125 lines
9.7 KiB
PowerShell
125 lines
9.7 KiB
PowerShell
# sergey-filter.ps1 — фильтр контента на Windows: AdGuard DNS (DoH) + браузеры без своего DoH + hosts + удаление Telegram/MAX + запрет запуска
|
||
# Запуск (PowerShell от администратора), ПЕРЕД запуском задать ID профиля AdGuard DNS:
|
||
# $AGID='abcdef'; [Net.ServicePointManager]::SecurityProtocol='Tls12'; irm https://git.dttb.ru/oleg/scripts/raw/branch/main/sergey-filter.ps1 | iex
|
||
# Откат: $UNDO=1; ... | iex — снимает политики DNS/браузеров, hosts и запреты запуска (программы не восстанавливает)
|
||
|
||
$ErrorActionPreference = 'Continue'
|
||
if (-not $AGID -and -not $UNDO) { Write-Host 'Не задан $AGID (ID профиля AdGuard DNS). Пример: $AGID=''abcdef''' -ForegroundColor Red; return }
|
||
|
||
$DohTemplate = "https://d.adguard-dns.com/dns-query/$AGID"
|
||
$DnsIPs = @('94.140.14.14','94.140.15.15')
|
||
$BlockDomains = @('telegram.org','www.telegram.org','desktop.telegram.org','t.me','telegram.me','web.telegram.org','tdesktop.com','telegram.dog',
|
||
'max.ru','www.max.ru','web.max.ru','download.max.ru','oneme.ru','www.oneme.ru')
|
||
$BlockExe = @('Telegram.exe','Max.exe','MAX.exe','Unigram.exe')
|
||
|
||
function Step($t){ Write-Host "`n=== $t ===" -ForegroundColor Cyan }
|
||
function RegSet($path,$name,$value,$type='DWord'){ if(-not (Test-Path $path)){ New-Item -Path $path -Force | Out-Null }; New-ItemProperty -Path $path -Name $name -Value $value -PropertyType $type -Force | Out-Null; Write-Host " $path\$name = $value" }
|
||
|
||
$os = Get-CimInstance Win32_OperatingSystem
|
||
$build = [int]$os.BuildNumber
|
||
$isPro = $os.Caption -notmatch 'Home|Домашняя'
|
||
Step "Система"
|
||
Write-Host " $($os.Caption) build $build ($(if($isPro){'Pro-ветка: SRP доступен'}else{'Home: только DisallowRun'}))"
|
||
|
||
if ($UNDO) {
|
||
Step "ОТКАТ"
|
||
Remove-Item 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient' -Recurse -Force -EA SilentlyContinue
|
||
foreach($k in 'HKLM:\SOFTWARE\Policies\Google\Chrome','HKLM:\SOFTWARE\Policies\Microsoft\Edge','HKLM:\SOFTWARE\Policies\YandexBrowser','HKLM:\SOFTWARE\Policies\Mozilla\Firefox'){
|
||
foreach($n in 'DnsOverHttpsMode','BuiltInDnsClientEnabled','ForceGoogleSafeSearch','ForceYouTubeRestrict'){ Remove-ItemProperty $k -Name $n -EA SilentlyContinue } }
|
||
Remove-Item 'HKLM:\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS' -Recurse -Force -EA SilentlyContinue
|
||
Remove-Item 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer' -Recurse -Force -EA SilentlyContinue
|
||
Remove-Item 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun' -Recurse -Force -EA SilentlyContinue
|
||
Remove-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name DisallowRun -EA SilentlyContinue
|
||
$h = "$env:SystemRoot\System32\drivers\etc\hosts"; (Get-Content $h) | Where-Object { $_ -notmatch '# sergey-filter' } | Set-Content $h -Encoding ASCII
|
||
Get-NetAdapter -Physical | Where-Object Status -eq 'Up' | ForEach-Object { Set-DnsClientServerAddress -InterfaceIndex $_.ifIndex -ResetServerAddresses }
|
||
Write-Host "Откат выполнен. Перезагрузить." -ForegroundColor Green; return
|
||
}
|
||
|
||
Step "1. DNS системы → AdGuard DNS"
|
||
$adapters = Get-NetAdapter -Physical | Where-Object Status -eq 'Up'
|
||
foreach($a in $adapters){ Set-DnsClientServerAddress -InterfaceIndex $a.ifIndex -ServerAddresses $DnsIPs; Write-Host " $($a.Name): $($DnsIPs -join ', ')" }
|
||
if ($build -ge 22000) {
|
||
foreach($ip in $DnsIPs){
|
||
Remove-DnsClientDohServerAddress -ServerAddress $ip -EA SilentlyContinue
|
||
Add-DnsClientDohServerAddress -ServerAddress $ip -DohTemplate $DohTemplate -AllowFallbackToUdp $false -AutoUpgrade $true | Out-Null
|
||
Write-Host " DoH: $ip → $DohTemplate"
|
||
}
|
||
# Политика: DoH обязателен (3). Если DoH недоступен — DNS не работает, это осознанно (иначе фильтр обходится сменой DNS).
