{"id":3255,"date":"2026-11-05T15:51:33","date_gmt":"2026-11-05T13:51:33","guid":{"rendered":"https:\/\/itsimple.info\/?p=3255"},"modified":"2026-11-05T15:52:06","modified_gmt":"2026-11-05T13:52:06","slug":"rat-scanner-for-finding-bed-tools","status":"publish","type":"post","link":"https:\/\/itsimple.info\/?p=3255","title":{"rendered":"itsimple.info Scam and RAT Scanner"},"content":{"rendered":"\n\n<!--\n  ITsimple.info RAT Scanner \u2013 WordPress page for itsimple.info\n  HOW TO USE:\n  1. Pages > Add New > title \"Genie Scam and RAT Scanner\"\n  2. Top-right \u22ee menu > Code editor (Ctrl+Shift+Alt+M) > paste this whole file > Exit code editor\n     (or add a single \"Custom HTML\" block and paste everything between the wp:html comments)\n  3. Replace the two placeholders below:\n       DOWNLOAD_URL  -> the media-library URL of GenieScanner-0.8.1.zip\n       SHA256_HASH   -> output of: Get-FileHash .\\GenieScanner-0.8.1.zip -Algorithm SHA256\n-->\n<style>\n.gs-page{--gs-navy:#0f2742;--gs-blue:#1f6feb;--gs-red:#c62828;--gs-orange:#e67e22;--gs-green:#2e7d32;--gs-grey:#5b6573;--gs-line:#e3e8ef;--gs-soft:#f5f8fc;\n  font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Roboto,Arial,sans-serif;color:#1d2733;line-height:1.6;max-width:1040px;margin:0 auto;font-size:16px}\n.gs-page *{box-sizing:border-box}\n.gs-page h2{font-size:1.6rem;color:var(--gs-navy);margin:2.6rem 0 .8rem;padding-bottom:.4rem;border-bottom:3px solid var(--gs-blue);display:inline-block}\n.gs-page h3{font-size:1.15rem;color:var(--gs-navy);margin:1.4rem 0 .5rem}\n.gs-page p{margin:.5rem 0 1rem}\n.gs-page code{background:#eef2f7;padding:.1em .4em;border-radius:4px;font-family:Consolas,\"Courier New\",monospace;font-size:.9em;word-break:break-word}\n.gs-page pre{background:#0d1b2a;color:#e6edf3;padding:1rem 1.2rem;border-radius:8px;overflow-x:auto;font-family:Consolas,\"Courier New\",monospace;font-size:.88rem;line-height:1.5;margin:.6rem 0 1.2rem}\n.gs-page pre code{background:none;padding:0;color:inherit}\n\n\/* hero *\/\n.gs-hero{background:linear-gradient(135deg,#0f2742 0%,#163d6b 60%,#1f6feb 100%);color:#fff;border-radius:14px;padding:2.6rem 2rem;margin-bottom:1.5rem;position:relative;overflow:hidden}\n.gs-hero:after{content:\"\";position:absolute;right:-60px;top:-60px;width:260px;height:260px;border-radius:50%;background:rgba(255,255,255,.06)}\n.gs-hero h1{color:#fff;font-size:2.2rem;line-height:1.2;margin:0 0 .6rem}\n.gs-hero p.gs-lead{font-size:1.15rem;opacity:.93;max-width:720px;margin:0 0 1.4rem}\n.gs-badges{display:flex;flex-wrap:wrap;gap:.5rem;margin-bottom:1.6rem}\n.gs-badge{background:rgba(255,255,255,.14);border:1px solid rgba(255,255,255,.25);padding:.25rem .7rem;border-radius:999px;font-size:.85rem}\n.gs-btn{display:inline-block;background:#fff;color:var(--gs-navy)!important;font-weight:700;padding:.85rem 1.6rem;border-radius:8px;text-decoration:none!important;font-size:1.05rem;box-shadow:0 4px 14px rgba(0,0,0,.2);transition:transform .15s}\n.gs-btn:hover{transform:translateY(-2px)}\n.gs-btn-sub{display:block;font-size:.8rem;font-weight:400;color:var(--gs-grey)}\n.gs-hash{margin-top:1rem;font-size:.82rem;opacity:.9;display:flex;flex-wrap:wrap;gap:.4rem;align-items:center}\n.gs-hash