v1.8.11 — Restore throttle and Malwarebytes waiting fixes

Fixes

• Continue cleanup when Windows throttles a new System Restore point and a readable existing point is less than 24 hours old. Logs remain SKIPPED (throttled), not Created. Missing, stale, unreadable, unknown-time or future-dated points and genuine creation failures still block cleanup.
• The official Malwarebytes.com download fallback now waits for technician confirmation: type DONE after installation, and again after the scan finishes and its window is closed. An installer/bootstrapper or GUI launcher exiting early can no longer automatically advance the pipeline.
• Keep attended scanner prompts visible and interactive in the direct runner. Winget installation behavior, registry-export safeguards and removal approval remain unchanged.

Verification

• Windows 2022 and Windows 2025 CI passed under Windows PowerShell 5.1 and PowerShell 7: https://github.com/pupontech/screenconnect-cleanup/actions/runs/39625152119
• This is the unchanged Windows 2025 CI-built ZIP from tested commit dc9917dbebda6ec96cb7a159bf2437094edac6c7 (PR #34 merge-test commit). ZIP inventory and source contents verified after download.
• Published as Latest at the owner's request for live testing. Actual Malwarebytes installation/scanning and System Restore behavior on the owner's machine remain to be tested.

SHA256 (screenconnect-cleanup-v1.8.11.zip):
c3e28cb1d3d0aa2d35dbf9163bb0e48fe82778129f5739d77ab37be7e505e1d3

v1.8.10 — System restore fix

System restore fix

v1.8.9 - launcher survives a path containing parentheses (TESTING)

TESTING ONLY - not production. v1.8.5 remains the approved latest release.

Fixes the reported failure: START-HERE.bat closed instantly, with no UAC prompt, when the extracted folder name contained parentheses (e.g. the 'name (1)' folder Windows Explorer creates on a second extract).

[1.8.9] - 2026-10-11

TESTING CANDIDATE - launcher fix for paths containing parentheses.

• START-HERE.bat now survives a folder name containing ( or ) - e.g.
  screenconnect-cleanup-v1.8.8 (1), which is what Windows Explorer creates
  when the same ZIP is extracted twice. cmd expands %~dp0/%~f0 at PARSE
  time, so the ( ) inside a ( ... ) block ended the block early and the
  batch aborted with no message and no UAC prompt: the window opened and closed
  instantly. Every path/argument expansion now happens once, before delayed
  expansion is enabled, and is referenced afterwards as !SCC_DP0! / !SCC_F0!
  / !SCC_ARG1! / !SCC_ARGS!, which cmd substitutes at run time (after
  parsing) and therefore cannot be broken by brackets in the path.
• New regression tests/ci/Test-LauncherPathWithParens.ps1: runs the real
  launcher from a paren-named directory and requires it to create its run root,
  with a negative control proving the old construct does abort from such a path.
  Wired into both CI editions.

Exact source: 76bbc7b557b78de02a39df05d40c7cf68566bb7f.

Windows CI (Server 2022 + 2025, PowerShell 5.1 and pwsh, including the extracted-ZIP fixtures) passed on both runners. The attached ZIP is the tested Windows 2022 CI artifact, published byte-identical - not rebuilt. relay/ and tests/ are not part of this bundle (server-side / dev only).

v1.8.8 - relay drain deadline, resume-trust regression (TESTING)

TESTING ONLY - not production. v1.8.5 remains the approved latest release.

Second review pass on the v1.8.7 merge. One real defect fixed and one coverage gap closed.

[1.8.8] - 2026-10-11

TESTING CANDIDATE - review follow-up on v1.8.7.

• relay/app.py: bound the early-rejection body drain with a total monotonic
  deadline instead of a per-read socket timeout. The per-read form let a client
  that trickled one byte per interval keep an unauthenticated handler thread
  (ThreadingHTTPServer spawns one per connection) alive indefinitely - a
  slowloris on the 401/404/415/411/413/400 paths. A handler now retires at the
  drain deadline regardless of how slowly the body arrives.
• Add tests/test_resume_materials_trust.ps1: the v1.8.7 resume-location ACL
  change had no automated coverage. It asserts a user-writable location is
  refused and a protected System32\\drivers location is accepted (the
  pre-merge check rejected that path), and it is wired into both CI editions.
• Relay regression test_reject_drain_is_bounded_against_a_trickling_client
  reproduces the slowloris (handler thread alive 13.5 s) and passes at ~5.5 s
  with the deadline in place.

