+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [Remove Rats/Check] TCPViewer (/showthread.php?tid=4971066)
[Remove Rats/Check] TCPViewer - Velozity™ - Aug 31, 2015
So I have come across a nifty program that may help some noobies out if they believe they are being ratted or put under some virus.
![[Image: NeO2sE2.png]](https://i.imgur.com/NeO2sE2.png)
Just look for any shady programs and especially using any unusual ports that the program should not be using. Also looking for default ports like 9003 (imminent) and others...
Here is a picture of a rat on my PC.
![[Image: n7AOtBm.png]](https://i.imgur.com/n7AOtBm.png)
yes.exe is obviously not legit and the port is being used by something shady, So lets locate the file (for startup)
![[Image: yp6OwZF.png]](https://i.imgur.com/yp6OwZF.png)
And there is the location for the rat.
This can be done through task manage, but I find this much more easier to manage and use more efficiently.
I hope I helped some newbies, fix there rat/keylogger related problems :)
note: this is not a full tutorial on removal of the rat, this just helps with a temporary solution, there may be startup and injection methods taking place.
Those who wants to download original TCPView program from Microsoft hosted website visit below website URL link.
Download TCPView:
https://technet.microsoft.com/en-us/sysi...s/bb897437
* - Burakku Kenshi - Aug 31, 2015
I use this method a lot :P
* - Velozity™ - Aug 31, 2015
Yeahh, it works very well, real efficient ;3
* - -Hyperion - Aug 31, 2015
This is pretty good for users who do not know how to use CMD
* - Freebooter - Aug 31, 2015
Are you trying to hide download link for Sysinternals famous TCPView program why are you not giving the original download URL link which then you don't have to make every HF member believe that your uploaded TCPView program is malware free very strange.
Those who wants to download original TCPView program from Microsoft hosted website visit below website URL link.
"Download TCPView"
https://technet.microsoft.com/en-us/sysinternals/bb897437
* - Velozity™ - Aug 31, 2015
(Aug 31, 2015 05:39 PM)Freebooter Wrote: Are you trying to hide download link for Sysinternals famous TCPView program why are you not giving the original download URL link which then you don't have to make every HF member believe that your uploaded TCPView program is malware free very strange.
Those who wants to download original TCPView program from Microsoft hosted website visit below website URL link.
"Download TCPView"
https://technet.microsoft.com/en-us/sysinternals/bb897437
Apologies.
Added the correct link/description 🤝
* - bobbobbybobman - Aug 31, 2015
Thanks I had this some time ago and couldn't find it because forgot the name.
* - Velozity™ - Aug 31, 2015
(Aug 31, 2015 07:04 PM)bobbobbybobman Wrote: Thanks I had this some time ago and couldn't find it because forgot the name.
My pleasure mate, enjoy. 🤝
* - freemium - Sep 1, 2015
yep good one, it has "who is" too :)
* - Velozity™ - Sep 3, 2015
Thanks guys for the excellent feedback