Aug 22, 2015 07:07 PM
(This post was last modified: Sep 6, 2015 06:29 AM by Yakz.)
This thread is for all the new users in this board, if you have come into contact with this user: "Lanchester" (UID: 2846080) and went on his Teamspeak (and downloaded a plugin) you should immediately scan/check your system and see if you have been infected.
![[Image: 5313944ce071536ef7a7d505e7546542.png]](https://i.gyazo.com/5313944ce071536ef7a7d505e7546542.png)
If you think you might be infected in general or wish to know what to do if it ever came to that, this thread is also for you!
Tools used.
How can i easily check if i'm infected?
1. Run a scan on your system.
2. Check out a few well known spreading methods (in his case teamspeak) and determine whether or not you fell for it.
3. Look if any files, accounts, .. are missing.
4. If you noticed suspicious things happening such as webcam light, mouse moving, random typing, weird piano sounds or voices, ect..
5. Check your system manually for a suspicious file or connection (explained below)
I actually think i got infected by that person (or other person)!
Don't worry, we are going to get rid of the intruder. First go to Windows start and type in "cmd", command prompt should show up in the list, right click it and select "run as administrator". Command prompt should now open.
Now that cmd prompt is open there's one last thing we should do as preparation to make our life easier.
Close all programs that are connected with the internet (browsers, skype, steam, ect..) You may even go as far as closing all programs that are connected to the internet for updating purposes.
Once you think most is closed you want to open cmd prompt and type in the following..
As you can see a list of connections will appear, this will probably not be much since you closed most programs connected to the internet, now it'll be easier to spot the stub.
(Click to View)
Go through the list and look for a filename that looks odd or that you think you have downloaded recently and shouldn't be having an active connection.
Once you found the program in the list you want remember the name, write down the ip connected to it and immediately pull out your internet cable (closing your internet connection).
Open your AV and run a scan on your system, if a virus comes up, get it removed. When all is removed put in your internet cable and download Comodo, if you already have comodo, restart your computer.
Now when you restart your computer comodo should tell you every incoming and outgoing connection upon starting your computer, if you see any connection that could be from a RAT it means that it was not successfully removed and that the stub is probably either run-time or scan-time crypted. If you don't see anything suspicious and the rat is removed, congrats!
For those who didn't succeed by trying the previous, don't worry you have a few options left, lets go through them.
Remember we wrote down the name of the stub when using netstat earlier? Look for that file on your system and upload it to virustotal, this will result in the stub being detected and the file being removed once you run a new scan, note that it's smart to keep your internet use minimal during the time AV's update and the stub gets detected. (You can find the file by partially following the steps below)
If you're more of a hands on person and don't want to sit around waiting and rather do everything yourself, you can do the following..
Open msconfig and go to the "Startup" tab, you should see the following..
(Click to View)
Look for a program that looks suspicious by keeping an eye on "startup item" and "manufacturer" if the startup item is a weird name and the manufacturer is unknown it may be a RAT. To be sure keep looking and if nothing else looks out of the ordinary, uncheck all files (if they're checked) and select the suspicious file you spotted earlier and click on "disable all". Make sure you write down the name and location of the suspected stub!
Now go to the "boot" tab and select safe mode.
(Click to View)
What you do next is run msconfig in safemode, if the rat is persistent it'll still be in the list but it WON'T be running since we are in safemode atm. Now it's just a matter of finding the source.
Make sure you're still in safemode and open "Regedit" (make sure you have "show hidden files and folders" enabled or you won't find it)
If you successfully opened regedit you should be looking at something like this..
(Click to View)
Remember we also were able to see the file location back in msconfig? Look at the file location again (in msconfig) and navigate to it (in regedit).
The location should somewhat look like this..
If you navigated to the location correctly you should be seeing this..
(Click to View)
You should now have spotted the file (you saw in msconfig) in this list. If not look at the location again and make sure it's the correct one.
Now right click on the stub and click modify and you should see this..
(Click to View)
Now if you're not completely sure if it is indeed the stub, put a ":" or something infront of it to disable it but still have it on your system (in case it's something else).
If you are sure it's the stub, you can completely delete it instead of modifying.
(Click to View)
To make sure it's gone go back to msconfig and see if it's in the startup list, it should be completely gone now, if not you did something wrong in previous steps and you should go over it again or just following the previous method.
Now for the last step we are going to download CCleaner and scan for issues in our registry. Hit the "registery" tab and click on "scan for issues", you should see something like this..
Spoiler (Click to View)
When all is done, hit "Fix selected issues" and you should be done.
Hope this was useful to any of you who dealt with Lanchester or think they're infected or want to know what to do if it ever came to that.
Remember, always stay secure and think twice before blindly opening files.
Peace & much love ✌
Kush.
If you think you might be infected in general or wish to know what to do if it ever came to that, this thread is also for you!
Tools used.
- Regedit
- Netstat
- msconfig
- CCleaner
- Comodo
- AV software
How can i easily check if i'm infected?
1. Run a scan on your system.
2. Check out a few well known spreading methods (in his case teamspeak) and determine whether or not you fell for it.
3. Look if any files, accounts, .. are missing.
4. If you noticed suspicious things happening such as webcam light, mouse moving, random typing, weird piano sounds or voices, ect..
5. Check your system manually for a suspicious file or connection (explained below)
I actually think i got infected by that person (or other person)!