Exact source: f01139219edeb39515549085722f9312064be70d.

Windows CI (Server 2022 + 2025, PowerShell 5.1 and pwsh, including the extracted-ZIP fixtures) passed on both runners. The attached ZIP is the tested Windows 2022 CI artifact, published byte-identical - not rebuilt. relay/ and tests/ are not part of this bundle (server-side / dev only).

v1.8.7 - audit fixes folded into v1.8.6 (TESTING)

TESTING ONLY - do not treat as production. v1.8.5 remains the approved
latest release. This candidate folds the fixes from an independent audit pass
(written against 1.7.55) into the v1.8.6 tree, keeping the post-AV persistence
subsystem and the v1.8.6 evidence/performance fixes.

[1.8.7] - 2026-10-11

TESTING CANDIDATE - audit fixes folded into v1.8.6.

• Move the -Debug unhandled-error trap to script level in sc-cleanup.ps1
  and preflight.ps1. A trap only covers the statement block it is written in,
  so the previous in-if trap caught nothing from the pipeline stages. Non-debug
  runs keep their original behavior (the trap rethrows; break).
• Quote Invoke-ChildScript arguments with Windows argv rules
  (ConvertTo-ProcessArgument): a value ending in a backslash is no longer read
  as an escaped closing quote, and empty-string arguments survive. The
  attended -Interactive child mode is unchanged.
• install-latest.ps1: keep the caller's PowerShell session intact under
  irm | iex (body wrapped in a scriptblock, no top-level exit), OR TLS 1.2
  into the existing protocols instead of replacing them (preserving TLS 1.3),
  and verify the GitHub release asset digest (sha256) when present.
• relay/app.py: answer early POST rejections through a draining _reject()
  (half-close + bounded body drain) so clients and the reverse proxy see the
  real 401/413 instead of a connection reset or 502; ignore
  ConnectionResetError on response writes.
• remove-screenconnect.ps1 Test-ResumeMaterialsTrusted: skip inherit-only
  ACEs, trust TrustedInstaller, and hold ancestors to a rename/replace mask so a
  genuinely protected resume location can be recognised. Fail-closed default
  behavior and the reboot-resume design (protected staging paths) are unchanged;
  that remains an owner decision.
• New regressions tests/test_audit_fixes.ps1 and
  tests/test_bootstrap_session.ps1, wired into both Windows PowerShell 5.1 and
  pwsh CI including the extracted-ZIP package run.

Exact source: ae25e89d4764925160aa9103dd1a26b86b83f705.

Windows CI (Server 2022 + 2025, PowerShell 5.1 and pwsh, including the
extracted-ZIP fixtures): the run for this commit passed on both runners.

The attached ZIP is the tested Windows 2022 CI artifact, published
byte-identical - not rebuilt. Reboot-resume design (protected staging paths)
remains an open owner decision and is not certified here.

v1.8.6 - TEST CANDIDATE - performance and evidence-safety fixes

Windows technician tool for investigating and cleaning up unauthorized remote-access software on client machines - typically after a tech-support scam, where the client was talked into letting someone remote in.

v1.8.6 - testing candidate

Approved v1.8.5 remains the latest stable release. This candidate contains six targeted changes from the code review:

• Faster persistence progress draining: the completed 600-line synthetic provider previously falsely timed out at 13.570 seconds; it now completes at 1.610 seconds locally. Idle backoff, heartbeats and both watchdog deadlines remain.
• Deduplicated script-inventory traversal: overlapping-root fixture directory reads 5 -> 2, hashes/records 8 -> 3. These are synthetic measurements, not a live Windows collection-speed claim.
• Review audit output refuses pre-existing/redirected files and creates records exclusively, preventing hard-link overwrite. Audit-write failures return nonzero.
• After-snapshot/diff failures no longer suppress the report; a separate failure artifact preserves INCOMPLETE status and existing evidence.
• AV-uninstall error text is HTML-escaped consistently.
• Single-section snapshot JSON preserves empty/single/multiple row arrays and the SRUM object shape.

Removal policy is unchanged. ScreenConnect removal remains technician-approved; unrelated services and startup items are not automatically removed as part of ScreenConnect cleanup.

Verification

Windows Server 2022 and 2025, PowerShell 5.1 and pwsh, including tests against the extracted ZIP: https://github.com/pupontech/screenconnect-cleanup/actions/runs/38132081776

45 local check commands exited zero (native Windows-only skips explicit); independent scoped source review found no introduced High/Medium defects. Published asset is the verified Windows 2022 CI artifact, not a rebuild.

