[Soup_DZ]

I suggest to clear your temp file after you clean up the virus issue. And also, a lot of viruses don't use those icons. Most of them melt on execution and hide themselves in various locations with persistence on. This will only remove some obvious infections.

You have to run the virus for it to embed itself in the first place. Unless it's a java drive by so get it right
Also it's easy to disable persistence by removing all permission from the stub. If it is a crypted stub it WILL be visible in you task manager. You can also go into your register to look for a start up key from the stub. I know what i'm talking about.

Well of course you have to run it unless it's a JDB. How else would it infect your system .__.;?
I don't think you understand some features that crypters have nowdays. I know what I'm talking about. I RAT. I have my own installs and my own infections. Honestly, I doubt you know what you're talking about.

You do realize that your registry will most likely be disabled, right? The crypted stub will be visible in the task manager, yeah. But you do know it hides itself and clones a process right?

Yes and most of the time is hides itself in explorer.exe ._. I also rat.

And I'm sure since you also RAT that it's easy to remove the msconfig file or change the files permissions. Which is another flaw in your tutorial. Nonetheless, removing it from that start up won't do anything against persistence as you have to kill the process first, then remove the base file, then remove the keys from the registry/start up folder. And you should also know most people also disable the task manager or make it so the process is closed every time it's executed.

[Cake]

I suggest to clear your temp file after you clean up the virus issue. And also, a lot of viruses don't use those icons. Most of them melt on execution and hide themselves in various locations with persistence on. This will only remove some obvious infections.

You have to run the virus for it to embed itself in the first place. Unless it's a java drive by so get it right
Also it's easy to disable persistence by removing all permission from the stub. If it is a crypted stub it WILL be visible in you task manager. You can also go into your register to look for a start up key from the stub. I know what i'm talking about.

Well of course you have to run it unless it's a JDB. How else would it infect your system .__.;?
I don't think you understand some features that crypters have nowdays. I know what I'm talking about. I RAT. I have my own installs and my own infections. Honestly, I doubt you know what you're talking about.

You do realize that your registry will most likely be disabled, right? The crypted stub will be visible in the task manager, yeah. But you do know it hides itself and clones a process right?

Yes and most of the time is hides itself in explorer.exe ._. I also rat.

And I'm sure since you also RAT that it's easy to remove the msconfig file or change the files permissions. Which is another flaw in your tutorial. Nonetheless, removing it from that start up won't do anything against persistence as you have to kill the process first, then remove the base file, then remove the keys from the registry/start up folder. And you should also know most people also disable the task manager or make it so the process is closed every time it's executed.

A lot of people don't disable the task manager because it makes it obvious and you don't want people suspecting they have a rat so they do their regular routine, so they can get their passwords. Everyone does it differently. There is no true way to remove one as the possibilities with them are endless. This wasn't made to be an in depth tutorial on every little thing you can do. You can always just backup important files on a flash drive and reformat.

[Soup_DZ]

You have to run the virus for it to embed itself in the first place. Unless it's a java drive by so get it right
Also it's easy to disable persistence by removing all permission from the stub. If it is a crypted stub it WILL be visible in you task manager. You can also go into your register to look for a start up key from the stub. I know what i'm talking about.

Well of course you have to run it unless it's a JDB. How else would it infect your system .__.;?
I don't think you understand some features that crypters have nowdays. I know what I'm talking about. I RAT. I have my own installs and my own infections. Honestly, I doubt you know what you're talking about.

You do realize that your registry will most likely be disabled, right? The crypted stub will be visible in the task manager, yeah. But you do know it hides itself and clones a process right?

Yes and most of the time is hides itself in explorer.exe ._. I also rat.

And I'm sure since you also RAT that it's easy to remove the msconfig file or change the files permissions. Which is another flaw in your tutorial. Nonetheless, removing it from that start up won't do anything against persistence as you have to kill the process first, then remove the base file, then remove the keys from the registry/start up folder. And you should also know most people also disable the task manager or make it so the process is closed every time it's executed.