code{background:rgba(0,0,0,.25);color:#fff;word-break:break-all}\n.gs-copy{background:rgba(255,255,255,.18);color:#fff;border:1px solid rgba(255,255,255,.35);border-radius:5px;padding:.15rem .55rem;font-size:.78rem;cursor:pointer}\n\n\/* callouts *\/\n.gs-callout{border-left:5px solid var(--gs-green);background:#eef7ef;padding:1rem 1.2rem;border-radius:0 8px 8px 0;margin:1rem 0}\n.gs-callout.warn{border-color:var(--gs-orange);background:#fdf3e8}\n.gs-callout.red{border-color:var(--gs-red);background:#fcecec}\n.gs-callout strong:first-child{display:block;margin-bottom:.2rem}\n\n\/* grids *\/\n.gs-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(230px,1fr));gap:1rem;margin:1rem 0}\n.gs-card{border:1px solid var(--gs-line);border-radius:10px;padding:1.1rem 1.2rem;background:#fff;box-shadow:0 1px 3px rgba(15,39,66,.05)}\n.gs-card h4{margin:0 0 .35rem;color:var(--gs-navy);font-size:1.02rem}\n.gs-card p{margin:0;font-size:.93rem;color:#3a4552}\n.gs-ico{font-size:1.5rem;line-height:1;margin-bottom:.4rem;display:block}\n\n\/* steps *\/\n.gs-steps{counter-reset:gs;list-style:none;padding:0;margin:1rem 0}\n.gs-steps li{counter-increment:gs;position:relative;padding:.2rem 0 1rem 3.2rem}\n.gs-steps li:before{content:counter(gs);position:absolute;left:0;top:0;width:2.2rem;height:2.2rem;border-radius:50%;background:var(--gs-blue);color:#fff;font-weight:700;display:flex;align-items:center;justify-content:center}\n\n\/* tables *\/\n.gs-table-wrap{overflow-x:auto;margin:.6rem 0 1.4rem}\n.gs-page table{border-collapse:collapse;width:100%;font-size:.93rem}\n.gs-page th{background:var(--gs-navy);color:#fff;text-align:left;padding:.6rem .8rem;font-weight:600}\n.gs-page td{border-bottom:1px solid var(--gs-line);padding:.55rem .8rem;vertical-align:top}\n.gs-page tr:nth-child(even) td{background:var(--gs-soft)}\n.gs-yes{color:var(--gs-green);font-weight:700}\n.gs-pill{display:inline-block;padding:.12rem .6rem;border-radius:999px;font-size:.8rem;font-weight:700;color:#fff;white-space:nowrap}\n.gs-crit{background:var(--gs-red)}.gs-rev{background:var(--gs-orange)}.gs-info{background:var(--gs-grey)}\n.gs-conf{background:var(--gs-green)}.gs-like{background:var(--gs-blue)}.gs-und{background:#8a6d3b}\n\n\/* profiles *\/\n.gs-profiles{display:grid;grid-template-columns:repeat(auto-fit,minmax(260px,1fr));gap:1rem;margin:1rem 0}\n.gs-profile{border:2px solid var(--gs-line);border-radius:12px;padding:1.2rem}\n.gs-profile.full{border-color:var(--gs-blue)}\n.gs-profile h4{margin:0;font-size:1.2rem;color:var(--gs-navy)}\n.gs-profile .gs-time{color:var(--gs-blue);font-weight:700;margin:.2rem 0 .6rem}\n\n\/* faq *\/\n.gs-page details{border:1px solid var(--gs-line);border-radius:8px;margin:.5rem 0;background:#fff}\n.gs-page summary{cursor:pointer;padding:.8rem 1rem;font-weight:600;color:var(--gs-navy)}\n.gs-page details[open] summary{border-bottom:1px solid var(--gs-line)}\n.gs-page details>div{padding:.6rem 1rem .9rem}\n\n.gs-cta{text-align:center;background:var(--gs-soft);border:1px solid var(--gs-line);border-radius:14px;padding:2rem 1.2rem;margin:2.6rem 0 1rem}\n.gs-cta .gs-btn{background:var(--gs-blue);color:#fff!important}\n.gs-cta .gs-btn-sub{color:#dbe7ff}\n.gs-small{font-size:.85rem;color:var(--gs-grey)}\n\n@media (max-width:600px){\n  .gs-hero{padding:1.8rem 1.2rem}\n  .gs-hero h1{font-size:1.65rem}\n  .gs-page h2{font-size:1.35rem}\n}\n<\/style>\n\n<div class=\"gs-page\">\n\n  <!