Source: 3e644599a95316b83e9a986ae5ea5b9a2cf858de
ZIP SHA-256: 2b9a48ce760a2c356750792114daae23e0f5b4ecfb011788bc621ea2db296b73

Remaining review finding

The existing SYSTEM logon resume task has no bounded retry/expiry policy on failed post-reboot verification. It can remain registered across logons. That lifecycle was not silently changed in this optimization patch; it needs a separate policy decision and Windows tests. This candidate is not certification of reboot-resume or unrestricted production readiness.

Full review, source-line evidence, regression tests and further optimization opportunities: docs/13-legacy-code-review.md in the ZIP, or https://github.com/pupontech/screenconnect-cleanup/blob/3e644599a95316b83e9a986ae5ea5b9a2cf858de/docs/13-legacy-code-review.md

Extract into a fresh folder for owner testing. No agents ran live scanners, installers, collector providers, removal or reboot; owner live acceptance remains required.

v1.8.5 - single UAC prompt, property-safe inventory, review windows

Windows technician tool for investigating and cleaning up unauthorized remote-access software on client machines — typically after a tech-support scam, where the client was talked into letting someone remote in.

ScreenConnect cleanup: Once the technician approves removal of a detected ScreenConnect instance, the tool cleans up that instance and its associated services and startup/persistence entries.

Other services and startup items: Additional findings—such as AutoHotkey scripts, batch files, scheduled tasks and other running services—are not automatically removed as part of ScreenConnect cleanup. They are inventoried for the technician to investigate and decide what further action is appropriate.

Where to find the service inventory and use AI for review

For the guided START-HERE.bat runner, each run prints its fresh run folder, typically:

C:\RIT-SCC\<COMPUTERNAME>-<run-guid>\persistence\inventory.json

Example request to the AI:

Review this Windows service inventory for possible malware or unauthorized remote-access software. For each suspicious entry, explain the evidence, uncertainty and possible legitimate explanation; suggest non-destructive verification steps. Treat service names as clues, not proof. Do not recommend deleting or stopping a service solely from its name.

AI review is triage, not a malware determination. Verify flagged entries against the actual binary path, digital signature/publisher, file hash/reputation, antivirus results and the client's authorized software before taking action. Legitimate remote-access tools are not inherently malware.

v1.8.2 - TESTING ONLY - Step 6d progress and hard deadlines

v1.8.2 — Step 6d progress and hard deadlines (TESTING ONLY)

TESTING ONLY - persistence collection progress and hard deadlines.

• Fixed the silent unbounded wait at guided Step 6d: read-only inventory now
  runs in an isolated worker with a 60-second per-section deadline and a
  300-second overall deadline. The exact provider that stalled the owner's
  prior run is not established; new section/heartbeat output identifies it.
• Added live section progress, periodic still-collecting messages and a local
  persistence/collection-progress.log. A stalled worker is terminated;
  persistence collection stops as Incomplete, removal is disabled, and the
  normal report path can continue with a nonzero outcome and the last section.
• Approval/removal remains in the visible attended parent, never the worker.
  Deadlines do not approve cleanup, suppress gaps or create a clean verdict.
• Added harmless blocked-provider, total-budget, success and worker-failure
  fixtures; no live Windows collection, scanner or removal was run by agents.
• Includes the v1.8.1 battery-check console visibility fix unchanged.

Owner-reported symptom and root cause

The run sat forever at STEP 6d/9: Persistence inventory and review. The old
code collected synchronously with no output and no time bound, so a stalled
Windows provider produced a silent, indefinite wait. The exact provider that
stalled your machine is still not established — the new section output and
persistence/collection-progress.log are there to name it on your next run.

What this build changes

Before	After
Silent, unbounded wait	Live [Persistence] Collecting <section> ... plus still-collecting heartbeats
No time limit	60s per section, 300s total; the stalled worker is terminated
Nothing to inspect afterwards	persistence/collection-progress.log (capped at 1 MB, truncation marked)
Ambiguous state after a hang	Collection is Incomplete, persistence removal disabled, report still produced with a nonzero outcome

Approval is unchanged: the visible attended console still owns removal review,
and no deadline can approve cleanup or turn incomplete evidence into a clean
verdict. This aborts the remaining collection rather than claiming those sources
were inspected.

