itsimple.info Scam and RAT Scanner
itsimple.info Scam and RAT Scanner
A free, read-only triage scanner for Windows 10 and 11. It finds the footholds scammers and attackers leave behind, explains how they probably got in, and writes a report you can e-mail.
39652821FE1457BC60223652F1A1F1D155E4DA69400994F87F13912723187BFA
What it looks for
Built for the classic “tech support” and bank-scam call: someone talked the user into installing a remote control tool, and now you need to know what was left behind.
Remote access tools
AnyDesk, TeamViewer, ScreenConnect and 350+ others, including portable copies, session history, RDP and VNC.
Hidden persistence
Run keys, services, scheduled tasks (including hidden ones), WMI, Winlogon and IFEO.
Tunnels and connections
Listeners, SSH tunnels, port forwards, proxy, hosts file and DNS cache.
Security tampering
Defender, UAC and firewall changes, new admin accounts, Sticky Keys backdoor, WDigest.
Credential theft
ClickFix lures in Run and PowerShell history, stealer leftovers, password tools, malicious browser extensions.
Ransomware preparation
Ransom notes, mass-renamed files, deleted shadow copies and disabled recovery.
How to run it
- Extract the whole zip (right-click, Extract All). Running it from inside the zip does not work.
- Double-click
Start-Scanner.batand accept the UAC prompt. If you decline, it still runs as a limited scan and the report lists every source it could not read. - Pick Quick or Full, then press Start scan. Findings appear as each module finishes.
- Read the report. It is saved in the
reportsfolder asGenieScan_<PC>_<date-time>.htmland.json. The HTML is self-contained, so you can e-mail it or open it on another PC.
Quick scan
Full scan
Reading the results
Every finding shows its evidence and the rules that fired, so you can always see why it got its severity.
| Severity | Meaning |
|---|---|
| Critical | Strong sign of compromise or abuse: act on it. |
| Review | Unusual: check whether the customer knows about it. |
| Info | Inventory and context: normally nothing to do. |
Entry vector: how did it get there?
Critical and Review findings also show the most likely chain of how the item arrived on the PC.
| Confidence | Meaning |
|---|---|
| Confirmed | An unbroken chain, for example a download from a link in Gmail, then the file ran. |
| Likely | A strong hint, for example it appeared during an AnyDesk session. |
| Undetermined | No chain could be built. The report lists what could not be checked and why (log too short, auditing off, no download marker). |
Options
History 7 / 30 / 90 days
How far back event logs, installs, downloads and file dates are checked.
Watch mode (admin)
After the scan, watches for 10, 30 or 60 minutes for new processes, connections, tasks, services and Run values. Useful while the customer repeats what the scammer asked them to do.
Hash lookup
Off by default. Checks flagged file hashes and public IPs against online reputation services.
EN / עב
Switches the window and the report to Hebrew, right to left.
Privacy
Nothing leaves the PC except the rules feed download, unless Hash lookup is ticked. With it ticked, only SHA256 hashes of flagged non-Microsoft files and public IP addresses from network findings are sent. File contents, file names and user data are never sent.
- Without API keys, only CIRCL hashlookup is asked. It only says whether a file is known legitimate software.
- For malicious verdicts, copy
config\lookup.example.jsontoconfig\lookup.jsonand add your keys for MalwareBazaar, VirusTotal and/or AbuseIPDB. - A malicious verdict raises a finding to Critical. A lookup never lowers one.
Command line, RMM and remote use
Start-Scanner.bat passes its arguments through, and -NoGui runs without the window. Ideal for pushing from your RMM and collecting the report afterwards.
Start-Scanner.bat -NoGui -Profile Full -HistoryDays 90 -OutputPath C:\Temp\Genie| Parameter | Meaning |
|---|---|
-NoGui | Run without the window |
-Profile Quick|Full | Scan profile, default Quick |
-Modules M01,M04 | Only these modules |
-HistoryDays 7|30|90 | History window, default 30 |
-HashLookup | Enable online hash and IP lookup |
-Watch 10 | Watch mode for N minutes after the scan (admin) |
-OutputPath <folder> | Where to write the HTML and JSON |
-Offline | Use the verified rules cache only |
-Language en|he | Report language |
Exit codes
| Code | Meaning |
|---|---|
0 | No Critical or Review findings |
1 | Review findings only |
2 | At least one Critical finding |
3 | Scan refused: scanner files or rules failed verification |
4 | Error |
Modules
| Module | Quick | Full | |
|---|---|---|---|
| M01 | Remote access tools (354), sessions (AnyDesk, TeamViewer, ScreenConnect), RDP, VNC, VPN adapters | ✓ | ✓ |
| M02 | Persistence: Run keys, services, scheduled tasks (hidden-task check), WMI, Winlogon, IFEO and more | ✓ | ✓ |
| M03 | Running processes | ✓ | ✓ + loaded DLLs |
| M04 | Listeners, connections, SSH tunnels, port forwards | ✓ | ✓ + DNS cache, hosts, proxy |
| M05 | Defender, UAC, firewall, accounts, Sticky Keys backdoor, WDigest | ✓ | ✓ |
| M06 | Run and PowerShell history (ClickFix lures), stealer leftovers, password tools | ✓ | ✓ |
| M07 | Event history: services and tasks created, admins added, RDP logons, password guessing, logs cleared | ✓ | ✓ |
| M08 | Browser extensions, policies, notifications, downloads, root certificates | ✓ | |
| M09 | Suspicious files in Downloads, Desktop, Temp, AppData and ProgramData | ✓ | |
| M10 | Ransom notes, mass-renamed files, shadow copies, recovery settings | ✓ |
Troubleshooting
“Scan refused: scanner files failed verification”
“Scan refused: rules”
“Rules outdated” (orange)
My antivirus blocks the scanner
Get-FileHash .\GenieScanner-0.8.1.zip -Algorithm SHA256Where are the logs?
logs\GenieScan_<PC>_<time>.log in the scanner folder.Think a scammer was on the PC?
Run the scanner first. It takes a few minutes and changes nothing.
⬇ Download GenieScanner-0.8.1.zip Windows 10 / 11 · freeDisclaimer: the scanner is a triage tool and is provided as is. It does not replace antivirus software or a professional incident response.