|
||
RegSet 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient' 'DoHPolicy' 3
|
||
} else {
|
||
Write-Host " Windows 10: системного DoH нет. Стоит обычный DNS AdGuard (публичный, без профиля!)." -ForegroundColor Yellow
|
||
Write-Host " Для профиля на Win10 нужен AdGuard DNS Client или привязка IP (Linked IP) в панели — решить вручную." -ForegroundColor Yellow
|
||
}
|
||
|
||
Step "2. Браузеры: свой DoH выключен, SafeSearch принудительно"
|
||
foreach($k in 'HKLM:\SOFTWARE\Policies\Google\Chrome','HKLM:\SOFTWARE\Policies\Microsoft\Edge','HKLM:\SOFTWARE\Policies\YandexBrowser'){
|
||
RegSet $k 'DnsOverHttpsMode' 'off' 'String'
|
||
RegSet $k 'BuiltInDnsClientEnabled' 0
|
||
RegSet $k 'ForceGoogleSafeSearch' 1
|
||
RegSet $k 'ForceYouTubeRestrict' 1
|
||
}
|
||
RegSet 'HKLM:\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS' 'Enabled' 0
|
||
RegSet 'HKLM:\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS' 'Locked' 1
|
||
$opera = Get-ChildItem "$env:LOCALAPPDATA\Programs\Opera*","$env:APPDATA\Opera Software" -EA SilentlyContinue
|
||
if($opera){ Write-Host " ВНИМАНИЕ: найден Opera — политиками не управляется, встроенный VPN обходит фильтр. Удалить вручную." -ForegroundColor Yellow }
|
||
|
||
Step "3. hosts: веб-версии и загрузка Telegram/MAX"
|
||
$h = "$env:SystemRoot\System32\drivers\etc\hosts"
|
||
$cur = Get-Content $h -EA SilentlyContinue
|
||
$add = $BlockDomains | Where-Object { $d=$_; -not ($cur | Where-Object { $_ -match "\s$([regex]::Escape($d))(\s|$)" }) } | ForEach-Object { "0.0.0.0 $_ # sergey-filter" }
|
||
if($add){ Add-Content $h -Value $add -Encoding ASCII; Write-Host " добавлено $($add.Count) записей" } else { Write-Host " уже есть" }
|
||
ipconfig /flushdns | Out-Null
|
||
|
||
Step "4. Удаление Telegram и MAX"
|
||
Get-Process | Where-Object { $_.Name -match '^(Telegram|Max|Unigram)$' } | Stop-Process -Force -EA SilentlyContinue
|
||
$unins = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' -EA SilentlyContinue |
|
||
Where-Object { $_.DisplayName -match '^Telegram|^MAX\b|^Max\b|OneMe' }
|
||
foreach($u in $unins){
|
||
Write-Host " найдено: $($u.DisplayName) → $($u.UninstallString)"
|
||
$cmd = $u.QuietUninstallString; if(-not $cmd){ $cmd = $u.UninstallString }
|
||
if($cmd -match 'unins\d*\.exe'){ $cmd = "$cmd /VERYSILENT /NORESTART" }
|
||
elseif($cmd -match 'Update\.exe.*--uninstall'){ $cmd = "$cmd -s" }
|
||
elseif($cmd -match 'msiexec'){ $cmd = ($cmd -replace '/I','/X') + ' /qn /norestart' }
|
||
try { cmd /c "$cmd" | Out-Null; Write-Host " выполнено: $cmd" } catch { Write-Host " ошибка, удалить вручную: $cmd" -ForegroundColor Yellow }
|
||
}
|
||
if(-not $unins){ Write-Host " в списке программ не найдено" }
|
||