-- HERO -->\n  <section class=\"gs-hero\">\n    <h1>itsimple.info Scam and RAT Scanner<\/h1>\n    <p class=\"gs-lead\">A free, read-only triage scanner for Windows 10 and 11. It finds the footholds scammers and attackers leave behind, explains how they probably got in, and writes a report you can e-mail.<\/p>\n    <div class=\"gs-badges\">\n      <span class=\"gs-badge\">Version 0.8.1<\/span>\n      <span class=\"gs-badge\">Windows 10 \/ 11<\/span>\n      <span class=\"gs-badge\">354 remote access tools<\/span>\n      <span class=\"gs-badge\">100% read-only<\/span>\n      <span class=\"gs-badge\">English \/ \u05e2\u05d1\u05e8\u05d9\u05ea<\/span>\n    <\/div>\n    <a class=\"gs-btn\" href=\"https:\/\/itsimple.info\/wp-content\/uploads\/2026\/11\/GenieScanner-0.8.1.zip\" download=\"GenieScanner-0.8.1.zip\">\n      \u2b07 Download GenieScanner-0.8.1.zip\n      <span class=\"gs-btn-sub\">Signed by Genie Support<\/span>\n    <\/a>\n    <div class=\"gs-hash\">\n      SHA256: <code id=\"gs-sha\">39652821FE1457BC60223652F1A1F1D155E4DA69400994F87F13912723187BFA<\/code>\n      <button type=\"button\" class=\"gs-copy\" onclick=\"navigator.clipboard&amp;&amp;navigator.clipboard.writeText(document.getElementById('gs-sha').textContent);this.textContent='Copied';\">Copy<\/button>\n    <\/div>\n  <\/section>\n\n  <div class=\"gs-callout\">\n    <strong>It never changes the PC.<\/strong>\n    The scanner removes, blocks and quarantines nothing and changes no settings. The only files it writes are its own reports, its log and its rules cache, all inside the scanner folder.\n  <\/div>\n\n  <!-- WHAT IT FINDS -->\n  <h2>What it looks for<\/h2>\n  <p>Built for the classic &#8220;tech support&#8221; and bank-scam call: someone talked the user into installing a remote control tool, and now you need to know what was left behind.<\/p>\n  <div class=\"gs-grid\">\n    <div class=\"gs-card\"><span class=\"gs-ico\">\ud83d\udda5\ufe0f<\/span><h4>Remote access tools<\/h4><p>AnyDesk, TeamViewer, ScreenConnect and 350+ others, including portable copies, session history, RDP and VNC.<\/p><\/div>\n    <div class=\"gs-card\"><span class=\"gs-ico\">\ud83d\udccc<\/span><h4>Hidden persistence<\/h4><p>Run keys, services, scheduled tasks (including hidden ones), WMI, Winlogon and IFEO.<\/p><\/div>\n    <div class=\"gs-card\"><span class=\"gs-ico\">\ud83c\udf10<\/span><h4>Tunnels and connections<\/h4><p>Listeners, SSH tunnels, port forwards, proxy, hosts file and DNS cache.<\/p><\/div>\n    <div class=\"gs-card\"><span class=\"gs-ico\">\ud83d\udee1\ufe0f<\/span><h4>Security tampering<\/h4><p>Defender, UAC and firewall changes, new admin accounts, Sticky Keys backdoor, WDigest.<\/p><\/div>\n    <div class=\"gs-card\"><span class=\"gs-ico\">\ud83d\udd11<\/span><h4>Credential theft<\/h4><p>ClickFix lures in Run and PowerShell history, stealer leftovers, password tools, malicious browser extensions.<\/p><\/div>\n    <div class=\"gs-card\"><span class=\"gs-ico\">\ud83d\udd12<\/span><h4>Ransomware preparation<\/h4><p>Ransom notes, mass-renamed files, deleted shadow copies and disabled recovery.