(04-11-2013, 02:48 AM)Odissea Wrote:

(04-11-2013, 02:29 AM)Soup Wrote:

(04-11-2013, 02:22 AM)Odissea Wrote:

(04-11-2013, 01:59 AM)Soup Wrote: I suggest to clear your temp file after you clean up the virus issue. And also, a lot of viruses don't use those icons. Most of them melt on execution and hide themselves in various locations with persistence on. This will only remove some obvious infections.

You have to run the virus for it to embed itself in the first place. Unless it's a java drive by so get it right
Also it's easy to disable persistence by removing all permission from the stub. If it is a crypted stub it WILL be visible in you task manager. You can also go into your register to look for a start up key from the stub. I know what i'm talking about.

Well of course you have to run it unless it's a JDB. How else would it infect your system .__.;?
I don't think you understand some features that crypters have nowdays. I know what I'm talking about. I RAT. I have my own installs and my own infections. Honestly, I doubt you know what you're talking about.

You do realize that your registry will most likely be disabled, right? The crypted stub will be visible in the task manager, yeah. But you do know it hides itself and clones a process right?

Yes and most of the time is hides itself in explorer.exe ._. I also rat.

(04-11-2013, 02:52 AM)Soup Wrote:

(04-11-2013, 02:48 AM)Odissea Wrote:

(04-11-2013, 02:29 AM)Soup Wrote:

(04-11-2013, 02:22 AM)Odissea Wrote:

(04-11-2013, 01:59 AM)Soup Wrote: I suggest to clear your temp file after you clean up the virus issue. And also, a lot of viruses don't use those icons. Most of them melt on execution and hide themselves in various locations with persistence on. This will only remove some obvious infections.

You have to run the virus for it to embed itself in the first place. Unless it's a java drive by so get it right
Also it's easy to disable persistence by removing all permission from the stub. If it is a crypted stub it WILL be visible in you task manager. You can also go into your register to look for a start up key from the stub. I know what i'm talking about.

Well of course you have to run it unless it's a JDB. How else would it infect your system .__.;?
I don't think you understand some features that crypters have nowdays. I know what I'm talking about. I RAT. I have my own installs and my own infections. Honestly, I doubt you know what you're talking about.

You do realize that your registry will most likely be disabled, right? The crypted stub will be visible in the task manager, yeah. But you do know it hides itself and clones a process right?

Yes and most of the time is hides itself in explorer.exe ._. I also rat.

And I'm sure since you also RAT that it's easy to remove the msconfig file or change the files permissions. Which is another flaw in your tutorial. Nonetheless, removing it from that start up won't do anything against persistence as you have to kill the process first, then remove the base file, then remove the keys from the registry/start up folder. And you should also know most people also disable the task manager or make it so the process is closed every time it's executed.

(04-11-2013, 03:14 AM)Odissea Wrote:

(04-11-2013, 02:52 AM)Soup Wrote:

(04-11-2013, 02:48 AM)Odissea Wrote:

(04-11-2013, 02:29 AM)Soup Wrote:

(04-11-2013, 02:22 AM)Odissea Wrote: You have to run the virus for it to embed itself in the first place. Unless it's a java drive by so get it right
Also it's easy to disable persistence by removing all permission from the stub. If it is a crypted stub it WILL be visible in you task manager. You can also go into your register to look for a start up key from the stub. I know what i'm talking about.

Well of course you have to run it unless it's a JDB. How else would it infect your system .__.;?
I don't think you understand some features that crypters have nowdays. I know what I'm talking about. I RAT. I have my own installs and my own infections. Honestly, I doubt you know what you're talking about.

You do realize that your registry will most likely be disabled, right? The crypted stub will be visible in the task manager, yeah. But you do know it hides itself and clones a process right?

Yes and most of the time is hides itself in explorer.exe ._. I also rat.

