‫So another important thing to remember is it's vital to remove the back door once you put a back door
‫on a system.
‫Anyone can use that backdoor to compromise the system.
‫Of course, there are some methods to prevent unintended usages of a back door, but still.
‫You have to remove the back door when you finish with it.
‫There are two plus one steps to remove the back door we put in the previous lecture.
‫Now, in the first step, we're going to remove the back door with an interpreter session.
‫Now, as you know, there are different file system commands in my interpreter that you can use on the
‫remote host.
‫And one of them is R.M, which is used to remove this specified file.
‫Now, the crime commands need the full file name, so let's roll up to find the installed file path
‫and the name.
‫Here are the messages of the persistence command.
‫And here is the file and the full path.
‫So as you imagine, the path is different from the previous lecture, because this is another backdoor
‫that I created off the record.
‫So no matter what, just find the back door file and its location.
‫Now, let me find the file in the victim machine documents and settings administrator dot seal to local
‫settings.
‫Temp.
‫This is the fire.
‫So I'll copy the full file path.
‫And give it the parameter of the rim command.
‫Now don't forget to duplicate the back slashes, as I mentioned before, the first backslash is the
‫indicator of a special character.
‫And the second one is that special character.
‫Now it says that the access is denied.
‫So maybe I don't have the necessary rights, so I'll want to use get system interpreter command to gain
‫this system privileges.
‫So I got the system.
‫Now, try to delete the file again.
‫My mistake?
‫I put the pair, but didn't put the file name.
‫So now I copy the file name and pasted at the end of the path.
‫OK.
‫The file is now deleted.
‫So the first step is pretty much enough to destroy the back door.
‫But, you know, it's better to be safe than sorry.
‫So let's just clean the system.
‫So I'd like to delete the registry key that is created by the persistence method.
‫Again.
‫Roll up to find their created registry key.
‫Here, I'll copy the full path and name.
‫So we're going to use the reg command to delete the registry key when we type reg and hit enter.
‫We reached the help page of the command.
‫Well, I made millions of unsuccessful attempt.
‫I don't want to lead these attempts just to show you that you shouldn't give up easily to succeed.
‫OK, so here's the correct reg command to delete a key is Reg.
‫The evil take the full path of the key v, the name of the key.
‫I think we finally deleted the registry key.
‫So let's go to the victim system and just check to make sure it's deleted.
‫Refresh the registry editor and yeah, the key has gone.
‫So the next step is not related to the victim machine.
‫I just wanted to clean up my own system, Carly.
‫So when I run the persistence method, a folder is created to keep the logs of that persistent session,
‫so let's delete the folder for perfect cleaning.
‫I now open a new terminal screen.
‫I'm in the home folder of the current user route.
‫Last year, she held see all the files and folders, including the hidden ones.
‫Now there is a folder named Scott MSEC for use, the CD command to go inside that folder.
‫Now go to the logs folder.
‫There is a folder called persistence in it.
‫Go to that folder as well.
‫As you see, there is a folder here.
‫The first part of the folder is the domain name of our victim machine.
‫And the rest is the date and time of the first usage of the persistence method.
‫So here you can use the M Command with R F as the parameter to delete any non empty folder.
‫And that's a.