Removing NoEscape.exe - Boot Sector included

Though a little bit more difficult to remove, it's still possible. In this video I'll show you how.
Endermanch's original removal tutorial: https://www.youtube.com/watch?v=4oATWyMMH4A
Discord: https://discord.gg/fSqJ6C5dTn
Windows PE ISO: https://archive.org/details/gandalfswin10pex64redstone307102018
ISO creator: https://sourceforge.net/projects/iso-creator-cs/files/latest/download
TestDisk: https://www.cgsecurity.org/Download_and_donate.php/testdisk-7.2-WIP.win.zip
(All NOT sponsored)
Registry Changes:
__HKLM:__
HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout\Scancode Map

HKLM\SOFTWARE\Classes\exefile\shell\open\command
HKLM\SOFTWARE\Classes\exefile\shell\runas\command

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\UseDefaultTile
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon
HKLM\SOFTWARE\Policies\Microsoft\Windows\System\DisableLogonBackgroundImage

__HKCU:__
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools
HKCU\Software\Policies\Microsoft\Windows\System\DisableCMD

HKCU\Control Panel\Desktop\AutoColorization
HKCU\Control Panel\Mouse\SwapMouseButtons

Music:
Tobu - Candyland [NCS Release]
DEAF KEV - Invincible [NCS Release]
#noescape #malware #trojan

Видео Removing NoEscape.exe - Boot Sector included канала Orange Group Tech