[SIM-3487621]

My dumbass ran a program which probably infected me. Any suggestions on how to find the virus if there actually is one?

[Bastille]

Check the running processes in the taskmanager, run Malwarebytes

[SIM-3487621]

Check the running processes in the taskmanager, run Malwarebytes

I've already done both. Processes look pretty normal to me and Malwarebytes found nothing.

[Bastille]

I've already done both. Processes look pretty normal to me and Malwarebytes found nothing.

I would say everything seems fine so

Avoid weird programs for the future

Have a nice day buddy

[Knautschtabak]

You already know the culprit that may have cause an infection. So what you can do is upload said program to a scanner service like Virustotal. Check which AV engine detects it. Use one of those engines to scan your system. The chance getting rid of the infection (if there is any by that file) is higher that way.

[SIM-3487621]

You already know the culprit that may have cause an infection. So what you can do is upload said program to a scanner service like Virustotal. Check which AV engine detects it. Use one of those engines to scan your system. The chance getting rid of the infection (if there is any by that file) is higher that way.

Virus Total scan
Virus total scan of some kind of program it opened
Its a open source rat. Anything suspicious in there?

[Bastille]

You intentionally ran a malware on your computer and then you come here to ask help ?

You are looking for help in the white hat section while you are attempting for black hat activities ?!!

May your computer die because of your stupidity

[Astonished]

Looks to me like you actually are infected and that you may have malicious files on your system but maybe not. This is what happens when you executed whatever it was

https://imgur.com/a/MubO6EX

Might want to double check your system friend unless you are aware that these things have happened

P.s > depends who you downloaded limeRat from. If its from nyancats' github page then its clean, if you downloaded from someone else it is most definitely NOT. I dont see why this has created a firewall exclusion or what its for so I doubt you have the legitimate version

[SIM-3487621]

You intentionally ran a malware on your computer and then you come here to ask help ?

You are looking for help in the white hat section while you are attempting for black hat activities ?!!

May your computer die because of your stupidity

How do you know this was intended for blackhat activities? Think before you post something

---

Looks to me like you actually are infected and that you may have malicious files on your system but maybe not. This is what happens when you executed whatever it was

https://imgur.com/a/MubO6EX

Might want to double check your system friend unless you are aware that these things have happened

P.s > depends who you downloaded limeRat from. If its from nyancats' github page then its clean, if you downloaded from someone else it is most definitely NOT. I dont see why this has created a firewall exclusion or what its for so I doubt you have the legitimate version

I did download it from nyan cats github page and did click on a button to add an exclusion to my firewall.

[Astonished]

How do you know this was intended for blackhat activities? Think before you post something

---

I did download it from nyan cats github page and did click on a button to add an exclusion to my firewall.

Then you're all good, nyan cat is a reputable member and creator of tools. All most all are widely used by script kiddies and people learning to create their own tools. You're all good

[Luffy-_-]

I'm not an expert or something but i have a small suggestion for you, i don't know if Bastille agree with me , everytime you download a suspicious file try to run it on a virtual machine first

[Bastille]

I'm not an expert or something but i have a small suggestion for you, i don't know if Bastille agree with me , everytime you download a suspicious file try to run it on a virtual machine first

Thanks to mention me on a white hat thread, however I'm not gonna help OP

Always useful to read the previous posts on a thread, please check above

[Knautschtabak]

Virus Total scan
Virus total scan of some kind of program it opened
Its a open source rat. Anything suspicious in there?

Well, you can weaken security of your system by running it, even if there is no backdoor in the code.
For this one the install locations depend on the settings:
--> installation routine is here: https://github.com/NYAN-x-CAT/Lime-RAT/b...llation.vb
--> default settings for the client: https://github.com/NYAN-x-CAT/Lime-RAT/b...ettings.vb

The default path of the malware in DEBUG mode is %TEMP%\Lime\Client.exe. Depending on what your settings were, you need to delete the file, then run Sysinternals Autoruns to remove the run entry (Software\Microsoft\Windows\CurrentVersion\Run\) or the task that references that file. The task is named LimeRAT-Admin no matter the settings.

[SIM-3487621]

I'm not an expert or something but i have a small suggestion for you, i don't know if Bastille agree with me , everytime you download a suspicious file try to run it on a virtual machine first

Thanks for your suggestion

---

Well, you can weaken security of your system by running it, even if there is no backdoor in the code.
For this one the install locations depend on the settings:
--> installation routine is here: https://github.com/NYAN-x-CAT/Lime-RAT/b...llation.vb
--> default settings for the client: https://github.com/NYAN-x-CAT/Lime-RAT/b...ettings.vb

The default path of the malware in DEBUG mode is %TEMP%\Lime\Client.exe. Depending on what your settings were, you need to delete the file, then run Sysinternals Autoruns to remove the run entry (Software\Microsoft\Windows\CurrentVersion\Run\) or the task that references that file. The task is named LimeRAT-Admin no matter the settings.

I found no file called "Client.exe" in the path you gave me and i had no task named "LimeRAT-Admin". So im guessing im good? Thanks for your help

[Knautschtabak]

That's because this is the default path in DEBUG mode. The file you ran likely used something else.

Please download Sysinternals Autoruns. Doubleclick autoruns.exe. Wait for a while until it has read everything. Click "File" -> "Save..." then choose "Save as type: Text (\*.txt)" and choose a location where you find it again.

Open the Autoruns log file and copy and paste the text file contents to pastebin.com. Click on "Create a new paste" then copy the link here.