﻿================================================================================
  SCAM SWEEP KIT  -  VERSION 3
  CoolTech Computers  -  Colin Clohesy
  Built 12 November 2026
================================================================================

  WHY THERE IS A V3
    V2 was published with the right ideas and four ways to mislead:

    1. IT MISSED A WHOLE DRIVE.
       On a real job the customer's Downloads and Documents had been MOVED to D:.
       V2 looked only under C:\Users\<name>, found no Downloads folder there and
       skipped it SILENTLY. The fake-bank download, two AnyDesk installers and a
       .zip from the scam site were never examined. V3 lists every local/USB drive,
       reads where each user's folders REALLY are, scans the drives you choose, and
       says "SKIPPED BY TECHNICIAN", "PARTIAL" or "NOT EXAMINED" - never "clean".

    2. IT SAID "NO FINDINGS" WHEN MOST CHECKS NEVER FED THE FINDINGS.
       About a dozen conditions could ever produce a finding, and failed checks
       printed "none / good / clean". V3 wraps every check in a ledger; the first
       thing in FINDINGS.txt and REPORT.txt is the list of checks that failed, were
       skipped or were partial, and "no findings" is worded accordingly.

    3. ITS DATES WERE AMBIGUOUS. Interpolated dates print month-first, so
       "11/10/2026" meant 10 November. V3 prints every date as 10 Nov 2026 14:30,
       shows the time zone and the machine's clock, and ends the window at 23:59:59
       (V2 stopped at 23:00).

    4. IT READ THE WRONG PERSON'S PROFILE. It used the elevated account's
       folders and registry as "the customer". V3 enumerates every profile, says
       who the console user is and who the sweep is running as, and reads each
       profile's registry (live, or from a temporary COPY of NTUSER.DAT).

  WHAT ELSE CHANGED
    * BROWSER EVIDENCE WITHOUT PYTHON: typed addresses, forms submitted, the
      Downloads table and extensions, with times, read from copies of the history
      databases through Windows' own SQLite (in memory - nothing compiled to disk,
      because antivirus deleted V2-era helper DLLs). A real case turned on
      exactly this.
    * Evidence V2 never read: AnyDesk session traces, Prefetch, BAM, UserAssist,
      the Windows Firewall event log (shows rules that were deleted before the
      sweep), Defender events and exclusions, MSI events, Security/RDP logons,
      Zone.Identifier download origins, the Recycle Bin ($I deletion times, every
      drive and user), shadow copies and restore points.
    * TRIAGE: Tier 1 look first / Tier 2 worth a look / Tier 3 routine (collapsed,
      never hidden), judged by a verifiable signature and an editable KnownGood.psd1.
      Every item says who it BELONGS TO and how that is known; a company name inside
      a file is only a claim, shown beside what the signature proves.
    * NO PYTHON. The printable PDF is built by a small pure-PowerShell writer. The
      kit is a few hundred KB, not 26 MB.
    * REMOVER REWRITTEN. It reads typed actions from actions.json - never command
      text - validates every field, exports evidence (event logs, a RESTORABLE
      firewall export, accounts, traces, Recycle Bin metadata) with SHA-256 hashes
      BEFORE any change, and reports APPLIED only when the change worked and checked.
    * Reports go to C:\ScamSweep\<date-time>\, never onto the technician's stick or a
      OneDrive-synced Desktop.
    * Elevated launchers (1-RUN-SWEEP.cmd ...), which confirm the date and window.
    * Network-Drive-Check: saved mappings are labelled correctly and de-duplicated.
    * 4-RECOVER-DELETED.cmd: optional Windows File Recovery helper.

  STILL NOT COVERED (candidates for V4)
    NTFS USN journal (deleted-file names across a whole volume), driver inventory,
    other users' loaded registry beyond HKLM/HKU, BitLocker/Secure Boot tampering,
    .lnk payload inspection, a live-memory view.

================================================================================
  KIT VERSION: V3
  If you report a problem, quote this version.
================================================================================

================================================================================
  V3 changes  -  13 November 2026
================================================================================
    * Reports now go in <kit folder>\<COMPUTER NAME>\<date-time>\, next to the
      launcher the technician clicked (falls back to C:\ScamSweep if the kit
      folder is read-only). The folder and FINDINGS.txt open when the sweep ends.
      The remover and recovery tool look in both places for the newest report.
      The report holds customer data: remove it from the stick when finished.
    * Start question is now a menu: last 14 / 7 / 4 days, a specific day with
      "days either side" (0 = that day only), or Exit.
    * Moving marker + elapsed time on every check, and on the winget install.
    * Console takes keyboard focus on start. Launchers fixed (empty-argument bug).
    * Windows File Recovery counts as ready when installed even if its help text
      cannot be captured while running elevated.
