[Cake]

Before you start I recommend just Downloading dark comet remover in case the scrub rating you is using DC.

If you pirate your software then I recommend just backing up your files on a flash drive or external HDD and formatting.

Okay so if you don't want to do that here is how I would recommend getting rid of a rat.

Okay First off you want to start by Cleaning your temp files.
You can do it manually or use this:

Spoiler:

http://amtsc.com/OldTimer/TFC.exe

Open up your task manager and see if there is a random program running in the backround. Now if you try to end it, it will just keep coming back so right click on it and set the permissions. Deny it of everything then end the process. You are now going to need to locate where it is.
The most common places for a rat are:

1. Favs#\
   
2. MyDocs#\
   
3. MyProg#\
   
4. Start#\
   
5. Cookie#\
   
6. Desktop#\
   
7. Temp#\
   
8. HDD#\
   
9. WinDin#\
   
10. Sys32#\
    
11. App#\
    

When you're in there look for files with icons similar to these:

Spoiler:

Those are all common rat icons. Delete Files AFTER you determine they are what you suspect.

The last few steps are going to be cleaning up the trail so your computers speed isn't effected by the rat still.

Download CCleaner:

Spoiler:

http://www.piriform.com/ccleaner

Okay With CCleaner we are going to clean all TEMP files with the "Cleaner"

Spoiler:

Now in CCleaner you want to navigate to the registry tab and clean that
NOTE: I always recommend making a backup .reg.

Spoiler:

*Click Fix All Selected Issues*

Now go to your start menu and type

Code:

msconfig.exe

and open it.
Navigate the the Startup and Services tabs and make sure the malicious software isn't selected to start with startup.

Spoiler:

You can also disable any thing you don't want to start up when you're there to make your pc boot faster.

last but not least if you didn't solve your problem download malware bytes and give it a shot or find some bot kills online.

I hope this tutorial helps some of you!
Thanks/+Rep is HIGHLY APPRECIATED for this detailed tutorial.

[Redbull]

Nice Tutorial, I'm sure this well help a lot of people out there.

[Banadmin]

It's a great help that you've actually listed the folders where a RAT can be found, but could it possibly be found anywhere on your computer's hard drive?

We just need a thread now explaining what exactly RATs are.

[Cake]

It's a great help that you've actually listed the folders where a RAT can be found, but could it possibly be found anywhere on your computer's hard drive?

We just need a thread now explaining what exactly RATs are.

I will make a thread explaining what a rat is and the possibilities are endless but most people put them in those folders and 90% of the time you want to thoroughly got hrough each and every folder in your appdata.

[Harvey]

Are you qualified to use TFC? Are you a member of AMTSC? And why do you recommend using CCleaner? I thought we outlawed that years ago. :p

[Cake]

Are you qualified to use TFC? Are you a member of AMTSC? And why do you recommend using CCleaner? I thought we outlawed that years ago. :p

Not sure if trolling or what ._.

[Soup_DZ]

I suggest to clear your temp file after you clean up the virus issue. And also, a lot of viruses don't use those icons. Most of them melt on execution and hide themselves in various locations with persistence on. This will only remove some obvious infections.

[Cake]

I suggest to clear your temp file after you clean up the virus issue. And also, a lot of viruses don't use those icons. Most of them melt on execution and hide themselves in various locations with persistence on. This will only remove some obvious infections.

You have to run the virus for it to embed itself in the first place. Unless it's a java drive by so get it right
Also it's easy to disable persistence by removing all permission from the stub. If it is a crypted stub it WILL be visible in you task manager. You can also go into your register to look for a start up key from the stub. I know what i'm talking about.

[Soup_DZ]

I suggest to clear your temp file after you clean up the virus issue. And also, a lot of viruses don't use those icons. Most of them melt on execution and hide themselves in various locations with persistence on. This will only remove some obvious infections.

You have to run the virus for it to embed itself in the first place. Unless it's a java drive by so get it right
Also it's easy to disable persistence by removing all permission from the stub. If it is a crypted stub it WILL be visible in you task manager. You can also go into your register to look for a start up key from the stub. I know what i'm talking about.

Well of course you have to run it unless it's a JDB. How else would it infect your system .__.;?
I don't think you understand some features that crypters have nowdays. I know what I'm talking about. I RAT. I have my own installs and my own infections. Honestly, I doubt you know what you're talking about.

You do realize that your registry will most likely be disabled, right? The crypted stub will be visible in the task manager, yeah. But you do know it hides itself and clones a process right?

[Cake]

I suggest to clear your temp file after you clean up the virus issue. And also, a lot of viruses don't use those icons. Most of them melt on execution and hide themselves in various locations with persistence on. This will only remove some obvious infections.

You have to run the virus for it to embed itself in the first place. Unless it's a java drive by so get it right
Also it's easy to disable persistence by removing all permission from the stub. If it is a crypted stub it WILL be visible in you task manager. You can also go into your register to look for a start up key from the stub. I know what i'm talking about.

Well of course you have to run it unless it's a JDB. How else would it infect your system .__.;?
I don't think you understand some features that crypters have nowdays. I know what I'm talking about. I RAT. I have my own installs and my own infections. Honestly, I doubt you know what you're talking about.

You do realize that your registry will most likely be disabled, right? The crypted stub will be visible in the task manager, yeah. But you do know it hides itself and clones a process right?

Yes and most of the time is hides itself in explorer.exe ._. I also rat.