Verification

• Exact source: 6eaed827b0d2d659d026f380fc76987a3e580931
• Windows CI (Server 2022 + 2025, PowerShell 5.1 + 7, including the extracted ZIP):
  https://github.com/pupontech/screenconnect-cleanup/actions/runs/37776056082 — green on Windows Server 2022 and 2025 under PowerShell 5.1 and 7, including the same fixtures run from the extracted ZIP.
• Harmless fixtures prove: a stalled provider times out; progress is observed
  while the run executes; the worker is terminated and not orphaned; a
  provider error propagates the real worker exit code; the total budget cannot be
  bypassed by repeated progress markers; a missing worker still fails closed; a
  leftover progress log is refused with the fresh-run requirement.
• Independent review by two GLM-5.3 lanes: PASS on bounded-collection
  correctness and on test/packaging validity. Their findings were fixed before
  this build (unresolvable-worker exit code, log-cap marker, fresh-run refusal,
  fixture timing margin, PID-identity-checked cleanup, live streaming proof).
• Full local matrix: 33/33.
• A real Windows sharing defect that CI caught is fixed: the progress log is opened FileShare.ReadWrite so it can be tailed while the run writes, and the fixture now reads it during the run — which is exactly why the local suite could not see it.
• ZIP: 46 members, exact per-member hash manifest, version and full source SHA verified; this download preserves the tested Windows 2022 artifact bytes.
• SHA-256: 4f1ed3ad93659ecfeb0bd00e469f7739beed91ddc92a88ebe8295d3306504e6b

Before you retry

Verify the checksum and extract this NEW ZIP into a fresh folder — a reused run
directory is refused by design. The agents ran no live scanner, installer or
removal; your live acceptance of collection coverage, approval UX and rollback
restoration is still required.

If Step 6d ever appears stuck again, it will now name the section and stop on its
own; send me the last [Persistence] lines and collection-progress.log.

v1.8.1 - TESTING ONLY - Visible attended launcher fix

v1.8.1 — visible attended launcher (TESTING ONLY)

TESTING ONLY - attended console visibility fix. Owner live acceptance remains required.

• Removed -WindowStyle Hidden from the foreground battery-check invocation:
  it shares the elevated runner console and could hide that whole window while
  the run continued at an unseen approval prompt. The separately started
  keep-awake helper remains hidden. Battery confirmation and cancel behavior
  are otherwise unchanged.
• Added a harmless native Windows console-visibility regression with the old
  Hidden flag as a negative control, plus continue/cancel stub paths. CI runs
  it under PowerShell 5.1 and 7 and repeats it against the extracted ZIP.
• Do not resume old hidden cleanup sessions blindly. Before retrying, close
  only the identified old ScreenConnect cleanup/stub runs, or reboot after
  saving work. Do not terminate unrelated cmd.exe processes.
• Post-AV persistence and its separate typed approval are unchanged. The
  agents do not run the real cleanup; actual UAC consent and battery dialog
  acceptance remain owner-live tests.

Verified Windows result

The harmless native fixture confirmed the reported failure and this fix:

Case	Before	After	Exit
Old foreground Hidden flag (negative control)	Visible	Hidden	0
Fixed foreground invocation, continue	Visible	Visible	0
Fixed foreground invocation, cancel	Visible	Visible	1; no continuation

Both Windows Server 2022 and 2025 passed under PowerShell 5.1 and 7, and the tests were repeated against the extracted ZIP. The actual native window state was measured with GetConsoleWindow/IsWindowVisible; these are not just source-marker assertions. The old control restores its window before exiting.

• Source: 87e5d60c9332dbef89c0ca92a343d704bf961a21
• Exact-source CI: https://github.com/pupontech/screenconnect-cleanup/actions/runs/37765531802
• PR CI also passed: https://github.com/pupontech/screenconnect-cleanup/actions/runs/37765536404
• Full local matrix: 32/32 commands passed; the new regression failed before the fix and passed afterward.
• ZIP is the tested Windows 2022 CI artifact, copied without rebuilding; 45-member manifest, version and full SHA verified.
• SHA-256: a781c8680bea8278243e68b4049624ac6114182089dc83c68278c319073eec8b

Before retrying

Save your work and reboot, or close only positively identified old ScreenConnect cleanup/stub sessions. Do not bulk-end cmd.exe or PowerShell processes. This release cannot close the owner machine's elevated hidden runs remotely.

Verify the checksum, extract this NEW ZIP into a fresh folder, then run START-HERE.bat. Do not use a previously downloaded v1.8.0 ZIP. Do not approve Step 5 removal if the detected ScreenConnect client is your own required remote-access client.