<\/p><\/div>\n  <\/div>\n\n  <!-- HOW TO RUN -->\n  <h2>How to run it<\/h2>\n  <ol class=\"gs-steps\">\n    <li><strong>Extract the whole zip<\/strong> (right-click, <em>Extract All<\/em>). Running it from inside the zip does not work.<\/li>\n    <li><strong>Double-click <code>Start-Scanner.bat<\/code><\/strong> and accept the UAC prompt. If you decline, it still runs as a <em>limited scan<\/em> and the report lists every source it could not read.<\/li>\n    <li><strong>Pick Quick or Full<\/strong>, then press <strong>Start scan<\/strong>. Findings appear as each module finishes.<\/li>\n    <li><strong>Read the report.<\/strong> It is saved in the <code>reports<\/code> folder as <code>GenieScan_&lt;PC&gt;_&lt;date-time&gt;.html<\/code> and <code>.json<\/code>. The HTML is self-contained, so you can e-mail it or open it on another PC.<\/li>\n  <\/ol>\n\n  <div class=\"gs-profiles\">\n    <div class=\"gs-profile\">\n      <h4>Quick scan<\/h4>\n      <div class=\"gs-time\">About 1 to 3 minutes<\/div>\n      Remote tools, persistence, processes, network, security settings, command history and event logs.\n    <\/div>\n    <div class=\"gs-profile full\">\n      <h4>Full scan<\/h4>\n      <div class=\"gs-time\">Up to 15 minutes<\/div>\n      Everything in Quick, plus browsers, loaded DLLs, file triage in user folders, and ransomware checks.\n    <\/div>\n  <\/div>\n\n  <!-- RESULTS -->\n  <h2>Reading the results<\/h2>\n  <p>Every finding shows its <strong>evidence<\/strong> and the <strong>rules that fired<\/strong>, so you can always see why it got its severity.<\/p>\n  <div class=\"gs-table-wrap\"><table>\n    <thead><tr><th>Severity<\/th><th>Meaning<\/th><\/tr><\/thead>\n    <tbody>\n      <tr><td><span class=\"gs-pill gs-crit\">Critical<\/span><\/td><td>Strong sign of compromise or abuse: act on it.<\/td><\/tr>\n      <tr><td><span class=\"gs-pill gs-rev\">Review<\/span><\/td><td>Unusual: check whether the customer knows about it.<\/td><\/tr>\n      <tr><td><span class=\"gs-pill gs-info\">Info<\/span><\/td><td>Inventory and context: normally nothing to do.<\/td><\/tr>\n    <\/tbody>\n  <\/table><\/div>\n\n  <h3>Entry vector: how did it get there?<\/h3>\n  <p>Critical and Review findings also show the most likely chain of how the item arrived on the PC.<\/p>\n  <div class=\"gs-table-wrap\"><table>\n    <thead><tr><th>Confidence<\/th><th>Meaning<\/th><\/tr><\/thead>\n    <tbody>\n      <tr><td><span class=\"gs-pill gs-conf\">Confirmed<\/span><\/td><td>An unbroken chain, for example a download from a link in Gmail, then the file ran.<\/td><\/tr>\n      <tr><td><span class=\"gs-pill gs-like\">Likely<\/span><\/td><td>A strong hint, for example it appeared during an AnyDesk session.<\/td><\/tr>\n      <tr><td><span class=\"gs-pill gs-und\">Undetermined<\/span><\/td><td>No chain could be built. The report lists what could not be checked and why (log too short, auditing off, no download marker).<\/td><\/tr>\n    <\/tbody>\n  <\/table><\/div>\n\n  <div class=\"gs-callout warn\">\n    <strong>Remote access tools are always reported.<\/strong>\n    There is no allowlist, not even for your own tools. Context decides between Review and Critical: portable copies, copies in user or temp folders, copies not signed by their vendor, incoming sessions in the history window, and installs during another remote session are Critical.