v1.8.5 - single UAC prompt, property-safe inventory, review windows

Windows technician tool for investigating and cleaning up unauthorized remote-access software on client machines — typically after a tech-support scam, where the client was talked into letting someone remote in.

ScreenConnect cleanup: Once the technician approves removal of a detected ScreenConnect instance, the tool cleans up that instance and its associated services and startup/persistence entries.

Other services and startup items: Additional findings—such as AutoHotkey scripts, batch files, scheduled tasks and other running services—are not automatically removed as part of ScreenConnect cleanup. They are inventoried for the technician to investigate and decide what further action is appropriate.

Where to find the service inventory and use AI for review

For the guided START-HERE.bat runner, each run prints its fresh run folder, typically:

C:\RIT-SCC\<COMPUTERNAME>-<run-guid>\persistence\inventory.json

Example request to the AI:

Review this Windows service inventory for possible malware or unauthorized remote-access software. For each suspicious entry, explain the evidence, uncertainty and possible legitimate explanation; suggest non-destructive verification steps. Treat service names as clues, not proof. Do not recommend deleting or stopping a service solely from its name.

AI review is triage, not a malware determination. Verify flagged entries against the actual binary path, digital signature/publisher, file hash/reputation, antivirus results and the client's authorized software before taking action. Legitimate remote-access tools are not inherently malware.