Spoof Call and Spoof SMS set any caller ◆ Traffic service & campaign optimization ◆ Cheap KYC Verifications & Openups ◆ Anvilpoint CyberOps - Hacker for Hire ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Whitehat • Blue Team • Defensive Security Malware, Rat, and Virus Removal › How to find and remove a rat on your pc without having to fac reset?

New Reply 

How to find and remove a rat on your pc without having to fac reset?
stimpyyoutube
stimpyyoutube Offline
[n00b@HF:]
*
Registered
Posts:
42
Threads:
25
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jan 15, 2017 05:00 PM
How to find and remove a rat on your pc without having to fac reset?
SoulZeh
SoulZeh Offline
King Skull
**********
King Skull
Posts:
9,907
Threads:
314
Credibility:
500
Popularity:
1,623
βytes:
β 8.5
Game XP:
71,924
Jan 15, 2017 05:20 PM
Run a scan of Malwarebytes and it should detect if you have a virus.
P.E.Investigations
P.E.Investigations Offline
[user@HF:]
**
HF l33t
Posts:
115
Threads:
26
Credibility:
000
Popularity:
8
βytes:
β 0
Game XP:
0
Jan 15, 2017 08:06 PM
I know Malwarebytes is very good but I also know that it does not detect newly and effectively cryped RATs.

How can I search for RATs if I think I have been RATed?
If possible, I would like to do this search without downloading and installing software I do not know.
Is there an (easy to follow) manual or run down list I can refer too?

Thanks.
LS RX7
LS RX7 Offline
[user@HF:]
**
HF l33t
Posts:
431
Threads:
12
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jan 15, 2017 08:08 PM
have you tried security task manager? I think it works for a lot of stuff.
P.E.Investigations
P.E.Investigations Offline
[user@HF:]
**
HF l33t
Posts:
115
Threads:
26
Credibility:
000
Popularity:
8
βytes:
β 0
Game XP:
0
Jan 15, 2017 08:47 PM
Thank you. Screen shots look similar to Processes from Task manager and Resource Monitor plus a rating they provide.

What would be involved if I want to see the DNS or IP address the RAT is broadcasting to? That information must be in the RAT and also show up somewhere in the lists of connections, no?
๖ۣۜÑåzgйŀ
๖ۣۜÑåzgйŀ Away
[bin@HF:]
***
HF Ub3r
Posts:
4,036
Threads:
20
Credibility:
400
Popularity:
200
βytes:
β 780.7
Game XP:
0
Jan 15, 2017 09:14 PM (This post was last modified: Jan 19, 2017 05:02 PM by ๖ۣۜÑåzgйŀ.)
use process explorer and TCPview to find and remove malware manually
Farbar Recovery Scan is another great tool to use (however it does not list network activity)
or use process hacker (the name might sound odd but it's great open source software)
removing malware manually allows you to find new malware which an Anti-virus won't detect

you can use wireshark for finding the DNS adress and also for finding the server that a keylogger will send it's logs

however you should have an anti-rootkit scanner avaible on your system at all times
some malware can hide themselves from the entire system
WRX
WRX Offline
Loyalty is a two way street
****
HF Ub3r
Posts:
6,734
Threads:
494
Credibility:
800
Popularity:
322
βytes:
β 0
Game XP:
617
Jan 15, 2017 09:18 PM
Do you know anything about what your computer usually runs and the names of the programs you use?

If so you can remove these pretty easily manually.

I would talk to Aura he really knows his shit
Signature for sale:

$10 week, $35 month.

PP, BTC, Bytes
๖ۣۜÑåzgйŀ
๖ۣۜÑåzgйŀ Away
[bin@HF:]
***
HF Ub3r
Posts:
4,036
Threads:
20
Credibility:
400
Popularity:
200
βytes:
β 780.7
Game XP:
0
Jan 15, 2017 09:26 PM
(Jan 15, 2017 08:06 PM)P.E.Investigations Wrote:  How can I search for RATs if I think I have been RATed?
If possible, I would like to do this search without downloading and installing software I do not know.
Is there an (easy to follow) manual or run down list I can refer too?