The agents ran no real cleanup, scanner, installation or live malicious sample. Actual UAC consent and the battery dialog on an unplugged owner machine remain untested by CI; full live collection/removal/rollback acceptance also remains pending. Mandatory post-AV persistence and the separate typed REMOVE gate are unchanged.

v1.8.0 - TESTING ONLY - Post-AV persistence investigation

v1.8.0 — post-AV persistence investigation (TESTING ONLY)

TESTING ONLY - post-AV persistence prototype. Owner live Windows acceptance is required.

• Added a mandatory persistence investigation after AV scans in both runners,
  including when scanners are declined, unavailable or skipped with -sa.
  The no-execution -WhatIf preview remains an explicit exception.
• Added local evidence collection for tasks/task XML/hidden-task discrepancies,
  registry autoruns, loaded user hives, startup folders, services, WMI, script
  file hashes, process/network context, Defender, accounts and logon/RDP context.
  Collection gaps and bounded/truncated evidence remain explicit and incomplete.
• Added separate selection and typed REMOVE approval for suspicious scheduled
  tasks, Run/RunOnce values and startup files, with rollback prerequisites,
  per-item backup, fresh target revalidation and post-action verification.
  -sr suppresses cleanup only; -ExecuteRemoval cannot approve this new scope.
• Added persistence status, findings, coverage errors and removal outcomes to
  the HTML report, plus aggregate-only sanitized share metadata. Raw evidence,
  commands, paths, task XML, scripts and histories are not added to sharing.
• Services/WMI/hidden-task artifacts/Winlogon remain review-only. Original
  offline user hives, raw script samples and PowerShell history are not collected.
• Added fixture/refusal/report/privacy/workflow tests to the Windows 2022/2025
  PowerShell 5.1 and pwsh matrix; package parsing now includes PowerShell modules.
• This is the existing guided cleanup tool, not a full-cleanup WPF GUI release.
  No live detector, scanner, installation or destructive Windows cleanup was
  performed by the agents; live selection, UAC and rollback acceptance are pending.

Verification and provenance

• Source commit: b731c5e42ada4df71f0099fef06de00869e32ee7 on feat/post-av-persistence. This release does not merge or replace the separate WPF GUI work.
• Hosted Windows CI: https://github.com/pupontech/screenconnect-cleanup/actions/runs/37760866006 — Windows Server 2022 and 2025, PowerShell 5.1 and 7, including native link-count fixtures, batch success/failure replay, and extracted-ZIP fixture execution.
• Local gate matrix: 32 commands passed; independent Luna source-security/spec/standards reviews had no unresolved release blocker.
• The release ZIP is the tested Windows 2022 artifact, copied without rebuilding. Both runner ZIPs passed integrity, exact 45-member hash manifest, full source SHA, version, ASCII/no-BOM and CRLF checks.
• SHA-256: 2d768cfe9b57a398d513c52159f0e721ad3b1620759e03ab00abe22233582b0e

Test it

1. Verify the .sha256 sidecar and extract the entire ZIP into a new folder.
2. Read DEPLOY.md and docs/12-post-av-persistence.md; then launch START-HERE.bat on an authorized disposable Windows test machine. This attended legacy runner uses elevation, not the standard-user DetectOnly GUI.
3. Decline every AV scanner and confirm Step 6d still runs; check report.html for persistence status, coverage gaps, candidate reasons and cleanup outcomes.
4. Test only harmless lab entries. Declining approval must leave them intact; selected cleanup requires typed REMOVE, current-run rollback prerequisites, backup and target revalidation.

-sa skips AV, not persistence. -sr disables persistence cleanup, not collection. -WhatIf, an aborted preflight, or a terminated process does not run the collector. A heuristic match is not a malware verdict; incomplete evidence is never clean.

Remaining acceptance limits

Owner live collection coverage, interactive approval/UAC behavior, actual task/registry/startup mutation, backup usefulness and quarantine restoration remain pending. Agents ran fixtures only: no live AV scanner, live cleanup, installation or malicious sample. Services/WMI/hidden tasks/Microsoft-folder tasks/Winlogon remain review-only; offline hive loading, shell history and script samples are intentionally omitted. Raw persistence evidence stays local and may contain sensitive commands, users and IPs; sanitized sharing adds aggregate metadata only.

Direct mirror: https://screenconnect.aygross.xyz/#screenconnect-cleanup-latest