[Swench]

Hello,

I am randomly losing bots and can't figure out why, I have them for 2-4 weeks then they just randomly disappear and no they arent just offline (i know) these are also not low quality bots from torrents/youtube, there is no other malware on them so I am not getting bot killed.

They are all using WinDefender and I have set exclusions set to c: and other folders where the bot.exe is so the file is not getting peridoically scanned.

I can only guess windows update (MSRT update?) is removing the exclusions upon update, any other ideas?

Disclaimer: These are bots on my own network :)

[aweroamsd]

Yeah have the same problem it stays on for like 1 week ish and it just poofs i did the same thing and did the excluision

[DramaKing]

Hello,

I am randomly losing bots and can't figure out why, I have them for 2-4 weeks then they just randomly disappear and no they arent just offline (i know) these are also not low quality bots from torrents/youtube, there is no other malware on them so I am not getting bot killed.

They are all using WinDefender and I have set exclusions set to c: and other folders where the bot.exe is so the file is not getting peridoically scanned.

I can only guess windows update (MSRT update?) is removing the exclusions upon update, any other ideas?

Disclaimer: These are bots on my own network :)

Windows Update does not remove Defender exclusions. I'd say that it's because you excluded the entire C: drive. In my experience Defender exclusions are not recursive, but to the point of the slaves dropping after a period, you didn't state that you kill Windows Security. I would say that it's a testament to people's lack of computer awareness that your slaves stay up for weeks. The victims are probably detecting and removing your malware. That's all.

[Rsynced]

Windows Update does not remove Defender exclusions. I'd say that it's because you excluded the entire C: drive. In my experience Defender exclusions are not recursive, but to the point of the slaves dropping after a period, you didn't state that you kill Windows Security. I would say that it's a testament to people's lack of computer awareness that your slaves stay up for weeks. The victims are probably detecting and removing your malware. That's all.

Ya they probably virus scanned or windows detected the virus.

[Sand Ferret]

Windows Defender exclusions are very easy to spot, you get a notification saying WD has skipped files when it scans. That is the most likely reason.

Setup a test VM and see if you can replicate it, it’s possibly just shit malware.

[DramaKing]

Windows Defender exclusions are very easy to spot, you get a notification saying WD has skipped files when it scans. That is the most likely reason.

Setup a test VM and see if you can replicate it, it’s possibly just shit malware.

A C: exclusion is hard not to spot.

[Swench]

Windows Update does not remove Defender exclusions. I'd say that it's because you excluded the entire C: drive. In my experience Defender exclusions are not recursive, but to the point of the slaves dropping after a period, you didn't state that you kill Windows Security. I would say that it's a testament to people's lack of computer awareness that your slaves stay up for weeks. The victims are probably detecting and removing your malware. That's all.

Thanks for the replies and confirming about updates, I haven't killed Defender, I think thats more obvious seeing a red X on the Defender shield over a exclusion and keeping Defender running don't think you? Unless there is another way to kill defender while keeping the green tick on the shield?

Windows Defender exclusions are very easy to spot, you get a notification saying WD has skipped files when it scans. That is the most likely reason.

Setup a test VM and see if you can replicate it, it’s possibly just shit malware.

I have seen this notification, thats the most probable cause, I'm using DarkVision, I think it is pretty good. Thanks for your input.

A C: exclusion is hard not to spot.

I could remove the c: exclusion, it was just an option within the build so added it in.

[martigo333]

What happened is that the slave scanned their pc and windows defender pick it and killed it. Its been happening for years and you're not the only person experiencing this. even those with $1k crypter is going through the same shit. When the bot.exe or any extension file is no more fud it will be killed by Win Defender. solution is to maybe create an ai that can auto crypt and auto upload new file on slaves remotely.

[InspectorGadget]

What happened is that the slave scanned their pc and windows defender pick it and killed it. Its been happening for years and you're not the only person experiencing this. even those with $1k crypter is going through the same shit. When the bot.exe or any extension file is no more fud it will be killed by Win Defender. solution is to maybe create an ai that can auto crypt and auto upload new file on slaves remotely.

This wouldn't apply if the entire C drive is excluded from defender though, right?

[Swench]

My .exe isnt crypted at all, my process is a .bat file that when ran... > Adds exclusions to WinDefender > Download and Execute's hosted .exe

I think the cause of loss is as said above, they are seeing the notification from Defender saying Defender has skipped a file, I think there is a way to turn off defender notifications, which if possible I will do in future.

[DramaKing]

Thanks for the replies and confirming about updates, I haven't killed Defender, I think thats more obvious seeing a red X on the Defender shield over a exclusion and keeping Defender running don't think you? Unless there is another way to kill defender while keeping the green tick on the shield?


I have seen this notification, thats the most probable cause, I'm using DarkVision, I think it is pretty good. Thanks for your input.


I could remove the c: exclusion, it was just an option within the build so added it in.

I didn't say anything about killing Defender. If you insist on a C: exclusion, you need to stop the associated warning from appearing.