EmergentRI Security Desk - CLEAN-OUT (Windows)
==============================================
The removal half. The Evidence Collector finds out who did what and where; this removes what they left.

0. EXTRACT the zip first (right-click -> Extract All...) - it cannot run from inside the zip.
1. Run the Evidence Collector first (the other zip) and upload the EVIDENCE folder at
   https://emergentri.com/security. The Security Desk reads it and writes:
     INCIDENT-REPORT.md   - the timeline: who, what, when, from where
     REMOVAL-PLAN.md      - in plain words, what has to go and why, and how to do each one by hand
     CLEAN-OUT-LIST.txt   - the same, as a list this script reads
2. Put CLEAN-OUT-LIST.txt next to this file on the USB stick (download it from the Desk).
   With the list, ONLY what is on it is removed. Without a list, the script uses its built-in set
   of known remote-control tools and scam bundles (TeamViewer, AnyDesk, Supremo, LogMeIn Rescue,
   UltraViewer, RustDesk, Splashtop, ScreenConnect, Wave Browser, TotalAV, ...).
3. Computer OFF the network. Double-click CLEAN-OUT.cmd -> REPORT ONLY. Read CLEAN-OUT\CLEAN-OUT-PLAN_*.txt.
4. If it looks right, double-click CLEAN-OUT-APPLY.cmd. Everything is archived to CLEAN-OUT\archive\<time>\
   before it is removed: registry exported, tasks saved as XML, service definitions saved, loose
   programs moved to quarantine with ".quarantined" added (they cannot run), extra admin accounts
   DISABLED (never deleted). If something was yours, it can be put back.
5. Restart. Run CLEAN-OUT.cmd again. Anything that came back is persistence the script could not see:
   that machine needs the full reinstall now.

Options (right-click clean-out.ps1 > Run with PowerShell, or from a prompt):
   -KeepUsers name1,name2   accounts that are yours (the signed-in user is always kept)
   -DisableRdp              turn Remote Desktop off too
   -ResetHosts              restore the default hosts file (old one archived)

Honest line: this is cleanup, not a guarantee. A machine someone else controlled is only certainly
clean after a full reinstall of Windows. Do this first so they lose their door today; still reinstall.
The script is plain text - open clean-out.ps1 in Notepad and read every line.
