Scribd Logo
Upload

Welcome to Scribd!

  • 86 views

    Bypass Setup Guide

    Uploaded by

    Johan
    The document provides instructions to bypass detection through various methods like disabling shellbags, userassistview, MRU lists, run search history, and real time protection in Windows Defender. It also describes clearing powershell command logs, shadow copies, appcompatcache, and the USN journal to remove traces. Potential methods discussed but not recommended include disabling fsutil.exe and sysmain system files.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd

    Bypass Setup Guide

    Uploaded by

    Johan
    86 views4 pages
    The document provides instructions to bypass detection through various methods like disabling shellbags, userassistview, MRU lists, run search history, and real time protection in Windows Defender. It also describes clearing powershell command logs, shadow copies, appcompatcache, and the USN journal to remove traces. Potential methods discussed but not recommended include disabling fsutil.exe and sysmain system files.

    Original Title

    BypassSetupGuide

    Copyright

    © © All Rights Reserved

    Available Formats

    TXT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document provides instructions to bypass detection through various methods like disabling shellbags, userassistview, MRU lists, run search history, and real time protection in Windows Defender. It also describes clearing powershell command logs, shadow copies, appcompatcache, and the USN journal to remove traces. Potential methods discussed but not recommended include disabling fsutil.exe and sysmain system files.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Download as txt, pdf, or txt
    86 views4 pages

    Bypass Setup Guide

    Uploaded by

    Johan
    The document provides instructions to bypass detection through various methods like disabling shellbags, userassistview, MRU lists, run search history, and real time protection in Windows Defender. It also describes clearing powershell command logs, shadow copies, appcompatcache, and the USN journal to remove traces. Potential methods discussed but not recommended include disabling fsutil.exe and sysmain system files.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Download as txt, pdf, or txt
    of 4

    Bypass Setup Guide

    By L

    Section 1
    =================================
    Disable ShellBags
    1. Open Regedit
    2. Delete all subkeys located below
    ---
    Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags
    Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\BagMRU
    Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags
    Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU
    Computer\HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\
    Windows\Shell\Bags
    Computer\HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\
    Windows\Shell\BagMRU
    ---
    3. Recreate these keys below
    ---
    Computer\HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\
    Windows\Shell\Bags
    Computer\HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\
    Windows\Shell\BagMRU
    ---
    4. Go to Computer\HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\
    Microsoft\Windows\Shell
    5. Right click "Shell" and select DWORD (32-bit) Value
    6. Name it "BagMRU Size" and set the value data to 1
    =================================
    Disable UserAssistView
    1. Open Regedit
    2. Navigate to Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\
    CurrentVersion\Explorer\UserAssist
    3. Right click on "UserAssist" and create a key. Rename the key to "settings"
    4. Under the key create a new DWord (32-bit) Value and name it "NoLog"
    5. Give it a value of 1
    =================================
    Disable MRU List
    1. Open Regedit
    2. Navigate to Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\
    CurrentVersion\Policies\Explorer
    3. Under the registry key "Explorer" create a new DWord (32-bit) Value and name it
    "NoRecentDocsHistory"
    4. Give it a value of 1
    =================================
    Disable Run Search History
    1. Open Regedit
    2. Navigate to Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\
    CurrentVersion\Explorer\Advanced
    3. Under the REG_DWORD "Start_TrackProgs", change the value to 0
    =================================
    Disable Real Time Protection Permanently
    1. Open Regedit
    2. Navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows
    Defender
    3. Under the registry key "Windows Defender" create a new key and name it "Real-
    Time Protection"
    4. Under the registry key create a new DWord (32-bit) Value and name it
    "DisableRealtimeMonitoring"
    5. Give it a value of 1
    6. Open Process Hacker in Administrator mode and terminate "MsMpEng"
    =================================
    Disable Kernel Mode (Remove Access to Regedit, csrss, MsMpEng in PH2) # Most people
    don't know about this
    1. Go to Hacker, select options, select Advanced
    2. Untick "Enable kernel-mode driver"
    =================================
    Disable Open Save Files # Not sure if it still works
    1. Open Regedit
    2. Navigate to Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\
    CurrentVersion\Explorer\ComDlg32
    3. Under the registry key "ComDlg32" create a new DWord (32-bit) Value
    4. Name it "NoFileMru" and give it a value of 1
    =================================
    Disable Powershell History
    1. Open Powershell as Administrator
    2. Type in "Set-PSReadlineOption -HistorySaveStyle SaveNothing"
    =================================
    Disable Memory Compression
    1. Open Powershell as Administrator
    2. Type in "Disable-MMAgent -mc"
    =================================
    Disable CSRSS and Registry in Process Hacker 2 (Not sure if it works for PH3)
    1. Redirect the application origin file path, exc: "C:\Program Files\Process Hacker
    2"
    2. Right click on ProcessHacker.exe and select properties
    3. Select "Change Settings for all Users" at the very bottom
    4. Tick "Run this program in compatibility mode for" and select the option "Windows
    Vista"
    5. Click on Apply for both windows
    =================================
    Check these registry paths in case there's suspicious logs, if so delete them.
    1. ShowJumpView :: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\
    CurrentVersion\Explorer\FeatureUsage\ShowJumpView
    2. StartMenuInternet :: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet
    3. Store :: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\
    CurrentVersion\AppCompatFlags\Compatibility Assistant\Store
    4. Command Process :: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor
    5. AppSwitched :: HKEY_CURRENT_USER\SOFTWARE\Microsoft\CurrentVersion\
    Explorer\FeatureUsage\AppSwitched
    6. Deleted Partition :: HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices
    7. OpenSavePidlMRU :: HKEY_CURRENT_USER\Software\Microsoft\Windows\
    CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU
    8. DirectInput :: HKEY_CURRENT_USER\Software\Microsoft\DirectInput
    9. ArcHistory :: WinRAR - HKEY_CURRENT_USER\SOFTWARE\WinRAR\
    ArcHistory
    :: 7zip [Compression] - HKEY_CURRENT_USER\SOFTWARE\7-Zip\
    Compression
    :: 7zip [Extraction] - HKEY_CURRENT_USER\SOFTWARE\7-Zip\
    Extraction
    10. RecentDocs :: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\
    CurrentVersion\Explorer\RecentDocs
    11. DisallowRun :: HKEY_CURRENT_USER\Software\Microsoft\Windows\
    CurrentVersion\Policies\explorer\DisallowRun
    12. TypedPaths :: HKEY_CURRENT_USER\Software\Microsoft\Windows\
    CurrentVersion\Explorer\TypedPaths
    13. LastVisitedPIDMRU :: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\
    CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU
    14. Bam :: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\
    15. MUICache :: HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\
    Windows\Shell\MuiCache
    ===================================================================================
    ================

