EmergentRI RESCUE (Windows) - for the person who cannot do the steps
=====================================================================
1. On a CLEAN computer: download the zip, right-click it, "Extract All..." onto a USB stick.
   (Running it from inside the zip does nothing - Windows only unpacks the one file you click.)
2. On the affected computer: cable OUT, Wi-Fi OFF. Plug in the stick, open the folder, double-click RESCUE.cmd.
   Say Yes to "allow this app to make changes". If Windows says "protected your PC": More info -> Run anyway.
3. Wait. It collects evidence (read-only), stops and blocks every known remote-control tool, removes them
   (archived first - nothing is deleted; accounts are disabled, never deleted), and leaves one small watch
   on the computer that stops them if they come back and writes EMERGENTRI-ALERT.txt on the Desktop.
4. It asks to restart. Restart. Then double-click RESCUE.cmd ONCE MORE: anything that came back is listed
   and stopped again - and that computer needs the clean install of Windows.
5. The results are on the stick: RESULTS_<date>.txt, the EVIDENCE folder, and CLEAN-OUT\archive\ (everything
   that was removed, kept). Upload the EVIDENCE folder at https://emergentri.com/security for the full report.
   If the Security Desk gave you a CLEAN-OUT-LIST.txt, put it next to RESCUE.cmd before running: then ONLY the
   items on that list are removed.

What it cannot do: the owner's accounts. Microsoft account, email, bank, credit freeze - those must be changed
from a CLEAN device, in that order; RESULTS tells you. And only a clean install of Windows is a guarantee.
Everything here is plain text - open any file in Notepad and read every line.
Remove the watch any time: Task Scheduler -> delete "EmergentRI Watch".
