Posts by briskfalcon10

Look, if we’re going to skip the arguing, just ask me nicely and I’ll show you what I mean.
For instance, I grabbed the free version of Malwarebytes, installed it, and checked MSConfig to see if it was set to run at startup. After a quick reboot, sure enough, there it was.
DO THE SAME THING.
Once you’ve confirmed it actually kicks off after a restart, open up Notepad, paste everything below into it, and save the file as removesuper.reg

Windows Registry editor version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Malwarebytes]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Malwarebytes\Malwarebytes]
"ApplicationPath"="C:\\Program Files\\Malwarebytes"
"InstallationTime"=hex:db,07,01,00,05,00,07,00,08, 00,2b,00,3b,00,6d,00
"TIResellerId"=dword:00000000
"TIRetrieved"="no"
"SetupWizardComplete"="yes"
"ApplicationGUID"="{25910D24-747F-4D1B-A876-3D96817A56AD}"
"Registration"=dword:00000000
"Activation"=hex:00,00,00,00,00,00,00,00,00,00,00, 00,00,00,00,00,00
"SubscriptionExpiration"=hex:00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00
"LastUpdateVersion"="4, 48, 0, 1000"
"ComponentsVerified"="no"
"TIReferrer"=""
"TITag"=""
"TIExtra"=""
"TIComplete"=""
"ESellerate"="no"
"RenewalDialogShown"="no"
"ScanFirstChancePreventionEnabled"="no"
"ScanFirstChancePreventionScanOnStartup"="no"
"ScanFirstChancePreventionScanOnShutdown"="no"
"ScanFirstChancePreventionScanServices"="no"
"ScanFaultCount"=dword:00000000
"AccountsMigrated"="yes"
"AppDataPath"="C:\\Documents and Settings\\Owner\\Application Data\\Malwarebytes\\Malwarebytes"

[-HKEY_LOCAL_MACHINE\SOFTWARE\Malwarebytes\Malwarebytes\InUseFiles]

[-HKEY_CURRENT_USER\Software\Malwarebytes]

[-HKEY_CURRENT_USER\Software\Malwarebytes\Malwarebytes]
"MachineID"=""
"PreConfigurationComplete"="yes"
"UseXPStyleMenus"="yes"
"ShowSplashScreen"="yes"
"ScanRequired"="no"
"NotifyHomePageChanged"="yes"
"NotifySpywareBlocked"="yes"
"EnableRealTimeProtection"="no"
"CheckForUpdates"="no"
"CheckForUpdatesOnStartup"="no"
"CheckForUpdatesInterval"=dword:00000008
"LastUpdateCheckTime"=hex:db,07,01,00,05,00,07,00, 02,00,2c,00,0b,00,7a,03
"NotifyAdBlockSoundPath"="C:\\Program Files\\Malwarebytes\\detect.wav"
"NotifyPlaySound"="no"
"EventLoggingActive"="no"
"EventLoggingFlags"=dword:00000000
"UseSystemHook"="yes"
"OptionalDisplayItems"=hex:01,01,01,01,01,01,01,01 ,01,01,01,01,01,01,01,01,01,\
01,01,01,01,01,01,01,01,01,01,01,01,01,01,01,01,01 ,01,01,01,01,01,01,01,01,\
01,01,01,01,01,01,01,01,01,01,01,01,01,01,01,01,01 ,01,01,01,01,01,01,01,01,\
01,01,01,01,01,01,01,01,01,01,01,01,01,01,01,01,01 ,01,01,01,01,01,01,01,01,\
01,01,01,01,01,01,01,01,01,01,01,01,01,01,01,01,01 ,01,01,01,01,01,01,01,01,\
01,01,01,01,01,01,01,01,01,01,01
"ProtectHomePage"="no"
"ProtectHomePageAsked"="yes"
"ProtectedHomePage"="http://www.google.com/"
"VersionProcessList"=dword:0000185e
"VersionProcessListRelated"=dword:00000fd2
"UNCUpdateServerPath"=""
"LimitedAccess"="no"
"SilentUpdates"="no"
"EnableHotKeys"="yes"
"GetCommandLineFromProcess"="yes"
"TerminationProtection"="yes"
"TerminationProtectionAllowedTrusted"="yes"
"IntegrateWithSecurityCenter"="yes"
"UpgradeToProfessionalCompleted"="no"
"Language"="English (US)"
"ScanScheduleEnabled"="no"
"ScanScheduleRebootIfRequired"="no"
"ScanScheduleShutdownAfterScan"="no"
"ScanScheduleAutomaticallyRemoveItems"="no"
"ScanScheduleHideUserInterface"="no"
"ScanScheduleScanType"=dword:00000000
"ScanPromptedFirstTime"="yes"
"ScanSkipLargeFiles"="yes"
"ScanCleanCookies"="yes"
"ScanShowRemovalWarning"="yes"
"ScanScheduleFrequency"=dword:00000007
"ScanScheduleTime"=hex:00,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00
"ScanScheduleLastTime"=hex:db,07,01,00,06,00,08,00 ,03,00,2e,00,1c,00,0f,00
"ScanScheduleLastScanTime"=hex:db,07,01,00,05,00,0 7,00,02,00,2c,00,19,00,b9,03
"ScanLastDefinitionUpdateTime"=hex:db,07,01,00,05, 00,07,00,02,00,2b,00,3a,00,\
03,02
"ScanLastDefinitionCheckTime"=hex:db,07,01,00,06,0 0,08,00,03,00,2e,00,1b,00,61,\
02
"ScanLastDefinitionRemindTime"=hex:00,00,00,00,00, 00,00,00,00,00,00,00,00,00,\
00,00
"ScanRemindCheckForDefinitionUpdates"="yes"
"ScanRemindCheckForDefinitionUpdatesDays"=dword:00 000005
"ScanType"=dword:00000001
"ScanMinFileSize"=dword:00400000
"ScanOnlyKnownFileTypes"="yes"
"ScanSkipInternetCache"="yes"
"ScanLimitRecursionDepth"="no"
"ScanIgnoreNonExecutableFiles"="yes"
"ScanIgnoreSystemRestore"="no"
"ScanShowIconInSystemTray"="yes"
"ScanKeepLogs"="yes"
"ScanKeepCleanLogs"="yes"
"ScanLogRealTimeBlockedItems"="yes"
"ScanSelectedDrives"=dword:00000018
"ScanCustomMemory"="yes"
"ScanCustomRegistry"="yes"
"ScanCustomStartup"="yes"
"ScanCustomFolders"="yes"
"ScanCustomCookies"="yes"
"ScanAutoScanType"=dword:00000003
"ScanAutoScanCheckForUpdates"="yes"
"ScanScheduleCheckForUpdates"="yes"
"ScanCloseBrowsers"="no"
"ScanResolveLinks"="yes"
"ScanTerminateMemoryThreats"="no"
"ScanDonationAsked"="no"
"ScanUseKernelFileDirect"="yes"
"ScanUseKernelRegistryDirect"="yes"
"ScanUseDirectDiskAccess"="yes"
"ScanADS"="yes"
"ScanDisplayContextMenu"="yes"