$appx = Get-AppxPackage -AllUsers | Where-Object { $_.Name -match 'Telegram|Unigram|\.MAX|OneMe' }
|
||
foreach($p in $appx){ Write-Host " Store-пакет: $($p.Name)"; Remove-AppxPackage -Package $p.PackageFullName -AllUsers -EA SilentlyContinue }
|
||
# Портативные остатки
|
||
foreach($d in "$env:APPDATA\Telegram Desktop","$env:LOCALAPPDATA\Programs\MAX","$env:LOCALAPPDATA\Programs\Max","$env:LOCALAPPDATA\Max","$env:LOCALAPPDATA\MAX"){
|
||
if(Test-Path $d){ Remove-Item $d -Recurse -Force -EA SilentlyContinue; Write-Host " удалена папка $d" } }
|
||
$left = Get-ChildItem "$env:USERPROFILE","$env:ProgramFiles","${env:ProgramFiles(x86)}" -Recurse -Include $BlockExe -EA SilentlyContinue -Depth 4 | Select-Object -Expand FullName
|
||
if($left){ Write-Host " ОСТАЛИСЬ exe (удалить вручную):" -ForegroundColor Yellow; $left | ForEach-Object { Write-Host " $_" } }
|
||
|
||
Step "5. Запрет запуска"
|
||
$dr = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
|
||
RegSet $dr 'DisallowRun' 1
|
||
if(-not (Test-Path "$dr\DisallowRun")){ New-Item "$dr\DisallowRun" -Force | Out-Null }
|
||
$i=1; foreach($e in $BlockExe){ New-ItemProperty "$dr\DisallowRun" -Name $i -Value $e -PropertyType String -Force | Out-Null; $i++ }
|
||
Write-Host " DisallowRun: $($BlockExe -join ', ')"
|
||
if($isPro){
|
||
$safer = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers'
|
||
RegSet $safer 'DefaultLevel' 262144 # Unrestricted
|
||
RegSet $safer 'TransparentEnabled' 1
|
||
RegSet $safer 'PolicyScope' 0
|
||
RegSet $safer 'AuthenticodeEnabled' 0
|
||
RegSet $safer 'ExecutableTypes' @('ADE','ADP','BAS','BAT','CHM','CMD','COM','CPL','CRT','EXE','HLP','HTA','INF','INS','ISP','LNK','MDB','MDE','MSC','MSI','MSP','MST','OCX','PCD','PIF','REG','SCR','SHS','URL','VB','WSC') 'MultiString'
|
||
foreach($e in $BlockExe){
|
||
$g = "{$([guid]::NewGuid().ToString())}"
|
||
$p = "$safer\0\Paths\$g"
|
||
RegSet $p 'ItemData' $e 'ExpandString'
|
||
RegSet $p 'SaferFlags' 0
|
||
RegSet $p 'Description' 'sergey-filter' 'String'
|
||
}
|
||
Write-Host " SRP (Disallowed по имени файла) добавлен — действует после перезагрузки/перелогина"
|
||
}
|
||
|
||
Step "6. Проверка"
|
||
if($build -ge 22000){ Get-DnsClientDohServerAddress | Format-Table -AutoSize | Out-String | Write-Host }
|
||
foreach($d in 'pornhub.com','t.me','web.max.ru','ya.ru'){
|
||
try { $r = Resolve-DnsName $d -Type A -EA Stop | Select-Object -First 1 -Expand IPAddress } catch { $r = 'NXDOMAIN/ошибка' }
|
||
Write-Host (" {0,-14} → {1}" -f $d, $r)
|
||
}
|
||
Write-Host "`nОжидание: pornhub/t.me/web.max.ru → 0.0.0.0 или пусто; ya.ru → реальный IP." -ForegroundColor Green
|
||
Write-Host "Дальше: перезагрузка, затем проверить в браузере и в режиме раздачи с телефона." -ForegroundColor Green
|