﻿================================================================================
  SCAM SWEEP KIT  -  VERSION 3
  CoolTech Computers  -  Colin Clohesy
================================================================================

  WHAT IT IS
    A read-only sweep of a Windows PC after a remote-access scam (AnyDesk,
    TeamViewer, ScreenConnect and friends). It reconstructs what the PC recorded
    inside a time window, sorts the results so the important ones come first, and
    says plainly what it could NOT check. It is NOT an antivirus and a clean
    result is NOT an all-clear - nothing on a PC can prove what a person watching
    the screen saw or took.

  HOW TO RUN IT  (four steps, no install)
    1. EXTRACT THE ZIP FIRST. Do not run anything from inside the zip.
       Put the kit folder on a USB stick (or any folder - spaces, apostrophes and
       any drive letter are fine). It runs IN PLACE from the stick.
    2. Double-click   1-RUN-SWEEP.cmd   on the customer's PC. Click Yes at the
       Windows permission prompt. Type the incident date as DAY-MONTH-YEAR
       (05-03-2026 for 5 March 2026) and confirm the window it shows you.
    3. Answer the drive questions (one keypress each: Y, N, A = all, 0 = none).
       Then leave it - the rest runs unattended.
    4. Read  FINDINGS.txt  first, print  REPORT-PRINTABLE.pdf, and copy the
       report folder off the PC (it holds customer data).

  WHERE THINGS GO
    Nothing is written to the stick. The report, evidence and temporary files go
    to  <kit folder>\<COMPUTER NAME>\<date-time>  (opens when the sweep ends)\  (or the folder you give with -OutDir).
    THAT FOLDER HOLDS CUSTOMER DATA. Copy it off deliberately, then decide whether
    to delete it from the PC.

  THE LAUNCHERS
    1-RUN-SWEEP.cmd           the sweep (discovery only)
    2-RUN-REMOVER.cmd         the ONLY thing that changes anything - per item,
                              evidence exported first. Add  -WhatIf  to preview.
    3-RUN-NETWORK-CHECK.cmd   mapped drives / file servers (asks before scanning)
    4-RECOVER-DELETED.cmd     OPTIONAL: try to get deleted AnyDesk logs/installers
                              back with Microsoft's Windows File Recovery

  READING THE REPORT
    FINDINGS.txt   one screen first: checks that could not run, then the TRIAGE
                   (Tier 1 look first / Tier 2 worth a look / Tier 3 routine),
                   then each finding with its evidence.
    REPORT.txt     everything, in order, with the same triage summary at the top.
    Every item shows who it BELONGS TO and how that is known. A program's own
    "company name" is only a CLAIM; it is shown beside what the digital signature
    actually proves. A file that claims to be Microsoft/Google/etc. but is not
    signed by them is Tier 1.
    KnownGood.psd1 is YOUR list of routine publishers/folders/domains - edit it.

  IF THE ANTIVIRUS GETS IN THE WAY
    * V3 compiles nothing to disk, because V2-era helpers that did were deleted
      by Trend Micro (generic machine-learning detection of random-named DLLs).
    * If something still blocks a helper, the report says so in the list of
      checks that could not run - e.g. "Browser history reader blocked or
      unavailable ... antivirus may have removed the helper" - and the browser
      section says BROWSER EVIDENCE WAS NOT READ. That is NOT "no browser
      evidence". Re-run, or read the copied database another way.
    * If the stick is read-only, or the antivirus quarantines the kit's scripts,
      the launcher offers (one Y/N) to copy the kit to  C:\ScamKit  and run from
      there. DELETE C:\ScamKit afterwards.
    * The recovery helper installs only Microsoft packages, checks their digital
      signature, and logs everything. Mention in your job notes that those tools
      were added after the incident, so nobody mistakes them for the scammer's.

  SWITCHES (advanced - 1-RUN-SWEEP.cmd passes them straight through)
    -IncidentDate 05-03-2026   -DaysBack 14   -Drives "D:,E:"   -AllDrives
    -NoDrivePrompt   -OutDir <folder>   -DeepScan   -ShowAll   -FullPdf   -NoPdf

  FILES
    Scam-Sweep.ps1, Remove-ScamFindings.ps1, Network-Drive-Check.ps1,
    Recover-Deleted.ps1, KnownGood.psd1, Lib\ (the engine), Tests\ (validator
    tests), logo.png, RUNBOOK / SCAM-JOB-CHECKLIST / SCAM-CONTACTS-FOR-CUSTOMER
    (.txt and .pdf), VERSION.txt, LESSONS.txt, BUILD-NOTES.md.

  AUTHORISATION
    Only run this on a machine you have the owner's permission to examine.
================================================================================