Thanks.

if you want I can help you with that
just PM me
combovirus
combovirus Offline
[user@HF:]
*
Registered
Posts:
137
Threads:
5
Credibility:
000
Popularity:
37
βytes:
β 0
Game XP:
24
Jan 16, 2017 01:58 AM
My method may look complicated but hope it is best one. Download and install process hacker and check all the established connection under network. If you find the rat then, with this you directly go process and delete the root file of rat even if it is protected.
Hackoo
Hackoo Offline
[bin@HF:]
***
HF l33t
Posts:
2,407
Threads:
146
Credibility:
000
Popularity:
242
βytes:
β 0
Game XP:
0
Jan 16, 2017 03:03 AM
Farbar Recovery Scan Tool (FRST) Scan
  • Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
  • Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
  • Double-Click FRST.exe or FRST64.exe to run the programme
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the program run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste them to pastebin.com. Post the link here.
In your next reply I get from you
  • FRST.txt
  • Addition.txt
Create a shortcut with admin rights for the current vbscript or any other application
P.E.Investigations
P.E.Investigations Offline
[user@HF:]
**
HF l33t
Posts:
115
Threads:
26
Credibility:
000
Popularity:
8
βytes:
β 0
Game XP:
0
Jan 16, 2017 11:06 PM
Thank you all. I downloaded three of the programs already and will do Farbar Recovery Scan Tool next too. I think I am not allowed to posts links yet so maybe I need to post the results as a thread.
Please continue to support me. Recently I had an error message in a foreign language appear so I think the RATer's OS language might not be English.
Aura
Aura Offline
[g0d@HF:]
******
HF Ub3r
Posts:
33,920
Threads:
533
Credibility:
000
Popularity:
655
βytes:
β 568.2
Game XP:
11
Jan 17, 2017 05:16 PM
You can always PM me the logs and I can check them (though I won't be providing a fixlist sadly).
Fiat justitia ruat cælum

My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
Sab4fa
Sab4fa Offline
[n00b@HF:]
*
Registered
Posts:
13
Threads:
3
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jan 20, 2017 09:45 AM (This post was last modified: Jan 20, 2017 09:46 AM by Sab4fa.)
(Jan 16, 2017 03:03 AM)Hackoo Wrote:  Farbar Recovery Scan Tool (FRST) Scan
  • Please download or and save the file to your Desktop.
  • Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
  • Double-Click FRST.exe or FRST64.exe to run the programme
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the program run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste them to pastebin.com. Post the link here.
In your next reply I get from you
  • FRST.txt
  • Addition.txt
DONT DOWNLOAD IT!!! ITS A VIRUS SOMEONE HACKED ME THROUGH IT!
This sameguy did it to me! please dont!
Hackoo
Hackoo Offline
[bin@HF:]
***
HF l33t
Posts:
2,407
Threads:
146
Credibility:
000
Popularity:
242
βytes:
β 0
Game XP:
0
Jan 20, 2017 10:08 AM (This post was last modified: Jan 20, 2017 05:35 PM by Hackoo.)
(Jan 20, 2017 09:45 AM)Sab4fa Wrote:  DONT DOWNLOAD IT!!! ITS A VIRUS SOMEONE HACKED ME THROUGH IT!
This sameguy did it to me! please dont!

What did you mean by that ?
Can you explain us more ? did you mean that FRST.exe is a virus ???? 😅 😅
Create a shortcut with admin rights for the current vbscript or any other application
Aura
Aura Offline
[g0d@HF:]
******
HF Ub3r
Posts:
33,920
Threads:
533
Credibility:
000
Popularity:
655
βytes:
β 568.2
Game XP:
11
Jan 20, 2017 05:21 PM
(Jan 20, 2017 09:45 AM)Sab4fa Wrote:  DONT DOWNLOAD IT!!! ITS A VIRUS SOMEONE HACKED ME THROUGH IT!
This sameguy did it to me! please dont!

FRST is a legitimate malware removal tool created by farbar. As long as you download it from BleepingComputer.com, it'll be safe. It is known for tools like this to trigger Antivirus and Antimalware programs, though they are false positives that can be safely ignored.
Fiat justitia ruat cælum

My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by A U R O R ADec 5, 2016 06:58 PM 7 316 Dec 5, 2016 06:58 PM
Last Post: GruntStyl
by CreateChaossMar 24, 2015 04:09 PM 14 273 Mar 24, 2015 04:09 PM
Last Post: CreateChaoss