I appreciate this feedback, I’ll check this and update this article if required. Thanks!

This threat removal method leaves out the backdoor executable inside the “/var/tmp/” folder with a random name beginning by “tmp.”

That folder isn’t removed by os x when you restart your Mac according to Apple’s documentation.