Sinisterly
Detecting RATs/Keyloggers installed on your PC using CMD and TaskManager. - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: Detecting RATs/Keyloggers installed on your PC using CMD and TaskManager. (/Thread-Detecting-RATs-Keyloggers-installed-on-your-PC-using-CMD-and-TaskManager)

Pages: 1 2 3 4 5 6 7

RE: Detecting RATs/Keyloggers installed on your PC using CMD and TaskManager. - 1234hotmaster - 09-07-2013

That works fine but Cain & Abel, Fiddler2, Process Hacker are worth mention-able for a faster and more efficient method Smile

RE: Detecting RATs/Keyloggers installed on your PC using CMD and TaskManager. - jmdcosta - 09-11-2013

Good tip.

Thanks man!

RE: Detecting RATs/Keyloggers installed on your PC using CMD and TaskManager. - diana32 - 09-11-2013

(02-09-2013, 03:12 AM)ArcaneFx Wrote: It's as easy as that.
Hope you find this useful.

-Arcane.cfg
Well is not bad ,and for the start -this is the right way to identify if you have malware on your computer.But .... there is a but - first of all -task manager don't show you all the process that are run,and some rat could dissalow this feature -i would add -to use the diagnostic program like process hacker and some program in the link below :
http://technet.microsoft.com/en-us/sysinternals/bb469930,
second - for you example i don't even watch what connection is establish since i see 127.0.0.1 as ip(127.0...1 is a home connection) - be carefull to explain that it could be a process running like you have the dropbox or like i have ,the kaspersky automatic update.If you kill a process that you see conection established may be some automatic update of av,sandboxies ,teamviewer connection thru internet - whit bad results.Is good for you to make a copy of the process every time when you install a new program and compare sometimes with the actual process running. You forgot to say that a malware running thru the feature printer and fax device sharing in internet -as countermeasure is to disallow this process going to lan icon -right click whith mouse -open network and sharing center -change adapter settings -go to your lan or wifi card -properties -and make sure to disallow the File and Printer Sharing for Microsoft Networks - in the middle box,and also the telnet .But , like i say is a good start for those how don't know how to identify a malware.

RE: Detecting RATs/Keyloggers installed on your PC using CMD and TaskManager. - RaccoonCity_mybb_import13707 - 09-24-2013

Real good tutorial! Thanks, I really like how you use screenshots, it makes it all look so much HQ and easier. Good work!

RE: Detecting RATs/Keyloggers installed on your PC using CMD and TaskManager. - rojahrabbit - 11-22-2013

going to give this a shot. I need to find the keylogger on my pc. Though i thought keyloggers were hidden and kept away from the processes?
(02-09-2013, 03:12 AM)ArcaneFx Wrote:
[Image: a6KviOY.png]
In this tutorial, I'll be showing you the easiest way of finding out malicious applications installed on your PC that transfer data using the internet without you knowing it.

As stated in the title, we'll be using TaskManager and CMD for the purposes of this tutorial.

[Image: EU1A3x6.png]
1. To get started, open up your TaskManager by right clicking your TaskBar and selecting TaskManager or just hit CTRL+ALT+DEL to get it open.

2. Once that is done, click the "Processes" tab of your TaskManager and click View -> Select Columns -> Make sure that "Process Identifier(PID)" is ticked.

[Image: So5iBIG.png]

3. Now click the PID column to make sure that all the processes are sorted in a specific order. This step is not necessary, but it will make it easier for you to detect processes using their IDs.

[Image: Iz3VtpJ.png]

[Image: pmv2ItE.png]
Once you've done that right, we're going to move on to part 2 of our tutorial, which is using CMD to view established connections.

Assuming you know how to open up CMD, I'm just going to rush through step 1.
1. Start -> Run -> CMD
OR
Just type in cmd in the searchbar if you're running a system powered by Windows7.

2. Once cmd is open, I want you to type in "netstat -ano".
Your result should be something like this:
[Image: 75xp0C4.png]

3. Now what we're interested in are only the connections with the state "ESTABLISHED".
Isolate them out and look for the PID right next to them. There will be many connections with "ESTABLISHED" state, you'll have to repeat the following steps for all of them.

