemRoot\System32\drivers\etc\hosts" +$cur = Get-Content $h -EA SilentlyContinue +$add = $BlockDomains | Where-Object { $d=$_; -not ($cur | Where-Object { $_ -match "\s$([regex]::Escape($d))(\s|$)" }) } | ForEach-Object { "0.0.0.0 $_ # sergey-filter" } +if($add){ Add-Content $h -Value $add -Encoding ASCII; Write-Host " добавлено $($add.Count) записей" } else { Write-Host " уже есть" } +ipconfig /flushdns | Out-Null + +Step "4. Удаление Telegram и MAX" +Get-Process | Where-Object { $_.Name -match '^(Telegram|Max|Unigram)$' } | Stop-Process -Force -EA SilentlyContinue +$unins = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' -EA SilentlyContinue | + Where-Object { $_.DisplayName -match '^Telegram|^MAX\b|^Max\b|OneMe' } +foreach($u in $unins){ + Write-Host " найдено: $($u.DisplayName) → $($u.UninstallString)" + $cmd = $u.QuietUninstallString; if(-not $cmd){ $cmd = $u.UninstallString } + if($cmd -match 'unins\d*\.exe'){ $cmd = "$cmd /VERYSILENT /NORESTART" } + elseif($cmd -match 'Update\.exe.*--uninstall'){ $cmd = "$cmd -s" } + elseif($cmd -match 'msiexec'){ $cmd = ($cmd -replace '/I','/X') + ' /qn /norestart' } + try { cmd /c "$cmd" | Out-Null; Write-Host " выполнено: $cmd" } catch { Write-Host " ошибка, удалить вручную: $cmd" -ForegroundColor Yellow } +} +if(-not $unins){ Write-Host " в списке программ не найдено" } +$appx = Get-AppxPackage -AllUsers | Where-Object { $_.Name -match 'Telegram|Unigram|\.MAX|OneMe' } +foreach($p in $appx){ Write-Host " Store-пакет: $($p.Name)"; Remove-AppxPackage -Package $p.PackageFullName -AllUsers -EA SilentlyContinue } +# Портативные остатки +foreach($d in "$env:APPDATA\Telegram Desktop","$env:LOCALAPPDATA\Programs\MAX","$env:LOCALAPPDATA\Programs\Max","$env:LOCALAPPDATA\Max","$env:LOCALAPPDATA\MAX"){ + if(Test-Path $d){ Remove-Item $d -Recurse -Force -EA SilentlyContinue; Write-Host " удалена папка $d" } } +$left = Get-ChildItem "$env:USERPROFILE","$env:ProgramFiles","${env:ProgramFiles(x86)}" -Recurse -Include $BlockExe -EA SilentlyContinue -Depth 4 | Select-Object -Expand FullName +if($left){ Write-Host " ОСТАЛИСЬ exe (удалить вручную):" -ForegroundColor Yellow; $left | ForEach-Object { Write-Host " $_" } } + +Step "5. Запрет запуска" +$dr = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' +RegSet $dr 'DisallowRun' 1 +if(-not (Test-Path "$dr\DisallowRun")){ New-Item "$dr\DisallowRun" -Force | Out-Null } +$i=1; foreach($e in $BlockExe){ New-ItemProperty "$dr\DisallowRun" -Name $i -Value $e -PropertyType String -Force | Out-Null; $i++ } +Write-Host " DisallowRun: $($BlockExe -join ', ')" +if($isPro){ + $safer = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers' + RegSet $safer 'DefaultLevel' 262144 # Unrestricted + RegSet $safer 'TransparentEnabled' 1 + RegSet $safer 'PolicyScope' 0 + RegSet $safer 'AuthenticodeEnabled' 0 + RegSet $safer 'ExecutableTypes' @('ADE','ADP','BAS','BAT','CHM','CMD','COM','CPL','CRT','EXE','HLP','HTA','INF','INS','ISP','LNK','MDB','MDE','MSC','MSI','MSP','MST','OCX','PCD','PIF','REG','SCR','SHS','URL','VB','WSC') 'MultiString' + foreach($e in $BlockExe){ + $g = "{$([guid]::NewGuid().ToString())}" + $p = "$safer\0\Paths\$g" + RegSet $p 'ItemData' $e 'ExpandString' + RegSet $p 'SaferFlags' 0 + RegSet $p 'Description' 'sergey-filter' 'String' + } + Write-Host " SRP (Disallowed по имени файла) добавлен — действует после перезагрузки/перелогина" +} + +Step "6. Проверка" +if($build -ge 22000){ Get-DnsClientDohServerAddress | Format-Table -AutoSize | Out-String | Write-Host } +foreach($d in 'pornhub.com','t.me','web.max.ru','ya.ru'){ + try { $r = Resolve-DnsName $d -Type A -EA Stop | Select-Object -First 1 -Expand IPAddress } catch { $r = 'NXDOMAIN/ошибка' } + Write-Host (" {0,-14} → {1}" -f $d, $r) +} +Write-Host "`nОжидание: pornhub/t.me/web.max.ru → 0.0.0.0 или пусто; ya.ru → реальный IP." -ForegroundColor Green +Write-Host "Дальше: перезагрузка, затем проверить в браузере и в режиме раздачи с телефона." -ForegroundColor Green