Someone's in. Here's the order.

Two rules before anything else. (1) The affected computer is the attacker's until it is wiped — unplug it from the network and never type a new password on it. (2) Nobody legitimate — not Microsoft, not Amazon, not your bank — calls or pops up asking for remote access, gift cards, or a "rescue" download. That is the attacker, including when they come back.

The checklist

This is the canonical list. When you run the Security Desk on your own incident, you get this list tailored to your accounts, banks and dates — with boxes that tick and save, in a plain file that's yours.

A. The first hour — stop the bleeding

• Unplug the affected computer from the network (cable out, Wi-Fi off). Leave it off the network until it is wiped.
• From a CLEAN device (phone on cellular, a different computer): change the password of the account that was taken first (Microsoft / Google / Apple), then email, then bank. Never type a new password on the affected machine.
• In that account: sign out everywhere · remove unknown devices · delete app passwords · fix recovery email and phone (attackers add their own) · turn on MFA with an authenticator app · remove any profile photo or name they changed.
• Call the bank and card issuers: report fraud, dispute the charges, new card numbers; if the account number was exposed, a NEW account number.
• Freeze your credit at Equifax, Experian and TransUnion (free, online, ten minutes). Add ChexSystems if a bank account was opened in your name.

B. The first day — identity

• File at IdentityTheft.gov — it produces the affidavit and letters the bank, bureaus and police want.
• Police report (online is fine in most cities) and IC3.gov (FBI). Keep the report numbers.
• Pull all three credit reports at annualcreditreport.com; dispute every account you did not open.
• IRS: get an Identity Protection PIN (irs.gov/ippin) so nobody files a return in your name. Social Security: create/claim your my Social Security account (ssa.gov) so nobody else can.
• Phone carrier: set a port-out / account PIN (stops SIM-swap of your number). Check call forwarding on your phone.
• USPS Informed Delivery (so you see mail in your name); watch for mail you did not expect.
• Tell the people they might impersonate you to: family, your bank contact, your accountant.

C. Preserve, then rebuild the machine

• On the affected machine, OFFLINE: run the EmergentRI evidence collector from a USB stick; keep the folder.
• Copy personal files (documents, photos) to an external drive — files only, never programs. Do not plug that drive into a clean machine until the files have been scanned there.
• Make a Windows install USB on a CLEAN computer (Microsoft's Media Creation Tool), boot the affected machine from it (boot menu: usually F12 / F2 / Del / Esc at power-on), delete ALL partitions, install fresh. Not "Reset this PC" — a full clean install.
• First boot: updates, then Defender on, firewall on, no remote-access tools, a standard (non-admin) daily account, MFA on the Microsoft account used to sign in.
• Change the critical passwords AGAIN from the rebuilt machine (anything typed on the old one in the meantime is suspect). Use a password manager; different password everywhere.
• Phone: review installed apps, remove anything unknown; change the phone's own account password; turn off any mirroring/"link to PC" you did not set up yourself.

D. The first month — watch

• Check bank and card activity weekly; credit reports again in 30 days.
• Any "Microsoft / Amazon / your bank" call or pop-up asking for remote access or gift cards is the attacker coming back. Hang up. Nobody legitimate asks for TeamViewer or AnyDesk.
• Upload the collector folder to the Security Desk; keep the incident report and this checklist with your police report number.

The evidence collector

A single PowerShell script. Run it from a USB stick on the affected machine while it is off the network. It gathers what an intruder leaves behind — user accounts, services, scheduled tasks, startup entries, remote-access tools and their own connection logs, downloads with hashes, files pretending to be pictures, browser history, Windows event logs — into one folder on the stick. It reads; it never cleans, deletes or fixes. Then upload that folder to the Security Desk from a clean computer.

The easy way: download the collector (.zip), unzip it onto a USB stick, and double-click RUN-ME.cmd — it asks for Administrator (so the Security event log can be included) and does the steps above for you. If Windows says "protected your PC", click More info → Run anyway; the script is plain text you can open in Notepad. Prefer to read it first? Here's the script alone — about 90 lines of PowerShell. It is read-only: it changes nothing on the machine.

Can't do the steps? The Rescue stick does them.

For the person who shouldn't have to learn any of this. One zip, extracted onto a USB stick; on the affected computer, cable out, one double-click: it collects the evidence (read-only), stops and blocks every known remote-control tool, removes them (archived first; accounts disabled, never deleted), and leaves one small plain-text watch that stops them if they come back and writes an alert on the Desktop. Then it asks to restart, and you run it once more: anything that came back is the clean install talking.

Download the Rescue (Windows, .zip) — the collector, the clean-out and the watch in one. If the Desk gave you a CLEAN-OUT-LIST.txt, put it beside it and only those items are removed. Honest line: it takes the door away today and watches the door; the owner's accounts are theirs to change from a clean device, and only a clean install is a guarantee.

Then: the clean-out

The collector finds out who did what and where. The Desk reads it and writes a removal plan in plain words — every remote-control tool, the "antivirus" they sold you, the services, scheduled tasks, startup entries, firewall holes and extra accounts that keep them coming back — and the same list as a file the Clean-Out script reads. Put that list beside the script on the USB stick; it removes only what is on it. Double-click once for a report (nothing changes); read it; double-click the apply version. Everything is archived before it goes, loose programs are quarantined so they cannot run, extra accounts are disabled — never deleted. Restart, run the report again: anything that came back is the reinstall talking.

Download the Clean-Out (Windows, .zip) — plain PowerShell you can read in Notepad (the script alone). Without a list from the Desk it uses its built-in set of known remote-control tools and scam bundles. Honest line: cleanup is not a guarantee; it takes their door away today, and you still do the clean install.