Add a whole-system Windows machine check to malware-scan

[pokhiii]

Why

The local sweep (scan_all.sh) needs Python and bash, so it doesn't help when the machine to check runs Windows and belongs to someone who doesn't use developer tools. This adds a check they can run by pasting one line into PowerShell. It writes a plain-text report for whoever asked them to run it.

What's added

malware-scan/windows/:

File	What it is
ColoredCow-Laptop-Check.ps1	Read-only scanner for Windows PowerShell 5.1 (built into Windows 10/11). Nothing to install.
ColoredCow-Laptop-Check.data.txt	Every indicator and rule, loaded at runtime.
README.md	Guide for whoever sends it: the step-by-step messages, what the person will see, how to read the report, what to do if it finds something.

Also a new section 4. Windows machine check in malware-scan/README.md, and an updated Security row in the root README.md.

The check reads every file on every internal/USB drive, including C:\Windows, AppData, node_modules, .git and zip/vsix contents. It also covers:

• every git branch, tag and stash tip, plus the reflog
• running processes and live network connections
• the DNS cache
• persistence: Run keys, services, scheduled tasks, WMI
• VS Code/Claude auto-run files and known-bad packages
• Defender history, and where credentials and .env files sit on disk (locations only)

It never changes anything, never runs project code and never sends data anywhere. A COVERAGE section names everything it couldn't read.

Testing

• Run end to end on Windows 11 with Windows PowerShell 5.1, as administrator. A full run over close to a million files takes most of a day.
• Re-run against infected and clean fixtures with PowerShell 7.6: no parse errors, no PowerShell-7-only syntax, every planted indicator caught, clean files not flagged, and the scanner's own files not flagged.

Design notes for review

• Indicators live outside the script. Defender's script scanner (AMSI) blocks a script containing the malware's signature strings (ScriptContainedMaliciousContent). The report refers to indicators by ID (S01…) so the report doesn't get quarantined either.

• The data file is JSON named .txt on purpose. With a .json name, scan_malicious.py --path malware-scan reports 8 HIGH findings, so every clone of this repo would show up as infected in the local sweep. It now reports 0. The new README contains no indicator strings.

• Distribution is a secret gist of the two files. This repo's own Download ZIP would bring the other scanners and READMEs, which quote the indicators on purpose and would show as false hits.

• Known limits:

  • A full run takes many hours.
  • The git step shows no progress inside a large repo.
  • Locked files print harmless red Get-AuthenticodeSignature errors.
  • The on-screen text says "green bar", though the bar is blue in Windows PowerShell.

  They can be addressed in a follow-up.

🤖 Generated with Claude Code