Someone is in the computer. Here is exactly what to do.

For the person helping — a friend, a grandchild, a neighbour. Five steps, one thing each. You do not need to understand any of it; the stick does the work and tells you what it did.

Before you start: unplug the network cable and turn Wi-Fi off on the affected computer. Do not restart it yet. Use a different computer or a phone to read this page.
1

Download the Rescue onto a USB stick

On any computer: click the button, save the zip. Plug in a USB stick. Right-click the zip → Extract All… → choose the stick. A folder named EmergentRI-Rescue appears on the stick with the files inside it.

Download EmergentRI-Rescue.zipNever run anything from inside the zip — extract first.
2

Run it on the affected computer

Plug the stick into the affected computer (still offline). Open the stick, open the EmergentRI-Rescue folder, double-click RESCUE.cmd.

Windows asks "Do you want to allow this app to make changes?" → Yes. If a blue box says "Windows protected your PC" → click More info, then Run anyway. A second, blue window opens and does the work. It stays open and tells you everything it finds, stops, removes and watches. Leave it alone until it asks you something.

If a black box says "Smart App Control blocked a file that may be unsafe": that is a newer Windows setting that refuses any program not yet signed by a company Microsoft knows (ours is in progress). On a computer that is going to be reinstalled anyway, turn it off: Settings → Privacy & security → Windows Security → App & browser control → Smart App Control settings → Off, then double-click RESCUE.cmd again. (It is one-way until the reinstall, which turns it back on fresh.)

3

Answer its two questions

At the end it asks: Send the evidence to the Security Desk now? Plug the network cable back in (or turn Wi-Fi on) and type Y. Then an e-mail address for the report (or just press Enter), and whether we may keep the technical indicators to protect the next person. It shows a case code like EMR7Q3K2X9 and writes it to the Desktop as EMERGENTRI-CASE.txt. Write it down.

4

Restart, and run it once more

Restart the computer, then double-click RESCUE.cmd again. Anything that came back is listed and stopped again — and that machine needs a clean install of Windows; the stick says so in plain words.

5

Put the Guardian in the browser

So it does not happen again: open GUARDIAN-INSTALL.txt on the stick. Two clicks per browser (Edge and Chrome). From then on every download and every extension is looked at before it runs.

Guardian on its own

Your case

Type the case code from the stick. This page shows what the Desk has done and, when it is ready, the report, the removal list and the texts to send to the providers and the police. The same documents go to the e-mail you gave, if any.

This takes the intruder's door away today and watches for it. It is not a guarantee a machine someone else controlled is clean — only a clean install of Windows is. The accounts (Microsoft, bank, e-mail) are the owner's to change, from a clean device; the report says which and in what order.