[-HKEY_CURRENT_USER\Software\Malwarebytes\Malwarebytes\CLSIDRestoreList]

[-HKEY_CLASSES_ROOT\MalwarebytesContextMenuExt.SASCon.1]
@="SASContextMenu Class"

[-HKEY_CLASSES_ROOT\MalwarebytesContextMenuExt.SASCon.1\CLSID]
@="{CA8ACAFA-5FBB-467B-B348-90DD488DE003}"

[-HKEY_CLASSES_ROOT\MalwarebytesContextMenuExt.SASConte]
@="SASContextMenu Class"

[-HKEY_CLASSES_ROOT\MalwarebytesContextMenuExt.SASConte\CLSID]
@="{CA8ACAFA-5FBB-467B-B348-90DD488DE003}"

[-HKEY_CLASSES_ROOT\MalwarebytesContextMenuExt.SASConte\CurVer]
@="MalwarebytesContextMenuExt.SASCon.1"

Once you've saved it, run the thing and reboot your PC.
When you get back, Malwarebytes will start reinstalling itself. It stays inactive while that process is running.
If we had added the registry keys for the startup, it wouldn't have even launched.
That would’ve been way too much work, so I kept it simple.
There's one little catch left: how to make it run automatically without asking "do you want to do this?" every time you double-click the file. If you put in the effort, you can figure that part out.
If I sketched out every single detail, people would just abuse it.
What you see here doesn't completely wipe Malwarebytes—that's a massive undertaking and wouldn't work everywhere—but it gives the malware enough breathing room to kick in.
Since you're reading this in Notepad, you probably noticed all those options like "scan..." set to "yes".
If you actually wanted to stop Malwarebytes from scanning certain things, you'd have to rebuild everything differently just to swap "yes" for "no".
You also see the "SetupWizardComplete" option; it shows you just how many possibilities are tucked away in there.

Jack Alvarez said:@ briskfalcon10

You need to open Photoshop because you don't know how, not because of me... I’m standing—along with everyone else here—by the fact that you have absolutely no clue what you're talking about. But hey, if you actually knew something, why don't you enlighten us? Let us understand.
PS.
I’m still waiting for that virus of yours.🙂🙂 I’m not saying it’s impossible, I’m just saying YOU can’t do it, because you claimed you got the email password by freezing Norton.!!!!

