registry clean after infection
ring3 Api Call

prevent rootkits from stopping your program