[Image: 2U2fQNs.png]

This is the fun part. Now go back to the TaskManager and look for the name of the process(es) that has the same PID(s) as the one you found with the ESTABLISHED connection(s).

[Image: mSBPnZn.png]

In the above case, it's a safe and trusted application known as Dropbox, so I'm good. But incase you find a process which you do not know, if it's something like svchost.exe that you're sure is infected, right click the process and select "Open File Location".

Now all you have to do is right click the file and scan it using your AV or upload it to an online scanner such as VirusTotal.com and check if it's infected.

[Image: ycn4yyH.png]

It's as easy as that.
Hope you find this useful.

-Arcane.cfg

I found a established connection which the PID number IS NOT listed in the task manager, so how do i go about finding out what exactly it is that belongs to that PID # now? PM me please if you could.

RE: Detecting RATs/Keyloggers installed on your PC using CMD and TaskManager. - rojahrabbit - 11-22-2013

going to give this a shot. I need to find the keylogger on my pc. Though i thought keyloggers were hidden and kept away from the processes?
(02-09-2013, 03:12 AM)ArcaneFx Wrote:
[Image: a6KviOY.png]
In this tutorial, I'll be showing you the easiest way of finding out malicious applications installed on your PC that transfer data using the internet without you knowing it.

As stated in the title, we'll be using TaskManager and CMD for the purposes of this tutorial.

[Image: EU1A3x6.png]
1. To get started, open up your TaskManager by right clicking your TaskBar and selecting TaskManager or just hit CTRL+ALT+DEL to get it open.

2. Once that is done, click the "Processes" tab of your TaskManager and click View -> Select Columns -> Make sure that "Process Identifier(PID)" is ticked.

[Image: So5iBIG.png]

3. Now click the PID column to make sure that all the processes are sorted in a specific order. This step is not necessary, but it will make it easier for you to detect processes using their IDs.

[Image: Iz3VtpJ.png]

[Image: pmv2ItE.png]
Once you've done that right, we're going to move on to part 2 of our tutorial, which is using CMD to view established connections.

Assuming you know how to open up CMD, I'm just going to rush through step 1.
1. Start -> Run -> CMD
OR
Just type in cmd in the searchbar if you're running a system powered by Windows7.

2. Once cmd is open, I want you to type in "netstat -ano".
Your result should be something like this:
[Image: 75xp0C4.png]

3. Now what we're interested in are only the connections with the state "ESTABLISHED".
Isolate them out and look for the PID right next to them. There will be many connections with "ESTABLISHED" state, you'll have to repeat the following steps for all of them.

[Image: 2U2fQNs.png]

This is the fun part. Now go back to the TaskManager and look for the name of the process(es) that has the same PID(s) as the one you found with the ESTABLISHED connection(s).

[Image: mSBPnZn.png]

In the above case, it's a safe and trusted application known as Dropbox, so I'm good. But incase you find a process which you do not know, if it's something like svchost.exe that you're sure is infected, right click the process and select "Open File Location".

Now all you have to do is right click the file and scan it using your AV or upload it to an online scanner such as VirusTotal.com and check if it's infected.

[Image: ycn4yyH.png]

It's as easy as that.
Hope you find this useful.

-Arcane.cfg

I found a established connection which the PID number IS NOT listed in the task manager, so how do i go about finding out what exactly it is that belongs to that PID # now? PM me please if you could.

RE: Detecting RATs/Keyloggers installed on your PC using CMD and TaskManager. - Anacreon - 11-22-2013

(02-09-2013, 03:12 AM)ArcaneFx Wrote:
[Image: a6KviOY.png]
In this tutorial, I'll be showing you the easiest way of finding out malicious applications installed on your PC that transfer data using the internet without you knowing it.

As stated in the title, we'll be using TaskManager and CMD for the purposes of this tutorial.

[Image: EU1A3x6.png]
1. To get started, open up your TaskManager by right clicking your TaskBar and selecting TaskManager or just hit CTRL+ALT+DEL to get it open.

2. Once that is done, click the "Processes" tab of your TaskManager and click View -> Select Columns -> Make sure that "Process Identifier(PID)" is ticked.

[Image: So5iBIG.png]

3. Now click the PID column to make sure that all the processes are sorted in a specific order. This step is not necessary, but it will make it easier for you to detect processes using their IDs.