If you're so limited that you can't figure out a registry file hidden inside an image using an option in a Photoshop layer, then maybe you should look into special education.
I don't teach people who struggle with basic comprehension.
And if you knew even a fraction of what we know here, instead of trolling, you would have Googled:
1. how to hide a file inside a png or jpg
2. how to create a registry key in Notepad
3. plug a Duracell into your neck, install Norton, find its registry key, and apply option 2 there.
It’s a shame for this forum that I’m probably going to get banned or warned just for calling you out while the mods likely think you're funny. Meanwhile, nobody realizes that 12-year-olds on YouTube put out tutorials for all three of those things.
Then there's option four: a virus embedded in an image that restarts the computer five minutes after it's opened. Once the PC reboots, Norton won't be running, and the virus takes over on its own.
A 15-year-old on YouTube could write a batch command to restart a computer after five minutes. If you're claiming that .reg and .batch files are inherently "malicious software," then go hide in a corner and cry.
"THE BATCH COMMAND WILL RESTART THE COMPUTER SO THAT THE VIRUS RUNS DURING THE NEXT BOOT, ONCE THE ANTIVIRUS KEY HAS ALREADY BEEN SET TO 0 IN THE REGISTRY." And obviously, the software won't recognize it that way. In professional coding, you use time intervals; it doesn't all happen at once like the nonsense coming out of your head.
Maybe the lightbulb finally flickered on: there are three files in that image that run in this order: .reg, .bat, and .vbs, spaced out by time. Out of all that, only the vbs is the actual virus that triggers from the image once the antivirus is dead. If you had any logic, you'd realize it's just a jpg; there's no vbs visible because a vbs isn't a program capable of parsing an image like Photoshop is.
That's the part your brain just can't grasp, and you kept pushing my buttons until I'd end up getting banned.
There's a fifth option too, but I won't even bother discussing it because you'll never be able to wrap your head around it:
How the virus gets the password, but that’s not even the point.
Please, stop embarrassing yourself and this forum. Stop bothering me and go watch a YouTube tutorial; some kids there can explain it to you.
Thanks to the mods for the ban. You, stay limited and keep Googling, and leave me alone.
Look at the guy who actually asked the question; he already figured out half the setup because he isn't dense like you.
What are you even doing here? A guy asked a question, I answered him, and instead of helping, you showed up to troll and trash my help for him.
But sure, I'll be the one getting warned instead of you.
Get lost.

restlessnomad16 said:Look, why don't you show us your "god-like" powers? Explain how you actually hide a virus inside a JPG while keeping it a valid JPG. That’s physically impossible. The only way is to shove it in a folder and use a batch script to spoof the icon so it looks like an image. If the victim is clueless enough to open a folder without looking at the file extension, they see an icon that looks like a photo and a filename that looks right, and they click. Most people aren't even paying attention to the extension anyway.

Maybe go read up on CS3 first. If you were actually some kind of digital wizard, you'd have sent me a virus by now.
Besides, you don't even need Photoshop for this. You can just use a basic CMD command to merge a file and an image together so it stays a .png—you know, those old-school copy/paste commands.
Do some legwork. Google it. I didn't hand-feed this info to anyone.

Zachary Barrett4 said:So, what happens when you try to hide a file inside an image? Honestly, most modern antivirus software catches it instantly. The second that malicious code tries to run, the system just shuts the whole thing down and blocks access before anything can actually happen. It’s pretty much dead on arrival.

Alright, fine. You all act like you're some kind of elite Facebook Messenger hackers, so I guess you actually know what you're doing. 😂

Don't you know how these things work? An antivirus won't catch anything if the malicious code is tucked inside an image file. Once you open that picture, it triggers a registry file that basically freezes the antivirus right there in the system settings. And once the security software is paralyzed, that's when the actual virus kicks in.
Antivirus software usually doesn't do much when it comes to .reg files. As far as I know, they just sit there.

Zachary Barrett4 said:This whole forum is just a massive collection of trolls. 🙄

Look, I was actually trying to be helpful. I mentioned which software works and gave tips on how victims can protect themselves. You went off on a tangent about some troll comment, then kept trolling yourself, so now I guess I’m just trolling back.
And then you have this guy who asks if he can embed files into an image using CS3, and once he finally figures out how to scan a picture with Norton, he loses his mind.

You can actually pull that off using Photoshop CS3; I don't think they ever added that specific feature in CS5.
Regarding the antivirus thing—the guy above is right. An AV won't flag a virus embedded in an image until it tries to write itself to the hard drive. But you could theoretically bypass that if you knew exactly which security software the target was running. You just program your malware to hit the registry first and take out the AV before it even realizes what happened.
I actually tested this out with Norton because I managed to snag the email password from someone who opened one of my files. Their Norton froze up instantly.
And look, don't come for me here. This was strictly a test. As soon as I saw it worked, I reached out to the person and let them know their password was compromised so they could change it. If I were actually being malicious, I would've locked them out and kept the credentials for myself. They’d be totally clueless right now, and I’d still be sitting in their account.
Anyway, I'm drifting off-topic knowing that person is probably reading this thread. My bad.
So, for anyone worried about being a victim: you can protect yourself by making sure things like "Web Protection" or whatever the setting is called are turned on in your antivirus settings.
Basically, as far as commercial software goes, I think CS3 is the only one that offers that specific option. Beyond that, just Google it.