How to remove a RAT 07-17-2013, 11:09 PM
#1
For this tutorial, I've RAT'd myself so you guys can see a somewhat "live", if you will, example of how a RAT can affect your PC.
So I crypted my RAT and added some disabled items to it, start up, etc.
http://scan4you.net/result.php?id=f9999_43lr2r as you c an see it's FUD.
http://gyazo.com/939b7e83ea1f521fbbd2e02...1365828355
http://gyazo.com/0a8e2c2c7d441ca79614ded...1365828384
http://gyazo.com/0f98cfa579b6b6a7d275f42...1365828406
As you can see they are all disabled. There's many ways you can approach this. Using msconfig if the file wasn't deleted or renamed. Running in Safe Mode. Using OTL, HJT, or CCleaner to view start up. However, I'm going to tackle this using .vbs scripts.
This doesn't work for all computers, however, it can work for most.
To enable registry: http://pspudupi.googlepages.com/RegSwitch.vbs
To enable CMD: http://pspudupi.googlepages.com/cmdSwitch.vbs
To enable task manager: http://pspudupi.googlepages.com/TaskmgrSwitch.vbs
So we'll go ahead and enable all of those again to let us gain access to the tools. But wait! What if the person whose controlling you is messing with you and you can't download the files? Well there's many ways to defeat this. The first way I thought up of was standing near the router and as soon as you finish downloading the files, unplug your router.
The .VBS scripts don't need internet to do their jobs. So as soon as you disconnect the router and have your files fully downloaded, you should be good.
Now that you've gotten the files, we run them! They're .VBS so you can always check the source codes to make sure they won't do anything harmful since it's basically almost like English. All you need is a small amount of knowledge and know that 0 = to false and 1 = true.
Let's take a look at the script.
As you can see, or if you can make sense of it, you'll be able to identify where it all is. In the beginning they define everything such as the file paths inside the registry editor. It also looks for the files default path in the system32. If it doesn't find the file, it'll tell you in a messagebox. If the CMD registry key is already set 1, which means true. If it is, then it will enable it because the regpath is "HKCU\Software\Policies\Microsoft\Windows\System\DisableCMD" So if it's already set to 1 that means it's enabled the disability of the CMD, if that makes sense lol. And vice versa for 0.
So now I ran the .VBS script and it came back with http://gyazo.com/037c79e26ec8e9a2c0cd8f9...1365829313
Now do this also for the registry and task manager, if they are too disabled.
So now, we've enabled the registry. First, let's take it off of start up. Now we can do this using mcsonfig, registry, or other programs that let you view start up. But we'll do it via registry.
So to check for start up, we'll need to look in several places, but firstly, we'll need to open it up. Go to the Start menu and type in "run" without the quotes. Then when the box comes up, type in "regedit" , again no quotes.
You can visit here for all the paths you should check : http://www.bleepingcomputer.com/tutorial...locations/
However most are under :
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
As you can see from the screenshot, there's one that sticks out. http://gyazo.com/d1393069872865e748540fa...1365829740
explorer.exe is found in the system32. Copy down the file path so you know for future reference to go to delete it. The fact that it's in the AppData folder makes it even more suspicious. Nothing else screams virus than programs that are needed to start up Windows that are in the AppData and/or Temp folders.
To delete the key, just right click it and hit "Delete"
Check all the other registry paths to be sure.
Now, restart Windows and plug your router back in to get internet connection. The RAT should not have been started up when you booted up Windows if you have taken it off all/any start up paths and folders.
Next, we delete the file.
The file from the start up was found in "C:\Users\Administrator\AppData\Roaming" So go to the start menu and type in "run" without the quotes. Then when the box comes up, type in the file path. Make sure to NOT INCLUDE the actual file (explorer.exe in this case). It will run the virus again.
