[๖ۣۣۜۜIvNet™]

CLOSED, please delete.
CLOSED, please delete.
CLOSED, please delete.
CLOSED, please delete.
CLOSED, please delete.
CLOSED, please delete.

[Pendalum]

Great tutorial you dork keep it up ;]

[๖ۣۣۜۜIvNet™]

Great tutorial you dork keep it up ;]

Thanks, I actully just picked this up from a tutorial on how to see your startup and testing around with my RAT

[kambatta]

You didn't address the persistence part of the problem. It does not matter if you delete the entry from the startup or delete the executable from the location. Until you have dealt with its persistence files, they will keep coming back.

[๖ۣۣۜۜIvNet™]

You didn't address the persistence part of the problem. It does not matter if you delete the entry from the startup or delete the executable from the location. Until you have dealt with its persistence files, they will keep coming back.

Im not sure what you mean but I added if theres an error when deleting the source stop the process in task manager and then delete it.

[Stev]

Looks like a decent tutorial, but it belongs in the White Hat section.

[Jim Newman]

Thanks for this great tutorial should help many users on the forums. ✌

[๖ۣۣۜۜIvNet™]

Looks like a decent tutorial, but it belongs in the White Hat section.

Well its mostly about RAT's. But if admin decides its the wrong section then if they can move it would be great :)

[๖ۣۣۜۜIvNet™]

I got another method which I wont right. If you think you have a RAT and cant find it contact me.

[teonanacalt]

Good guide and information, very useful guide.
Nice tutorial, thanks OP...appreciate.

[Tiszy]

Nice tutorial, but keep in mind that there is binders around here, and you can also bind your server into a spesific proc., which means it can be binded with all proc., and then you can't use this methods :/ All the new rats does have this function.

But overall, nice tutorial.

[Vir2ListiX]

Nice tutorial for those who don't know or are new to this stuff.

[๖ۣۣۜۜIvNet™]

Nice tutorial, but keep in mind that there is binders around here, and you can also bind your server into a spesific proc., which means it can be binded with all proc., and then you can't use this methods :/ All the new rats does have this function.

But overall, nice tutorial.

True, I will make another thread in a couple days or so about detecting viruses. And other stuff.

[Wafflemonger]

Eh ... this tutorial is okay, but it won't remove the difficult RATs. Also, disconnecting your internet just stops the owner from connecting to the PC. The RAT doesn't need internet to stop you from opening up processes. Furthermore, as another poster has said, you didn't touch on the persistent factor. When you delete it, almost ALL RATs will re-add themselves and re-create themselves. Just deleting the .exe is almost pointless. Plus, there are legit processes that are those names you mentioned as well. Thanks for the most though :).