Opens in Simple mode: Scan, scanning status and actual detected items. Switch to Advanced for the previous detailed interface without restarting the scan or losing results.
Download latest v0.2.0 Simple/Advanced GUI (Windows x64)
Download v0.2.0 SHA-256 checksum | Private GitHub release notes
START-READONLY-GUI.bat as a standard user, not Administrator.Fixes the findings reader rejecting the UTF-8 BOM written by Windows PowerShell 5.1. Malformed JSON and invalid or mismatched evidence remain inconclusive, not clean. The separate cause of the owner's adapter exit-code-1 report is not yet established; use Advanced errors/warnings if it recurs.
Read-only remote-access detection, not an antivirus scan. No removal, uninstall, service stopping, snapshots, antivirus scanning, uploads or elevation. Sensitive local evidence/logs are written under %LOCALAPPDATA%\ScreenConnectCleanup\Runs\<run-id> and a GUID-named Desktop transcript is attempted. Protect these files.
Independent review PASS; all ten exact-commit Windows 2022/2025 checks passed, including synthetic native containment, 23 findings-reader tests, 57 ViewModel tests, 16 cleanup assertions, PowerShell 5.1 and extracted-ZIP Simple/Advanced UI Automation. No live detector was run by the agents; owner live acceptance remains required.
Source: 5fdf3dcef7995869953ce45062581830e4ec6e45. Exact-commit prototype CI.
SHA-256: 9df60af08fa8d67e5af1d11287691aed85dff06f23f823b13e122d47e10c9b10
Self-contained Windows x64 GUI. Standard-user Detect Only inspection; Full Investigation and removal are unavailable. Owner live testing is still required.
Download DetectOnly GUI prototype v0.1.0 (Windows x64)
Download prototype SHA-256 checksum | Private GitHub prerelease notes
START-READONLY-GUI.bat as a standard user. Do not run as administrator or use the legacy cleanup bootstrap.No removal, uninstall, quarantine, service stopping, snapshots, scanners or uploads. Sensitive local evidence is written under %LOCALAPPDATA%\ScreenConnectCleanup\Runs\<run-id>; a GUID-named Desktop transcript is attempted. Incomplete collection is not a clean result. Protect these files.
Verified on hosted Windows 2022 and 2025 using synthetic containment tests, PowerShell 5.1 regressions and extracted-ZIP UI Automation. No agent live detector/removal run. Source: 64f18b57b9f723b5d95ae282ead286ab1be86fe1. Exact-commit prototype CI.
SHA-256: ae4f8c5a562779540004e9713ffee87d17b71575ef04470576816ffb37c69da2
Verification caveat: a pre-existing local scheduling test flaked once, then passed in isolation and two full reruns; both exact-commit Windows suites passed.
TESTING ONLY - not production-validated. This is the separate attended legacy cleanup tool, not the DetectOnly WPF GUI. Use an authorized disposable Windows test machine first.
Download screenconnect-cleanup-v1.8.5.zip
Download SHA-256 checksum | GitHub testing release notes
--elevation-attempted marker, replacing the fltmc.exe probe that could re-prompt and leave several elevated copies parked. If the console is still not elevated, the runner tells you to run as administrator instead of asking again.PSArgumentException: The input name "DisplayName" cannot be resolved to a property). All filters now read properties safely, and an incomplete collection prints the recorded errors and the unfinished sections instead of only saying "incomplete".services.msc and taskschd.msc, together with a printed list of what was flagged, where to look, and whether each entry is REVIEW-ONLY or a candidate. It opens windows and writes one audit record; it changes, stops, removes and approves nothing, and declining is safe.persistence/collection-progress.log) and the visible-console battery fix.DEPLOY.md and docs/12-post-av-persistence.md.START-HERE.bat - expect one elevation prompt. Vendor scanners still raise their own Windows prompt.Old stuck windows from the earlier elevation bug are yours to close: reboot, or end only positively identified ScreenConnect cleanup sessions. Do not bulk-end unrelated cmd.exe or PowerShell processes, and do not approve removal of your own required ScreenConnect client.
Raw evidence remains local and can contain sensitive commands, paths, users and IP addresses. Protect the run folder. Sanitized sharing adds only aggregate persistence metadata. Offline hive loading, script samples and shell history are intentionally omitted.
Windows Server 2022/2025 CI passed under PowerShell 5.1 and 7, including the extracted-ZIP fixtures, the elevation-bound check, the review-window fixture (declining launches nothing) and the property-safety negative controls: exact-source Windows CI. Both CI ZIPs passed exact member-manifest checks; this download preserves the tested Windows 2022 artifact bytes.
No agents ran live scanners, installations or destructive cleanup. Owner live collection coverage, approval/UAC UX, actual target mutation, rollback usefulness and quarantine restoration remain pending.
Source: 6f4aed383221f279db9115b61a09faf99f92f90f. SHA-256: 4f291d9b3513a4e4389972e4a8267a6f8b7bad36ecdd8515fd8a45fc0ee1f448.