When you open the folder, make sure you can view hidden files as some viruses like to edit that. If you aren't sure how check out this tutorial and select your operating system. http://www.bleepingcomputer.com/tutorial...n-windows/
Now that we can see the hidden files, look for the virus, explorer.exe for me. Right-click delete it. http://gyazo.com/3af8edd63e9e50dd901ee0f...365830552=
Now as a finally precaution, you can use any scanner, however, I recommend using Malwarebytes and do a full system scan. Delete any viruses that are found that you don't recognize if there are any.
After that, I recommend cleaning out your temp files and appdata folder, however you don't need to. You can use programs such as ATF-Cleaner and Temp File Cleaner to do this as well as CCleaner. However DO NOT use a registry cleaner as they can cause more harm that help.
There's plenty of other ways to remove a virus as well. You can always check your CMD and use the netstat commands to see what's connecting to the internet and through what process, etc.
Hope you've enjoyed this tutorial and if you need any assistance, let me know!
So I crypted my RAT and added some disabled items to it, start up, etc.
http://scan4you.net/result.php?id=f9999_43lr2r as you c an see it's FUD.
http://gyazo.com/939b7e83ea1f521fbbd2e02...1365828355
http://gyazo.com/0a8e2c2c7d441ca79614ded...1365828384
http://gyazo.com/0f98cfa579b6b6a7d275f42...1365828406
As you can see they are all disabled. There's many ways you can approach this. Using msconfig if the file wasn't deleted or renamed. Running in Safe Mode. Using OTL, HJT, or CCleaner to view start up. However, I'm going to tackle this using .vbs scripts.
This doesn't work for all computers, however, it can work for most.
To enable registry: http://pspudupi.googlepages.com/RegSwitch.vbs
To enable CMD: http://pspudupi.googlepages.com/cmdSwitch.vbs
To enable task manager: http://pspudupi.googlepages.com/TaskmgrSwitch.vbs
So we'll go ahead and enable all of those again to let us gain access to the tools. But wait! What if the person whose controlling you is messing with you and you can't download the files? Well there's many ways to defeat this. The first way I thought up of was standing near the router and as soon as you finish downloading the files, unplug your router.
The .VBS scripts don't need internet to do their jobs. So as soon as you disconnect the router and have your files fully downloaded, you should be good.
Now that you've gotten the files, we run them! They're .VBS so you can always check the source codes to make sure they won't do anything harmful since it's basically almost like English. All you need is a small amount of knowledge and know that 0 = to false and 1 = true.
Let's take a look at the script.
As you can see, or if you can make sense of it, you'll be able to identify where it all is. In the beginning they define everything such as the file paths inside the registry editor. It also looks for the files default path in the system32. If it doesn't find the file, it'll tell you in a messagebox. If the CMD registry key is already set 1, which means true. If it is, then it will enable it because the regpath is "HKCU\Software\Policies\Microsoft\Windows\System\DisableCMD" So if it's already set to 1 that means it's enabled the disability of the CMD, if that makes sense lol. And vice versa for 0.
Code:
'Enable/Disable Command Prompt
'By Prashanth Pai
'I have written this script to enable\disable 'cmd' in case a virus or trojan disables it.
Option Explicit
Dim WSHShell, read1, read2, lol, prash1, prash2, header, flag, fuck, regtype, WshSysEnv, path, flag2, shit
On Error Resume Next
Set WSHShell = WScript.CreateObject("WScript.Shell")
Set WshSysEnv = WshShell.Environment("PROCESS")
path = WshSysEnv("WINDIR") & "\SYSTEM32\CMD.EXE"
flag2 = ReportFileStatus(path)
prash1 = "HKCU\Software\Policies\Microsoft\Windows\System\DisableCMD"
prash2 = "HKLM\Software\Policies\Microsoft\Windows\System\DisableCMD"
regtype = "REG_DWORD"
fuck = "Command Prompt (cmd) is now "
header = "cmdSwitch by Prashanth Pai"
If (flag2=0) Then shit = MsgBox("Are you kidding me ?" & vbCr & path & " file is missing or does not exist." & vbCr & "This script will now quit without making any changes.",48,header) : WshShell.LogEvent 1, header & " couldn't find the file " & path : Wscript.Quit
read1 = WSHShell.RegRead (prash1)
read2 = WSHShell.RegRead (prash2)
flag=1
If (read1=1 or read2=1) Then flag=0
If flag = 1 Then
WSHShell.RegWrite prash1, 1, regtype
WSHShell.RegWrite prash2, 1, regtype
lol = MsgBox(fuck & "DISABLED", 64, header)
WshShell.LogEvent 0, header & " has successfully DISABLED cmd.exe access."