\n  <\/div>\n  <div class=\"gs-callout red\">\n    <strong>Stealer advisory<\/strong>\n    If a stealer is likely, the report says so: treat browser-saved passwords and session cookies as stolen, and change passwords from a different, clean device.\n  <\/div>\n  <div class=\"gs-callout warn\">\n    <strong>&#8220;No findings&#8221; does not mean &#8220;clean&#8221;.<\/strong>\n    It means the scanner found no indicators with the rules it has. Always read the limitations section of the report.\n  <\/div>\n\n  <!-- OPTIONS -->\n  <h2>Options<\/h2>\n  <div class=\"gs-grid\">\n    <div class=\"gs-card\"><h4>History 7 \/ 30 \/ 90 days<\/h4><p>How far back event logs, installs, downloads and file dates are checked.<\/p><\/div>\n    <div class=\"gs-card\"><h4>Watch mode (admin)<\/h4><p>After the scan, watches for 10, 30 or 60 minutes for new processes, connections, tasks, services and Run values. Useful while the customer repeats what the scammer asked them to do.<\/p><\/div>\n    <div class=\"gs-card\"><h4>Hash lookup<\/h4><p>Off by default. Checks flagged file hashes and public IPs against online reputation services.<\/p><\/div>\n    <div class=\"gs-card\"><h4>EN \/ \u05e2\u05d1<\/h4><p>Switches the window and the report to Hebrew, right to left.<\/p><\/div>\n  <\/div>\n\n  <h3>Privacy<\/h3>\n  <p>Nothing leaves the PC except the rules feed download, unless <strong>Hash lookup<\/strong> is ticked. With it ticked, only SHA256 hashes of flagged non-Microsoft files and public IP addresses from network findings are sent. <strong>File contents, file names and user data are never sent.<\/strong><\/p>\n  <ul>\n    <li>Without API keys, only <strong>CIRCL hashlookup<\/strong> is asked. It only says whether a file is known legitimate software.<\/li>\n    <li>For malicious verdicts, copy <code>config\\lookup.example.json<\/code> to <code>config\\lookup.json<\/code> and add your keys for <strong>MalwareBazaar<\/strong>, <strong>VirusTotal<\/strong> and\/or <strong>AbuseIPDB<\/strong>.<\/li>\n    <li>A malicious verdict raises a finding to Critical. A lookup never lowers one.<\/li>\n  <\/ul>\n\n  <!-- CLI -->\n  <h2>Command line, RMM and remote use<\/h2>\n  <p><code>Start-Scanner.bat<\/code> passes its arguments through, and <code>-NoGui<\/code> runs without the window. Ideal for pushing from your RMM and collecting the report afterwards.<\/p>\n<pre><code>Start-Scanner.bat -NoGui -Profile Full -HistoryDays 90 -OutputPath C:\\Temp\\Genie<\/code><\/pre>\n  <div class=\"gs-table-wrap\"><table>\n    <thead><tr><th>Parameter<\/th><th>Meaning<\/th><\/tr><\/thead>\n    <tbody>\n      <tr><td><code>-NoGui<\/code><\/td><td>Run without the window<\/td><\/tr>\n      <tr><td><code>-Profile Quick|Full<\/code><\/td><td>Scan profile, default Quick<\/td><\/tr>\n      <tr><td><code>-Modules M01,M04<\/code><\/td><td>Only these modules<\/td><\/tr>\n      <tr><td><code>-HistoryDays 7|30|90<\/code><\/td><td>History window, default 30<\/td><\/tr>\n      <tr><td><code>-HashLookup<\/code><\/td><td>Enable online hash and IP lookup<\/td><\/tr>\n      <tr><td><code>-Watch 10<\/code><\/td><td>Watch mode