[Anima Templi]

This is posted in the wrong section. We have different forum sections for a reason, please use them! Thread moved to "White Hat Base".

[Anima Templi]

This is posted in the wrong section. We have different forum sections for a reason, please use them! Thread moved to "White Hat Base".

[krislovesholly]

Go to run type: msconfig hit enter
then go to startup options and tell me if there is anything unusual running at the start up options that's were rat always ends up to the start up.
Let me know if you find anything unusual.

[nun4life]

Go to run type: msconfig hit enter
then go to startup options and tell me if there is anything unusual running at the start up options that's were rat always ends up to the start up.
Let me know if you find anything unusual.

Nope.avi nothing in there that I don't know i installed.

[noize]

Go to run type: msconfig hit enter
then go to startup options and tell me if there is anything unusual running at the start up options that's were rat always ends up to the start up.
Let me know if you find anything unusual.

Nope.avi nothing in there that I don't know i installed.

Servers can be hidden from msconfig and explorer too. DC, for instance, allows you to do so. Also, please note it may be disguised as something like WinUpdate, WinLogon or taskhost, in order to look legitimate.

All I'd dare to say (please, don't take for sure what I say), basing on what Coder-san gave too, as I still haven't checked it under VM, is that this it is a server binded with another file coded in C#. I also think you have Windows XP (I'm not a seer, please, correct me), and if this is a Nuclear RAT server (the name looks like a AntiNuke + server, maybe the user knew about AntiNuke and thought to disguise it this way adding a "server" to recognize it), it may be located under %windir%, system32 directory or %programfiles% under a subdirectory (of program files) with possibly any kind of name, default is NR.

Nuclear servers are able to relocate theirselves once installed, so you never know, but about what I was saying above, Nuclear servers are not able to hide theirselves in any way from explorer and msconfig, but they can change regedit entries and execute arbitrary code, maybe the client-user has done something about it.

Please note I never said this is Nuclear server, just speculated. If this is actually passed through Confuser 1.8 ( @Coder-san , how did you get to this? ) then it shouldn't be able to do any damage as long as (as far as I know), it is still and always FUD, but instead of being detected, becomes useless. I used Chrome Crypter 5.6 + Confuser 1.9 for some time, and worked superlatively. After some time, I could see it still fully undetectable, but not working anymore. That's the buzz; maybe I'm wrong, but I believe it won't do any damage if confused with 1.8.

P.S: you really got XP?

[nun4life]

Go to run type: msconfig hit enter
then go to startup options and tell me if there is anything unusual running at the start up options that's were rat always ends up to the start up.
Let me know if you find anything unusual.

Nope.avi nothing in there that I don't know i installed.

Servers can be hidden from msconfig and explorer too. DC, for instance, allows you to do so. Also, please note it may be disguised as something like WinUpdate, WinLogon or taskhost, in order to look legitimate.

All I'd dare to say (please, don't take for sure what I say), basing on what Coder-san gave too, as I still haven't checked it under VM, is that this it is a server binded with another file coded in C#. I also think you have Windows XP (I'm not a seer, please, correct me), and if this is a Nuclear RAT server (the name looks like a AntiNuke + server, maybe the user knew about AntiNuke and thought to disguise it this way adding a "server" to recognize it), it may be located under %windir%, system32 directory or %programfiles% under a subdirectory (of program files) with possibly any kind of name, default is NR.

Nuclear servers are able to relocate theirselves once installed, so you never know, but about what I was saying above, Nuclear servers are not able to hide theirselves in any way from explorer and msconfig, but they can change regedit entries and execute arbitrary code, maybe the client-user has done something about it.

Please note I never said this is Nuclear server, just speculated. If this is actually passed through Confuser 1.8 ( @Coder-san , how did you get to this? ) then it shouldn't be able to do any damage as long as (as far as I know), it is still and always FUD, but instead of being detected, becomes useless. I used Chrome Crypter 5.6 + Confuser 1.9 for some time, and worked superlatively. After some time, I could see it still fully undetectable, but not working anymore. That's the buzz; maybe I'm wrong, but I believe it won't do any damage if confused with 1.8.

P.S: you really got XP?