[Image: Iz3VtpJ.png]

[Image: pmv2ItE.png]
Once you've done that right, we're going to move on to part 2 of our tutorial, which is using CMD to view established connections.

Assuming you know how to open up CMD, I'm just going to rush through step 1.
1. Start -> Run -> CMD
OR
Just type in cmd in the searchbar if you're running a system powered by Windows7.

2. Once cmd is open, I want you to type in "netstat -ano".
Your result should be something like this:
[Image: 75xp0C4.png]

3. Now what we're interested in are only the connections with the state "ESTABLISHED".
Isolate them out and look for the PID right next to them. There will be many connections with "ESTABLISHED" state, you'll have to repeat the following steps for all of them.

[Image: 2U2fQNs.png]

This is the fun part. Now go back to the TaskManager and look for the name of the process(es) that has the same PID(s) as the one you found with the ESTABLISHED connection(s).

[Image: mSBPnZn.png]

In the above case, it's a safe and trusted application known as Dropbox, so I'm good. But incase you find a process which you do not know, if it's something like svchost.exe that you're sure is infected, right click the process and select "Open File Location".

Now all you have to do is right click the file and scan it using your AV or upload it to an online scanner such as VirusTotal.com and check if it's infected.

[Image: ycn4yyH.png]

It's as easy as that.
Hope you find this useful.

-Arcane.cfg

it's very useful.. thank you @ArcaneFx :Smile:

RE: Detecting RATs/Keyloggers installed on your PC using CMD and TaskManager. - Anacreon - 11-22-2013

(02-09-2013, 03:12 AM)ArcaneFx Wrote:
[Image: a6KviOY.png]
In this tutorial, I'll be showing you the easiest way of finding out malicious applications installed on your PC that transfer data using the internet without you knowing it.

As stated in the title, we'll be using TaskManager and CMD for the purposes of this tutorial.

[Image: EU1A3x6.png]
1. To get started, open up your TaskManager by right clicking your TaskBar and selecting TaskManager or just hit CTRL+ALT+DEL to get it open.

2. Once that is done, click the "Processes" tab of your TaskManager and click View -> Select Columns -> Make sure that "Process Identifier(PID)" is ticked.

[Image: So5iBIG.png]

3. Now click the PID column to make sure that all the processes are sorted in a specific order. This step is not necessary, but it will make it easier for you to detect processes using their IDs.

[Image: Iz3VtpJ.png]

[Image: pmv2ItE.png]
Once you've done that right, we're going to move on to part 2 of our tutorial, which is using CMD to view established connections.

Assuming you know how to open up CMD, I'm just going to rush through step 1.
1. Start -> Run -> CMD
OR
Just type in cmd in the searchbar if you're running a system powered by Windows7.

2. Once cmd is open, I want you to type in "netstat -ano".
Your result should be something like this:
[Image: 75xp0C4.png]

3. Now what we're interested in are only the connections with the state "ESTABLISHED".
Isolate them out and look for the PID right next to them. There will be many connections with "ESTABLISHED" state, you'll have to repeat the following steps for all of them.

[Image: 2U2fQNs.png]

This is the fun part. Now go back to the TaskManager and look for the name of the process(es) that has the same PID(s) as the one you found with the ESTABLISHED connection(s).

[Image: mSBPnZn.png]

In the above case, it's a safe and trusted application known as Dropbox, so I'm good. But incase you find a process which you do not know, if it's something like svchost.exe that you're sure is infected, right click the process and select "Open File Location".

Now all you have to do is right click the file and scan it using your AV or upload it to an online scanner such as VirusTotal.com and check if it's infected.

[Image: ycn4yyH.png]

It's as easy as that.
Hope you find this useful.

-Arcane.cfg

it's very useful.. thank you @ArcaneFx :Smile:

RE: Detecting RATs/Keyloggers installed on your PC using CMD and TaskManager. - behehe hacked - 11-22-2013

noobs will like this Biggrin
thumbs up

RE: Detecting RATs/Keyloggers installed on your PC using CMD and TaskManager. - Madhatter - 11-26-2013

Nice tutorial. But does anyone knows what the ... is happening with my cmd?Thanks.
Spoiler: Picture
[Image: Untiafstled.png]