Hack Forums
Remove a JRAT? - SOLVED!!! - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: Remove a JRAT? - SOLVED!!! (/showthread.php?tid=4860804)

Pages: Pages 1 2 3 4 5

Remove a JRAT? - SOLVED!!! - Avαlαr - Jun 11, 2015

Anyone gotta a clue as to how I get this thing off of my PC? I got it around 2 days ago, and it's gotten to the point that I can't use my computer unless I start it in Safe Mode with Networking. I know that there's probably a section specifically for this on HF, but I don't know where it is, and I haven't ever posted in any of the other sections.

and dun call me stoopid. I ran a scan on the file before using it and it came up clean for some reason.

Yeah, and then some other guy did a scan on the same file on the same website and found that it had RAT in it. Fml...

I'm actually willing to do a complete wipe of my hard drive and reinstall Windows 8.1, but it won't accept my Product ID for some reason. I guess getting a computer with Windows pre-installed complicates things. :/

* - c$sh - Jun 11, 2015

Curious, what file was it?

* - Kotlin - Jun 11, 2015

I'm not entirely sure this is the right section. Even though it's Java, it belongs in the Whitehat section.

https://hackforums.net/forumdisplay.php?fid=110

Anyways, you tried scanning with Malwarebyte?

* - Avαlαr - Jun 11, 2015

(Jun 11, 2015 06:49 PM)S. M. Archer Wrote:  I'm not entirely sure this is the right section. Even though it's Java, it belongs in the Whitehat section.

https://hackforums.net/forumdisplay.php?fid=110

Anyways, you tried scanning with Malwarebyte?

Tried just about every freakin antivirus ever. So like 6. But yeah, Malwarebyte was one of them. All it did was a 5 hour scan that had no effect on the virus that was actually causing all of the problems. It just found shit like trojans and adware in Internet Explorer, which I don't even use.

Oh and I forgot.

Somewhere along the lines, I managed to stop the virus for a few hours. It was only after I ran a scan from Kaspersky, then started a 30 day free trial where it would protect your computer in real time, like most other antivirus software does. I then uninstalled and reinstalled Java. After that, it was working fine for a few hours, and then it just stopped working.

And now when I start up my PC normally, I can't do anything because it's lagging so hard, with 40 instances of Java Environment... something running in the background, making pop-up windows n shit one after the other.

(Jun 11, 2015 06:46 PM)WontonZ Wrote:  Curious, what file was it?

Supposed to be an "installer" in this link for Flare 3.3. http://www.2shared.com/file/HS40LLVy/Flare_33_Cracked_by_Saladman.html

The actual thing has been leaked now though. I've heard the font rendering has some issues...

Also, here's the link of the working leak. Because the guy who cracked it felt like deobfuscating the RAT, so I guess it might help.
http://hentaiandecchi.#.com/forums/attachment.php?aid=13

* - Kotlin - Jun 11, 2015

(Jun 11, 2015 06:57 PM)TheWallsPlayer Wrote:  - snip -

I suggest you delete those links because:

A:) The dev sells the product on the forums
B:) It's not allowed.

* - Ashley‌ - Jun 11, 2015

https://github.com/redpois0n/jrat-remover

There are build instructions in the readme. Made by the guy who made jRAT.

* - le edgy fag - Jun 11, 2015


Holy shit redpois0n, now that's a name I haven't seen in a while

* - Avαlαr - Jun 11, 2015

(Jun 11, 2015 07:09 PM)poop nugget Wrote:  https://github.com/redpois0n/jrat-remover

There are build instructions in the readme. Made by the guy who made jRAT.

u w0t m8? That sounds too good to be true, lol. But I'll try it.

My problem is that I literally cannot do anything once I log into my computer in regular mode. I get like a 1 minute time window to be able to do anything. After that, it becomes too laggy to accomplish anything.

* - afk0 - Jun 11, 2015

(Jun 11, 2015 07:45 PM)TheWallsPlayer Wrote:  u w0t m8? That sounds too good to be true, lol. But I'll try it.