    !! Do these after finished setting up for bypass.


    Section 2
    =================================
    Clear Powershell Command Logs (Do it after using Powershell related to
    Bypassing/Cheating)
    1. Redirect the path "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\
    PowerShell\PSReadLine"
    2. Delete the file called "ConsoleHost_history.txt"
    =================================
    Clear shawdow copies (Best to disable MsMpEng before doing so)
    1. Open Cmd as Administrator
    2. Type in "vssadmin delete shadows /for=c: /all"
    =================================
    Clear Appcompatcache
    1. Open Powershell as Administrator
    2. Type in "rundll32.exe kernel32.dll,BaseFlushAppcompatCache"
    =================================
    Delete Fsutil USN Journal
    1. Open Cmd as Administrator
    2. Type in "fsutil usn deleteJournal /D C:"
    ===================================================================================
    ================

    !! These methods are only for reference. (In Progress)


    Section 3
    =================================
    Disable Fsutil.exe (make sure to backup the file if possible)
    1. Locate the file in C:\Windows\System32
    2. Open fsutil.exe with notepad++
    3. Delete a word in it and save
    =================================
    Disable Sysmain (Bannable most of the time)
    1. Open Cmd as Administrator
    2. Type in "sc config sysmain start= disabled & sc stop sysmain"
    =================================
    Change AnyDesk ID (in case you're cheating on an alt)
    1. Redirect the path "...\AppData\anydesk"
    2. Delete the file called "service.conf"
    =================================
    Hide icons
    Gpedit : https://gpeditmsc.en.softonic.com/download
    1. Open Run(win+r) and type in "gpedit.msc" (installation above if not found)
    2. Redirect the path: User Configuration > Administrative Templates > Start menu
    and taskbar
    3. Double click "Hide the notification area" and select "Enable"
    =================================
    Erase all Traces of connected USB
    USB Oblivion : https://sourceforge.net/projects/usboblivion/?source=typ_redirect
    1. Install and run USB Oblivion
    2. Untick every options except for "Do real clean (simulation otherwise)"
    3. Select "Clean"
    =================================

    You might also like