================================================================================
  SCAM-KIT  -  post-incident sweep for remote-access scams
  CoolTech Computers  -  Colin Clohesy
================================================================================

  WHAT IT DOES
  A read-only sweep of a Windows machine after an AnyDesk / TeamViewer /
  ScreenConnect style remote-access scam. 27 sections. It CHANGES NOTHING.
  It finds things and reports them; you decide what to remove.

  GENERIC - not written for any one customer. Run it on any Windows PC.

  CONTENTS
    Scam-Sweep.ps1                 the sweep (read-only, 27 sections)
    Run-Scam-Sweep.cmd             double-click - last 14 days
    Run-Scam-Sweep-DATED.cmd       double-click - asks for the incident date
    txt2pdf.py                     builds the printable PDF at the end
    make-printable.py              builds the 3 branded runbook PDFs

    ANYDESK-SCAM-SWEEP.pdf         the command runbook        <- PRINT
    SCAM-JOB-CHECKLIST.pdf         the tick-off checklist     <- PRINT
    SCAM-CONTACTS-FOR-CUSTOMER.pdf hand this to the customer  <- PRINT

    logo.png                       used on the PDF headers

  HOW TO RUN
    Double-click Run-Scam-Sweep-DATED.cmd
    -> type the date (2026-11-09)
    -> click Yes at the UAC prompt
    -> the PDF is built automatically at the end

    It writes a folder to the Desktop with REPORT-PRINTABLE.pdf inside it.

  WHAT IT COVERS (27 sections)
    Registry backup (rollback safety net), remote-access tools, autostart keys,
    startup folders, scheduled tasks, local accounts, services installed,
    files and executables in the window, hidden/drop locations, browser
    profiles and history, downloads, USB history, network shares, printers,
    Remote Desktop settings, FIREWALL RULES, recent documents, restore points,
    antivirus status, software installed, ONEDRIVE / CLOUD SYNC, deep registry
    autostart (Winlogon, IFEO, AppInit, BHO, COM, LSA), WMI persistence.

  SLOW SECTIONS ARE TIME-BOXED
    Section 6 walks the filesystem. Each folder has a time budget; if one hits
    its limit the scan stops and the report marks it PARTIAL. It never claims a
    folder was fully checked when it was not. Set $deepScan = $true in the
    script for a full walk (adds 5-10 minutes).

  REQUIREMENTS
    Windows. Admin rights (the .cmd files self-elevate).
    Python + fpdf2 for the PDF step. Without it the .txt files are still
    produced and the script says so.
        pip install fpdf2

  AUTHORISATION
    Only run this on a machine you have the owner's permission to examine.

================================================================================