My problem is that I literally cannot do anything once I log into my computer in regular mode. I get like a 1 minute time window to be able to do anything. After that, it becomes too laggy to accomplish anything.

Sounds like your computer is being used to mine Bitcoins.
I reported your post for being in the wrong section so staff should move it soon.

* - Avαlαr - Jun 11, 2015

(Jun 11, 2015 07:46 PM)Λaron Wrote:  Sounds like your computer is being used to mine Bitcoins.
I reported your post for being in the wrong section so staff should move it soon.

I hope I know where to find it when it gets there, haha.

(Jun 11, 2015 07:09 PM)poop nugget Wrote:  https://github.com/redpois0n/jrat-remover

There are build instructions in the readme. Made by the guy who made jRAT.

How do I run this program again? In the readme it's saying something about double-clicking "Remover.jar", but that didn't come with the file on that page. :/

* - The Scarabian - Jun 11, 2015

Why the hell is this in the Griefing Section?

* - Avαlαr - Jun 11, 2015

Goddamn, the Whitehat section just looks f-ing sad. All those people with the same problems. Durn.

(Jun 11, 2015 07:55 PM)Manuel Neuer Wrote:  Why the hell is this in the Griefing Section?

werkin on et.

m8002342342345

* - c$sh - Jun 11, 2015

Are you sure it is a jRAT?

Could really be about any RAT on the market considering it was an EXE

* - Avαlαr - Jun 11, 2015

(Jun 11, 2015 08:07 PM)WontonZ Wrote:  Are you sure it is a jRAT?

Could really be about any RAT on the market considering it was an EXE

Naw, it was a .jar alright. Every time I start up my computer, my desktop gets spammed with Java Environment errors n shit.

Also, gotta love contacting Microsoft for help on resetting your computer, and the bitch says this:

"That is great
LEt's get started
Windows 8.1 will cost you $119.99 and you will have this one for a life time"

I already payed for the shit when I got it pre-installed along with this poop of a laptop. Last time I contacted them and told them I had a virus, they wanted me to buy a subscription or some crap that was $40 a month. T_T

Do they not have enough $$$$$$?

* - Knautschtabak - Jun 11, 2015

Hi TheWallsPlayer.
Are you now able to get into normal mode? If so, please do that and proceed with the following steps.

Please read through the points below to ensure this process moves as quickly and efficiently as possible.
  • Ensure you read through my instructions thoroughly, and carry out each step in the order specified.

  • Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in providing the best set of instructions for you.

  • Please backup important files before proceeding with my instructions. Malware removal can be unpredictable at times.

  • If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.

  • I will notify you when I believe your computer is free of malware. Please bear in mind, absence of symptoms does not necessarily correlate to absence of malware, so please wait until the "All Clean".


------
Step 1: Farbar Recovery Scan Tool (FRST) Scan
  • Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.

  • Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.

  • Right-Click FRST.exe or FRST64.exe and select Run as Administrator

  • Click Yes to the disclaimer.

  • Ensure the Addition.txt box is checked.

  • Click the Scan button and let the program run.

  • Upon completion, click OK, then OK on the Addition.txt pop up screen.

  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste them to pastebin.com. Post the link here.


Step 2: RogueKiller
  • Download RogueKiller (32 bit)/RogueKiller (64 bit) and save the file to your Desktop.

  • Note: Download and run the version compatible with your system (32 or 64-bit). Download the first (32-bit) if you're unsure.

  • Close any running programs.

  • Right-Click RogueKiller.exe and select Run as administrator to run the program.

  • Allow the Prescan to complete. Upon completion, a window will open. Click Accept.

  • A browser window may open. Close the browser window.

  • Click [Image: jpgUwzp.png]. Upon completion, click [Image: phPvmc6.png].

  • Close the program. Do not fix anything!

  • A log (RKreport.txt) will be open. Copy the contents of the log to pastebin.com, click Submit and paste the link to it in your next reply.