No, I don't have XP I have windows 7. I have seen dwm.exe*32 and just dwm.exe be for, i have a 64 bit system so could it be the dwm.exe*32?

[noize]

Go to run type: msconfig hit enter
then go to startup options and tell me if there is anything unusual running at the start up options that's were rat always ends up to the start up.
Let me know if you find anything unusual.

Nope.avi nothing in there that I don't know i installed.

Servers can be hidden from msconfig and explorer too. DC, for instance, allows you to do so. Also, please note it may be disguised as something like WinUpdate, WinLogon or taskhost, in order to look legitimate.

All I'd dare to say (please, don't take for sure what I say), basing on what Coder-san gave too, as I still haven't checked it under VM, is that this it is a server binded with another file coded in C#. I also think you have Windows XP (I'm not a seer, please, correct me), and if this is a Nuclear RAT server (the name looks like a AntiNuke + server, maybe the user knew about AntiNuke and thought to disguise it this way adding a "server" to recognize it), it may be located under %windir%, system32 directory or %programfiles% under a subdirectory (of program files) with possibly any kind of name, default is NR.

Nuclear servers are able to relocate theirselves once installed, so you never know, but about what I was saying above, Nuclear servers are not able to hide theirselves in any way from explorer and msconfig, but they can change regedit entries and execute arbitrary code, maybe the client-user has done something about it.

Please note I never said this is Nuclear server, just speculated. If this is actually passed through Confuser 1.8 ( @Coder-san , how did you get to this? ) then it shouldn't be able to do any damage as long as (as far as I know), it is still and always FUD, but instead of being detected, becomes useless. I used Chrome Crypter 5.6 + Confuser 1.9 for some time, and worked superlatively. After some time, I could see it still fully undetectable, but not working anymore. That's the buzz; maybe I'm wrong, but I believe it won't do any damage if confused with 1.8.

P.S: you really got XP?

No, I don't have XP I have windows 7. I have seen dwm.exe*32 and just dwm.exe be for, i have a 64 bit system so could it be the dwm.exe*32?

Well, dwm stands for Desktop Window(s) Manager, the *32 after it means the file is meant for 32-bit systems, but as 64-bit computers can handle 32-bit software too (though, not vice-versa), that software works fine. It is not normal stuff to see that for system software, as for 64-bit OSs I at least expect to find 64-bit-designed software; in fact, no original system files usually have that.

Right click the process and choose "Open file path". Have a look at its location and size. I suppose you're running Windows on C: drive, so it should be "C:\Windows\System32\dwm.exe" and 120.320 bytes (117/8 KBs - depends on rounding).

Surely it is not Nuclear RAT, however, as it doesn't stand on Windows 7.

[Coder-san]

Well if you just want to remove it then it's probably no big deal. PM me and we could have a teamviewer session.
Or if you want to try on your own then download Autoruns, and it will show you every startup entry that exists other than Software\Microsoft\Active Setup\Installed components
Or you can just go to safe-mode, no startup-entries will work now. So recheck msconfig, yes there is a way to hide msconfig entries but only after the program has started.

Fortunately enough, most malwares are amateur and can be removed in a few minutes without reinstalling OS or System restore (some can even bypass that).

[noize]

Well if you just want to remove it then it's probably no big deal. PM me and we could have a teamviewer session.
Or if you want to try on your own then download Autoruns, and it will show you every startup entry that exists other than Software\Microsoft\Active Setup\Installed components
Or you can just go to safe-mode, no startup-entries will work now. So recheck msconfig, yes there is a way to hide msconfig entries but only after the program has started.

Fortunately enough, most malwares are amateur and can be removed in a few minutes without reinstalling OS or System restore (some can even bypass that).

My hears have heard legendary tales of malwares who used to bypass good old system restores. That's tough stuff!

Also, nun, I'd suggest to let our Coder have a TeamViewer sesh with your PC, he'll surely be able to easily remove whatsoever.

[Coder-san]

Well I can't do much in teamviewer, as safemode would be the best place to remove malwares, and teamviewer won't work in that.
You can start safe-mode with networking but it's not very safe imo.
Perhaps we can follow the standard procedure of HiJackThis log, etc.