Don't worry, we are going to get rid of the intruder. First go to Windows start and type in "cmd", command prompt should show up in the list, right click it and select "run as administrator". Command prompt should now open.
Now that cmd prompt is open there's one last thing we should do as preparation to make our life easier.
Close all programs that are connected with the internet (browsers, skype, steam, ect..) You may even go as far as closing all programs that are connected to the internet for updating purposes.
Once you think most is closed you want to open cmd prompt and type in the following..
Code
netstat -bAs you can see a list of connections will appear, this will probably not be much since you closed most programs connected to the internet, now it'll be easier to spot the stub.
(Click to View)
![[Image: cb40fb4b9ff932808ea60ca7436f347d.png]](https://i.gyazo.com/cb40fb4b9ff932808ea60ca7436f347d.png)
Go through the list and look for a filename that looks odd or that you think you have downloaded recently and shouldn't be having an active connection.
Once you found the program in the list you want remember the name, write down the ip connected to it and immediately pull out your internet cable (closing your internet connection).
Open your AV and run a scan on your system, if a virus comes up, get it removed. When all is removed put in your internet cable and download Comodo, if you already have comodo, restart your computer.
Now when you restart your computer comodo should tell you every incoming and outgoing connection upon starting your computer, if you see any connection that could be from a RAT it means that it was not successfully removed and that the stub is probably either run-time or scan-time crypted. If you don't see anything suspicious and the rat is removed, congrats!
For those who didn't succeed by trying the previous, don't worry you have a few options left, lets go through them.
Remember we wrote down the name of the stub when using netstat earlier? Look for that file on your system and upload it to virustotal, this will result in the stub being detected and the file being removed once you run a new scan, note that it's smart to keep your internet use minimal during the time AV's update and the stub gets detected. (You can find the file by partially following the steps below)
If you're more of a hands on person and don't want to sit around waiting and rather do everything yourself, you can do the following..
Open msconfig and go to the "Startup" tab, you should see the following..
(Click to View)
![[Image: 3f3a78ccd1c7300d8dfdba0f9145e11e.png]](https://i.gyazo.com/3f3a78ccd1c7300d8dfdba0f9145e11e.png)
Look for a program that looks suspicious by keeping an eye on "startup item" and "manufacturer" if the startup item is a weird name and the manufacturer is unknown it may be a RAT. To be sure keep looking and if nothing else looks out of the ordinary, uncheck all files (if they're checked) and select the suspicious file you spotted earlier and click on "disable all". Make sure you write down the name and location of the suspected stub!
Now go to the "boot" tab and select safe mode.
(Click to View)
![[Image: fac952f9d89ba2077dfacda59236fcca.png]](https://i.gyazo.com/fac952f9d89ba2077dfacda59236fcca.png)
What you do next is run msconfig in safemode, if the rat is persistent it'll still be in the list but it WON'T be running since we are in safemode atm. Now it's just a matter of finding the source.
Make sure you're still in safemode and open "Regedit" (make sure you have "show hidden files and folders" enabled or you won't find it)
If you successfully opened regedit you should be looking at something like this..
(Click to View)
![[Image: 8d46fca4c84082b29d5490aeb84a805a.png]](https://i.gyazo.com/8d46fca4c84082b29d5490aeb84a805a.png)
Remember we also were able to see the file location back in msconfig? Look at the file location again (in msconfig) and navigate to it (in regedit).
The location should somewhat look like this..
Code
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\...If you navigated to the location correctly you should be seeing this..
(Click to View)
![[Image: 351a8aa8fc675674c115c18eb3a794eb.png]](https://i.gyazo.com/351a8aa8fc675674c115c18eb3a794eb.png)
You should now have spotted the file (you saw in msconfig) in this list. If not look at the location again and make sure it's the correct one.
Now right click on the stub and click modify and you should see this..
(Click to View)
![[Image: 4b280fe36c2bc4e6a65a3232900f9501.png]](https://i.gyazo.com/4b280fe36c2bc4e6a65a3232900f9501.png)
Now if you're not completely sure if it is indeed the stub, put a ":" or something infront of it to disable it but still have it on your system (in case it's something else).
If you are sure it's the stub, you can completely delete it instead of modifying.
(Click to View)
![[Image: 88ec49ad086ce684821c2007e1d3ab41.png]](https://i.gyazo.com/88ec49ad086ce684821c2007e1d3ab41.png)
To make sure it's gone go back to msconfig and see if it's in the startup list, it should be completely gone now, if not you did something wrong in previous steps and you should go over it again or just following the previous method.
Now for the last step we are going to download CCleaner and scan for issues in our registry. Hit the "registery" tab and click on "scan for issues", you should see something like this..
Spoiler (Click to View)
![[Image: 2b6530992bfd2b9439737449d0cf84d3.png]](https://i.gyazo.com/2b6530992bfd2b9439737449d0cf84d3.png)
When all is done, hit "Fix selected issues" and you should be done.
Hope this was useful to any of you who dealt with Lanchester or think they're infected or want to know what to do if it ever came to that.
Remember, always stay secure and think twice before blindly opening files.
Peace & much love ✌
Kush.
Never ignorant getting goals accomplished.
![[Image: 1801a69d9f.gif]](https://puu.sh/xeCgR/1801a69d9f.gif)
![[Image: 4cffUl5.jpg?1]](https://i.imgur.com/4cffUl5.jpg?1)
![[Image: boostdroid-signature.gif]](https://boostdroid.com/assets/images/boostdroid-signature.gif)