for N minutes after the scan (admin)<\/td><\/tr>\n      <tr><td><code>-OutputPath &lt;folder&gt;<\/code><\/td><td>Where to write the HTML and JSON<\/td><\/tr>\n      <tr><td><code>-Offline<\/code><\/td><td>Use the verified rules cache only<\/td><\/tr>\n      <tr><td><code>-Language en|he<\/code><\/td><td>Report language<\/td><\/tr>\n    <\/tbody>\n  <\/table><\/div>\n\n  <h3>Exit codes<\/h3>\n  <div class=\"gs-table-wrap\"><table>\n    <thead><tr><th>Code<\/th><th>Meaning<\/th><\/tr><\/thead>\n    <tbody>\n      <tr><td><code>0<\/code><\/td><td>No Critical or Review findings<\/td><\/tr>\n      <tr><td><code>1<\/code><\/td><td>Review findings only<\/td><\/tr>\n      <tr><td><code>2<\/code><\/td><td>At least one Critical finding<\/td><\/tr>\n      <tr><td><code>3<\/code><\/td><td>Scan refused: scanner files or rules failed verification<\/td><\/tr>\n      <tr><td><code>4<\/code><\/td><td>Error<\/td><\/tr>\n    <\/tbody>\n  <\/table><\/div>\n\n  <!-- MODULES -->\n  <h2>Modules<\/h2>\n  <div class=\"gs-table-wrap\"><table>\n    <thead><tr><th><\/th><th>Module<\/th><th>Quick<\/th><th>Full<\/th><\/tr><\/thead>\n    <tbody>\n      <tr><td><strong>M01<\/strong><\/td><td>Remote access tools (354), sessions (AnyDesk, TeamViewer, ScreenConnect), RDP, VNC, VPN adapters<\/td><td class=\"gs-yes\">\u2713<\/td><td class=\"gs-yes\">\u2713<\/td><\/tr>\n      <tr><td><strong>M02<\/strong><\/td><td>Persistence: Run keys, services, scheduled tasks (hidden-task check), WMI, Winlogon, IFEO and more<\/td><td class=\"gs-yes\">\u2713<\/td><td class=\"gs-yes\">\u2713<\/td><\/tr>\n      <tr><td><strong>M03<\/strong><\/td><td>Running processes<\/td><td class=\"gs-yes\">\u2713<\/td><td class=\"gs-yes\">\u2713 + loaded DLLs<\/td><\/tr>\n      <tr><td><strong>M04<\/strong><\/td><td>Listeners, connections, SSH tunnels, port forwards<\/td><td class=\"gs-yes\">\u2713<\/td><td class=\"gs-yes\">\u2713 + DNS cache, hosts, proxy<\/td><\/tr>\n      <tr><td><strong>M05<\/strong><\/td><td>Defender, UAC, firewall, accounts, Sticky Keys backdoor, WDigest<\/td><td class=\"gs-yes\">\u2713<\/td><td class=\"gs-yes\">\u2713<\/td><\/tr>\n      <tr><td><strong>M06<\/strong><\/td><td>Run and PowerShell history (ClickFix lures), stealer leftovers, password tools<\/td><td class=\"gs-yes\">\u2713<\/td><td class=\"gs-yes\">\u2713<\/td><\/tr>\n      <tr><td><strong>M07<\/strong><\/td><td>Event history: services and tasks created, admins added, RDP logons, password guessing, logs cleared<\/td><td class=\"gs-yes\">\u2713<\/td><td class=\"gs-yes\">\u2713<\/td><\/tr>\n      <tr><td><strong>M08<\/strong><\/td><td>Browser extensions, policies, notifications, downloads, root certificates<\/td><td><\/td><td class=\"gs-yes\">\u2713<\/td><\/tr>\n      <tr><td><strong>M09<\/strong><\/td><td>Suspicious files in Downloads, Desktop, Temp, AppData and ProgramData<\/td><td><\/td><td class=\"gs-yes\">\u2713<\/td><\/tr>\n      <tr><td><strong>M10<\/strong><\/td><td>Ransom notes, mass-renamed files, shadow copies, recovery settings<\/td><td><\/td><td class=\"gs-yes\">\u2713<\/td><\/tr>\n    <\/tbody>\n  <\/table><\/div>\n\n  <!-- TROUBLESHOOTING -->\n  <h2>Troubleshooting<\/h2>\n  <details><summary>&#8220;Scan refused: scanner files failed verification&#8221;<\/summary><div>A file in the folder was changed or is missing. Download the zip again from this page.