Superseded: v1.8.2 (Step 6d hang fix) can re-prompt for elevation and can throw the inventory error above - archived v1.8.2 ZIP | v1.8.1 | v1.8.0 (hidden-console bug).
v1.8.5 remains the approved latest release. Fixes the reported failure where the runner window opened and closed instantly with no UAC prompt: the batch launcher broke when the extracted folder name contained parentheses, e.g. screenconnect-cleanup-v1.8.8 (1). Every path expansion is now captured before delayed expansion and referenced as !VAR!, so brackets in the path can no longer break cmd's block parsing.
Download v1.8.9 testing ZIP | SHA-256 checksum | Release notes
Exact-source Windows 2022/2025 checks passed under PowerShell 5.1 and pwsh, including extracted-ZIP fixtures and a test that runs the launcher from a ( ) folder with a negative control. Owner confirmed v1.8.9 works live on Windows.
Deferred (owner decision): the reboot-resume protected-staging design and the bounded lifecycle of a failed resume task were not changed.
Extract into a fresh folder for testing. No agents ran live client scanners, installers, removal or reboot.
Source: c2196bb8ab7da1229db0dfd34d406230016f8a46. SHA-256: 3876e5be87b9b1394a5673a9ac7ede80b8c1a8159538b07078e150262fdee56b.
v1.8.5 remains the approved latest release. Second review pass on v1.8.7: the relay's rejection drain is now bounded by a total deadline (a trickling client could previously pin an unauthenticated handler thread), and the resume-location ACL check gained its first automated regression.
Download v1.8.8 testing ZIP | SHA-256 checksum | Release notes
Exact-source Windows 2022/2025 checks passed under PowerShell 5.1 and pwsh, including extracted-ZIP fixtures. The download preserves the tested Windows 2022 CI artifact bytes. The relay and test files are server-side/dev only and are not in this bundle.
Deferred (owner decision): the reboot-resume protected-staging design and the bounded lifecycle of a failed resume task were not changed.
Extract into a fresh folder for owner testing. No agents ran live client scanners, installers, removal or reboot.
Source: f01139219edeb39515549085722f9312064be70d. SHA-256: e5274c1ca9bfc7c334c9c649ded12868baef021f98c3ae1d049eb847980c7c5b.
v1.8.5 remains the approved latest release. This candidate folds an independent audit pass into v1.8.6: script-level debug traps, correct Windows argument quoting, a session-safe installer with release-digest verification, draining relay rejections, and more accurate resume-location ACL checks. Removal policy and the GUI are unchanged.
Download v1.8.7 testing ZIP | SHA-256 checksum | Release notes
Exact-source Windows 2022/2025 checks passed under PowerShell 5.1 and pwsh, including extracted-ZIP fixtures. The download preserves the tested Windows 2022 CI artifact bytes.
Deferred (owner decision): the reboot-resume protected-staging design and the bounded lifecycle of a failed resume task were not changed. See docs/13-legacy-code-review.md in the ZIP. This candidate does not certify reboot-resume or unrestricted production readiness.
Extract into a fresh folder for owner testing. No agents ran live client scanners, installers, removal or reboot.
Source: ae25e89d4764925160aa9103dd1a26b86b83f705. SHA-256: eece265303c300c2c1c460c1b70afaaf5e2989a670a83a9703af2fa8eb545e8b.
v1.8.5 remains the approved latest release. This separate candidate contains reviewed performance and evidence-safety fixes; removal policy and the GUI are unchanged.
Download v1.8.6 testing ZIP | SHA-256 checksum | Release notes
Faster buffered persistence progress draining, deduplicated inventory traversal, protected review audit output, after-snapshot failure reporting, HTML error escaping and stable single-section JSON arrays. The local synthetic 600-line supervisor fixture changes from a false timeout at 13.570 seconds to completion at 1.610 seconds; this is not a live Windows provider benchmark.
Exact-source Windows 2022/2025 checks passed under PowerShell 5.1 and pwsh, including extracted-ZIP fixtures: Windows CI. The download preserves the tested Windows 2022 CI artifact bytes.
Deferred review finding: failed reboot-resume verification can leave the SYSTEM logon resume task registered without a bounded retry/expiry policy. That lifecycle was not changed here. See docs/13-legacy-code-review.md in the ZIP. This candidate does not certify reboot-resume or unrestricted production readiness.
Extract into a fresh folder for owner testing. No agents ran live client scanners, installers, removal or reboot.
Source: 3e644599a95316b83e9a986ae5ea5b9a2cf858de. SHA-256: 2b9a48ce760a2c356750792114daae23e0f5b4ecfb011788bc621ea2db296b73.
Download screenconnect-cleanup-v1.7.53.zip | SHA-256 checksum | Release notes
SHA-256: 802fa38ebe35014e6c83690e55b5db47af521f58ac0110722081e73b46693f23