Else
WSHShell.RegDelete prash1
WSHShell.RegDelete prash2
lol = MsgBox(fuck & "ENABLED.", 64, header)
WshShell.LogEvent 0, header & " has successfully ENABLED cmd.exe access."
End If
Function ReportFileStatus(filespec)
Dim fso, msg, flag2
Set fso = CreateObject("Scripting.FileSystemObject")
If (fso.FileExists(filespec)) Then
flag2 = 1
Else
flag2 = 0
End If
ReportFileStatus = flag2
End FunctionSo now I ran the .VBS script and it came back with http://gyazo.com/037c79e26ec8e9a2c0cd8f9...1365829313
Now do this also for the registry and task manager, if they are too disabled.
So now, we've enabled the registry. First, let's take it off of start up. Now we can do this using mcsonfig, registry, or other programs that let you view start up. But we'll do it via registry.
So to check for start up, we'll need to look in several places, but firstly, we'll need to open it up. Go to the Start menu and type in "run" without the quotes. Then when the box comes up, type in "regedit" , again no quotes.
You can visit here for all the paths you should check : http://www.bleepingcomputer.com/tutorial...locations/
However most are under :
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
As you can see from the screenshot, there's one that sticks out. http://gyazo.com/d1393069872865e748540fa...1365829740
explorer.exe is found in the system32. Copy down the file path so you know for future reference to go to delete it. The fact that it's in the AppData folder makes it even more suspicious. Nothing else screams virus than programs that are needed to start up Windows that are in the AppData and/or Temp folders.
To delete the key, just right click it and hit "Delete"
Check all the other registry paths to be sure.
Now, restart Windows and plug your router back in to get internet connection. The RAT should not have been started up when you booted up Windows if you have taken it off all/any start up paths and folders.
Next, we delete the file.
The file from the start up was found in "C:\Users\Administrator\AppData\Roaming" So go to the start menu and type in "run" without the quotes. Then when the box comes up, type in the file path. Make sure to NOT INCLUDE the actual file (explorer.exe in this case). It will run the virus again.
When you open the folder, make sure you can view hidden files as some viruses like to edit that. If you aren't sure how check out this tutorial and select your operating system. http://www.bleepingcomputer.com/tutorial...n-windows/
Now that we can see the hidden files, look for the virus, explorer.exe for me. Right-click delete it. http://gyazo.com/3af8edd63e9e50dd901ee0f...365830552=
Now as a finally precaution, you can use any scanner, however, I recommend using Malwarebytes and do a full system scan. Delete any viruses that are found that you don't recognize if there are any.
After that, I recommend cleaning out your temp files and appdata folder, however you don't need to. You can use programs such as ATF-Cleaner and Temp File Cleaner to do this as well as CCleaner. However DO NOT use a registry cleaner as they can cause more harm that help.
There's plenty of other ways to remove a virus as well. You can always check your CMD and use the netstat commands to see what's connecting to the internet and through what process, etc.
Hope you've enjoyed this tutorial and if you need any assistance, let me know!
![[Image: rYBC5OE.gif]](http://i.imgur.com/rYBC5OE.gif)
![[+]](https://sinister.ly/images/modern/collapse_collapsed.png)
![[Image: tumblr_m4vms28lYu1qj3ir1.gif]](http://media.tumblr.com/tumblr_m4vms28lYu1qj3ir1.gif)
![[Image: sasuke_akatsuki_robes_by_giiinger-d6gy0yi.png]](http://fc00.deviantart.net/fs70/f/2013/218/9/6/sasuke_akatsuki_robes_by_giiinger-d6gy0yi.png)