<\/div><\/details>\n  <details><summary>&#8220;Scan refused: rules&#8221;<\/summary><div>The rules could not be verified. Check the date and time on the PC and try again with internet access.<\/div><\/details>\n  <details><summary>&#8220;Rules outdated&#8221; (orange)<\/summary><div>The rules are more than 7 days old because the feed was unreachable. The scan still runs, but newer threats may be missed.<\/div><\/details>\n  <details><summary>My antivirus blocks the scanner<\/summary><div>Its checks read the same places attackers use for persistence, and some antivirus products flag that. The zip is signed by Genie Support: compare its SHA256 with the value at the top of this page.<br><code>Get-FileHash .\\GenieScanner-0.8.1.zip -Algorithm SHA256<\/code><\/div><\/details>\n  <details><summary>Where are the logs?<\/summary><div><code>logs\\GenieScan_&lt;PC&gt;_&lt;time&gt;.log<\/code> in the scanner folder.<\/div><\/details>\n\n  <!-- CTA -->\n  <div class=\"gs-cta\">\n    <h3 style=\"margin-top:0\">Think a scammer was on the PC?<\/h3>\n    <p>Run the scanner first. It takes a few minutes and changes nothing.<\/p>\n    <a class=\"gs-btn\" href=\"https:\/\/itsimple.info\/wp-content\/uploads\/2026\/11\/GenieScanner-0.8.1.zip\" download=\"GenieScanner-0.8.1.zip\">\n      \u2b07 Download GenieScanner-0.8.1.zip\n      <span class=\"gs-btn-sub\">Windows 10 \/ 11 \u00b7 free<\/span>\n    <\/a>\n    \n  <\/div>\n\n  <p class=\"gs-small\">Disclaimer: the scanner is a triage tool and is provided as is. It does not replace antivirus software or a professional incident response.<\/p>\n\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>itsimple.info Scam and RAT Scanner A free, read-only triage scanner for Windows 10 and 11. It finds the footholds scammers and attackers leave behind, explains how they probably got in, and writes a report you can e-mail. Version 0.8.1 Windows 10 \/ 11 354 remote access tools 100% read-only English \/ \u05e2\u05d1\u05e8\u05d9\u05ea \u2b07 Download GenieScanner-0.8.1.zip [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22,4,1,14,15],"tags":[],"class_list":["post-3255","post","type-post","status-publish","format-standard","hentry","category-security","category-tech","category-uncategorized","category-windows","category-windows-server"],"_links":{"self":[{"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/posts\/3255","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/itsimple.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3255"}],"version-history":[{"count":4,"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/posts\/3255\/revisions"}],"predecessor-version":[{"id":3261,"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/posts\/3255\/revisions\/3261"}],"wp:attachment":[{"href":"https:\/\/itsimple.info\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3255"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itsimple.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3255"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itsimple.info\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3255"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}