Skip to main content
Every artifact the game installs must be explicitly removed. Incomplete cleanup leaves a machine in an inconsistent state — and in a real incident, missed artifacts mean the attacker can return. cyber_modules/persistence.py exposes a remove_persistence() function that undoes everything the installation step created. tools/cleanup_tool.py wraps this function with a command-line interface for classroom use.

​
Artifacts created by the game

Before cleanup, understand exactly what needs to be removed:
ArtifactLocationPlatform
Registry Run keyHKCU\Software\Microsoft\Windows\CurrentVersion\Run\VirusHunterAgentWindows
Crontab entryCurrent user’s crontab (@reboot ...main_game.py...)Linux
LaunchAgent plist~/Library/LaunchAgents/com.v-hunter.agent.plistmacOS
Marker filecyber_modules/simulated_startup/system_defender_autorun.txtAll
Background processRunning main_game.py --bg processAll
Do not skip the background process termination step. Even after removing the autostart entry, a currently running background agent will continue operating until killed or the machine is rebooted.

​
How remove_persistence() works

Step 1: Remove the Registry entry
import winreg

key = winreg.OpenKey(
    winreg.HKEY_CURRENT_USER,
    r"Software\Microsoft\Windows\CurrentVersion\Run",
    0,
    winreg.KEY_SET_VALUE
)
winreg.DeleteValue(key, "VirusHunterAgent")
winreg.CloseKey(key)
Step 2: Kill running agent processes
import subprocess

subprocess.run(["taskkill", "/F", "/IM", "VirusHunter.exe"])
subprocess.run(["taskkill", "/F", "/IM", "pythonw.exe"])
/F forces termination without prompting. Note that killing all pythonw.exe processes is a broad sweep — in a real scenario, you would target the specific process ID (PID) instead.

​
All platforms: delete the marker file

Regardless of platform, the final step is always the same: 
import os

marker = os.path.join(
    os.path.dirname(__file__),
    "simulated_startup",
    "system_defender_autorun.txt"
)
if os.path.exists(marker):
    os.remove(marker)
The game uses the presence of this file to determine whether persistence is active. Deleting it resets the game state to “clean”.

​
The cleanup_tool.py wrapper

tools/cleanup_tool.py provides a standalone command-line interface that calls remove_persistence() without requiring the full game to be running: 
python tools/cleanup_tool.py
This is particularly useful in a classroom setting where a student may have closed the game window but left a background agent running, or where an instructor needs to reset a machine to a clean state before the next exercise.
The cleanup tool can be run safely multiple times. Each removal operation checks whether the artifact exists before attempting to delete it, so running it on an already-clean machine produces no errors.

​
Verifying cleanup was successful

After running cleanup, confirm that every artifact has been removed:
1

Check the autostart entry

reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Confirm VirusHunterAgent does not appear in the output.
2

Check for running processes

tasklist | findstr pythonw
tasklist | findstr VirusHunter
Neither process should appear.
3

Check the marker file

ls cyber_modules/simulated_startup/system_defender_autorun.txt
The file should not exist. If it does, the cleanup did not complete successfully.
4

Reboot and verify

The definitive test: reboot the machine and confirm that no unexpected processes start automatically. Use the process checks from Step 2 immediately after login.

​
Real-world incident response

In real incident response, artifact removal follows the same pattern but at a much larger scale. IR teams use frameworks like MITRE ATT&CK to enumerate all known persistence techniques for the malware family they are dealing with, then systematically check and remove each one.Tools commonly used for this include:
  • Autoruns (Windows) — shows every program configured to run at startup, from Registry keys to scheduled tasks to browser extensions.
  • osquery — cross-platform SQL-based endpoint visibility.
  • Volatility — memory forensics to find in-memory implants that leave no disk artifacts.
The key lesson: cleanup is not optional. In a real investigation, failing to remove a persistence mechanism means the attacker retains access even after the initial intrusion vector is patched. Always treat cleanup as a required step, not an afterthought — and always verify that it worked.

Build docs developers (and LLMs) love

Get started for freeTalk to us