A lot of people don't disable the task manager because it makes it obvious and you don't want people suspecting they have a rat so they do their regular routine, so they can get their passwords. Everyone does it differently. There is no true way to remove one as the possibilities with them are endless. This wasn't made to be an in depth tutorial on every little thing you can do. You can always just backup important files on a flash drive and reformat.

Well all I'm saying is, if you're going to write a tutorial, at least make it where it works in "universal" scenarios. Otherwise, specify more what kind of symptoms.

[Cake]

Well of course you have to run it unless it's a JDB. How else would it infect your system .__.;?
I don't think you understand some features that crypters have nowdays. I know what I'm talking about. I RAT. I have my own installs and my own infections. Honestly, I doubt you know what you're talking about.

You do realize that your registry will most likely be disabled, right? The crypted stub will be visible in the task manager, yeah. But you do know it hides itself and clones a process right?

Yes and most of the time is hides itself in explorer.exe ._. I also rat.

And I'm sure since you also RAT that it's easy to remove the msconfig file or change the files permissions. Which is another flaw in your tutorial. Nonetheless, removing it from that start up won't do anything against persistence as you have to kill the process first, then remove the base file, then remove the keys from the registry/start up folder. And you should also know most people also disable the task manager or make it so the process is closed every time it's executed.

A lot of people don't disable the task manager because it makes it obvious and you don't want people suspecting they have a rat so they do their regular routine, so they can get their passwords. Everyone does it differently. There is no true way to remove one as the possibilities with them are endless. This wasn't made to be an in depth tutorial on every little thing you can do. You can always just backup important files on a flash drive and reformat.

Well all I'm saying is, if you're going to write a tutorial, at least make it where it works in "universal" scenarios. Otherwise, specify more what kind of symptoms.

Yeah this tutorial was directed towards removing BSHADES, DC, and cybergate.

[Soup_DZ]

Didn't even read the full tutorial. Now I read you want them to clean out the registry? You know that can cause major errors right? It's never recommended to clean out the registry ...

[Cake]

Didn't even read the full tutorial. Now I read you want them to clean out the registry? You know that can cause major errors right? It's never recommended to clean out the registry ...

When you're done removing a rat you want to remove those empty registry keys it leaves behind..
And that's why you also backup your registry...

[Soup_DZ]

Didn't even read the full tutorial. Now I read you want them to clean out the registry? You know that can cause major errors right? It's never recommended to clean out the registry ...

When you're done removing a rat you want to remove those empty registry keys it leaves behind..
And that's why you also backup your registry...

Do that manually. Don't use a registry cleaner. Registry cleaners will "clean" up all the empty keys, some of which can cause problems and can lead to Windows not even working sometimes.

[Cake]

Didn't even read the full tutorial. Now I read you want them to clean out the registry? You know that can cause major errors right? It's never recommended to clean out the registry ...

When you're done removing a rat you want to remove those empty registry keys it leaves behind..
And that's why you also backup your registry...

Do that manually. Don't use a registry cleaner. Registry cleaners will "clean" up all the empty keys, some of which can cause problems and can lead to Windows not even working sometimes.

Very little chance of that happening. I always recommend backing up your registry before you do any cleaning.

[Harvey]

Didn't even read the full tutorial. Now I read you want them to clean out the registry? You know that can cause major errors right? It's never recommended to clean out the registry ...

When you're done removing a rat you want to remove those empty registry keys it leaves behind..
And that's why you also backup your registry...

Do that manually. Don't use a registry cleaner. Registry cleaners will "clean" up all the empty keys, some of which can cause problems and can lead to Windows not even working sometimes.

Very little chance of that happening. I always recommend backing up your registry before you do any cleaning.

The point Soup is trying to make is that it's generally not considered good practice anymore to clean registries with applications like CCleaner.

[Unknown]

Another method you can try is getting Dark Comet RAT Remover. This will obviously depend if you've been RATed by DarkComet or not.