And I'm sure since you also RAT that it's easy to remove the msconfig file or change the files permissions. Which is another flaw in your tutorial. Nonetheless, removing it from that start up won't do anything against persistence as you have to kill the process first, then remove the base file, then remove the keys from the registry/start up folder. And you should also know most people also disable the task manager or make it so the process is closed every time it's executed.

A lot of people don't disable the task manager because it makes it obvious and you don't want people suspecting they have a rat so they do their regular routine, so they can get their passwords. Everyone does it differently. There is no true way to remove one as the possibilities with them are endless. This wasn't made to be an in depth tutorial on every little thing you can do. You can always just backup important files on a flash drive and reformat.

(04-11-2013, 03:23 AM)Soup Wrote:

(04-11-2013, 03:14 AM)Odissea Wrote:

(04-11-2013, 02:52 AM)Soup Wrote:

(04-11-2013, 02:48 AM)Odissea Wrote:

(04-11-2013, 02:29 AM)Soup Wrote: Well of course you have to run it unless it's a JDB. How else would it infect your system .__.;?
I don't think you understand some features that crypters have nowdays. I know what I'm talking about. I RAT. I have my own installs and my own infections. Honestly, I doubt you know what you're talking about.

You do realize that your registry will most likely be disabled, right? The crypted stub will be visible in the task manager, yeah. But you do know it hides itself and clones a process right?

Yes and most of the time is hides itself in explorer.exe ._. I also rat.

And I'm sure since you also RAT that it's easy to remove the msconfig file or change the files permissions. Which is another flaw in your tutorial. Nonetheless, removing it from that start up won't do anything against persistence as you have to kill the process first, then remove the base file, then remove the keys from the registry/start up folder. And you should also know most people also disable the task manager or make it so the process is closed every time it's executed.

A lot of people don't disable the task manager because it makes it obvious and you don't want people suspecting they have a rat so they do their regular routine, so they can get their passwords. Everyone does it differently. There is no true way to remove one as the possibilities with them are endless. This wasn't made to be an in depth tutorial on every little thing you can do. You can always just backup important files on a flash drive and reformat.

Well all I'm saying is, if you're going to write a tutorial, at least make it where it works in "universal" scenarios. Otherwise, specify more what kind of symptoms.

(04-11-2013, 03:24 AM)Soup Wrote: Didn't even read the full tutorial. Now I read you want them to clean out the registry? You know that can cause major errors right? It's never recommended to clean out the registry ...

(04-11-2013, 03:29 AM)Odissea Wrote:

(04-11-2013, 03:24 AM)Soup Wrote: Didn't even read the full tutorial. Now I read you want them to clean out the registry? You know that can cause major errors right? It's never recommended to clean out the registry ...

When you're done removing a rat you want to remove those empty registry keys it leaves behind..
And that's why you also backup your registry...

(04-11-2013, 03:30 AM)Soup Wrote:

(04-11-2013, 03:29 AM)Odissea Wrote:

(04-11-2013, 03:24 AM)Soup Wrote: Didn't even read the full tutorial. Now I read you want them to clean out the registry? You know that can cause major errors right? It's never recommended to clean out the registry ...

When you're done removing a rat you want to remove those empty registry keys it leaves behind..
And that's why you also backup your registry...

Do that manually. Don't use a registry cleaner. Registry cleaners will "clean" up all the empty keys, some of which can cause problems and can lead to Windows not even working sometimes.

(04-11-2013, 03:33 AM)Odissea Wrote:

(04-11-2013, 03:30 AM)Soup Wrote:

(04-11-2013, 03:29 AM)Odissea Wrote:

(04-11-2013, 03:24 AM)Soup Wrote: Didn't even read the full tutorial. Now I read you want them to clean out the registry? You know that can cause major errors right? It's never recommended to clean out the registry ...

When you're done removing a rat you want to remove those empty registry keys it leaves behind..
And that's why you also backup your registry...

Do that manually. Don't use a registry cleaner. Registry cleaners will "clean" up all the empty keys, some of which can cause problems and can lead to Windows not even working sometimes.

Very little chance of that happening. I always recommend backing up your registry before you do any cleaning.