+- Sinisterly (https://sinister.ly)
+-- Forum: Computers (https://sinister.ly/Forum-Computers)
+--- Forum: Antivirus & Protection (https://sinister.ly/Forum-Antivirus-Protection)
+--- Thread: [Tutorial] How to remove a RAT for beginners. (/Thread-Tutorial-How-to-remove-a-RAT-for-beginners)
[Tutorial] How to remove a RAT for beginners. - Cake - 04-09-2013
Before you start I recommend just Downloading dark comet remover in case the scrub rating you is using DC.
If you pirate your software then I recommend just backing up your files on a flash drive or external HDD and formatting.
Okay so if you don't want to do that here is how I would recommend getting rid of a rat.
Okay First off you want to start by Cleaning your temp files.
You can do it manually or use this:
Spoiler:
http://amtsc.com/OldTimer/TFC.exe
Open up your task manager and see if there is a random program running in the backround. Now if you try to end it, it will just keep coming back so right click on it and set the permissions. Deny it of everything then end the process. You are now going to need to locate where it is.
The most common places for a rat are:
- Favs#\
- MyDocs#\
- MyProg#\
- Start#\
- Cookie#\
- Desktop#\
- Temp#\
- HDD#\
- WinDin#\
- Sys32#\
- App#\
When you're in there look for files with icons similar to these:
Spoiler:
The last few steps are going to be cleaning up the trail so your computers speed isn't effected by the rat still.
Download CCleaner:
Spoiler:
http://www.piriform.com/ccleaner
Okay With CCleaner we are going to clean all TEMP files with the "Cleaner"
Spoiler:
Now in CCleaner you want to navigate to the registry tab and clean that
NOTE: I always recommend making a backup .reg.
Spoiler:
Now go to your start menu and type
Code:
msconfig.exeNavigate the the Startup and Services tabs and make sure the malicious software isn't selected to start with startup.
Spoiler:
You can also disable any thing you don't want to start up when you're there to make your pc boot faster.
last but not least if you didn't solve your problem download malware bytes and give it a shot or find some bot kills online.
I hope this tutorial helps some of you!
Thanks/+Rep is HIGHLY APPRECIATED for this detailed tutorial.
RE: [Tutorial] How to remove a RAT for beginners. - Redbull - 04-09-2013
Nice Tutorial, I'm sure this well help a lot of people out there.
RE: [Tutorial] How to remove a RAT for beginners. - Banadmin - 04-09-2013
It's a great help that you've actually listed the folders where a RAT can be found, but could it possibly be found anywhere on your computer's hard drive?
We just need a thread now explaining what exactly RATs are.
RE: [Tutorial] How to remove a RAT for beginners. - Cake - 04-09-2013
(04-09-2013, 09:56 PM)Blueish Wrote: It's a great help that you've actually listed the folders where a RAT can be found, but could it possibly be found anywhere on your computer's hard drive?
We just need a thread now explaining what exactly RATs are.
I will make a thread explaining what a rat is and the possibilities are endless but most people put them in those folders and 90% of the time you want to thoroughly got hrough each and every folder in your appdata.
RE: [Tutorial] How to remove a RAT for beginners. - Harvey - 04-10-2013
Are you qualified to use TFC? Are you a member of AMTSC? And why do you recommend using CCleaner? I thought we outlawed that years ago. :p
RE: [Tutorial] How to remove a RAT for beginners. - Cake - 04-11-2013
(04-10-2013, 01:34 PM)Harvey M. Wrote: Are you qualified to use TFC? Are you a member of AMTSC? And why do you recommend using CCleaner? I thought we outlawed that years ago. :pNot sure if trolling or what ._.
RE: [Tutorial] How to remove a RAT for beginners. - Soup_DZ - 04-11-2013
I suggest to clear your temp file after you clean up the virus issue. And also, a lot of viruses don't use those icons. Most of them melt on execution and hide themselves in various locations with persistence on. This will only remove some obvious infections.
RE: [Tutorial] How to remove a RAT for beginners. - Cake - 04-11-2013
(04-11-2013, 01:59 AM)Soup Wrote: I suggest to clear your temp file after you clean up the virus issue. And also, a lot of viruses don't use those icons. Most of them melt on execution and hide themselves in various locations with persistence on. This will only remove some obvious infections.You have to run the virus for it to embed itself in the first place. Unless it's a java drive by so get it right
Also it's easy to disable persistence by removing all permission from the stub. If it is a crypted stub it WILL be visible in you task manager. You can also go into your register to look for a start up key from the stub. I know what i'm talking about.
RE: [Tutorial] How to remove a RAT for beginners. - Soup_DZ - 04-11-2013
(04-11-2013, 02:22 AM)Odissea Wrote:(04-11-2013, 01:59 AM)Soup Wrote: I suggest to clear your temp file after you clean up the virus issue. And also, a lot of viruses don't use those icons. Most of them melt on execution and hide themselves in various locations with persistence on. This will only remove some obvious infections.You have to run the virus for it to embed itself in the first place. Unless it's a java drive by so get it right
Also it's easy to disable persistence by removing all permission from the stub. If it is a crypted stub it WILL be visible in you task manager. You can also go into your register to look for a start up key from the stub. I know what i'm talking about.
Well of course you have to run it unless it's a JDB. How else would it infect your system .__.;?
I don't think you understand some features that crypters have nowdays. I know what I'm talking about. I RAT. I have my own installs and my own infections. Honestly, I doubt you know what you're talking about.
You do realize that your registry will most likely be disabled, right? The crypted stub will be visible in the task manager, yeah. But you do know it hides itself and clones a process right?
RE: [Tutorial] How to remove a RAT for beginners. - Cake - 04-11-2013
(04-11-2013, 02:29 AM)Soup Wrote:Yes and most of the time is hides itself in explorer.exe ._. I also rat.(04-11-2013, 02:22 AM)Odissea Wrote:(04-11-2013, 01:59 AM)Soup Wrote: I suggest to clear your temp file after you clean up the virus issue. And also, a lot of viruses don't use those icons. Most of them melt on execution and hide themselves in various locations with persistence on. This will only remove some obvious infections.You have to run the virus for it to embed itself in the first place. Unless it's a java drive by so get it right
Also it's easy to disable persistence by removing all permission from the stub. If it is a crypted stub it WILL be visible in you task manager. You can also go into your register to look for a start up key from the stub. I know what i'm talking about.
Well of course you have to run it unless it's a JDB. How else would it infect your system .__.;?
I don't think you understand some features that crypters have nowdays. I know what I'm talking about. I RAT. I have my own installs and my own infections. Honestly, I doubt you know what you're talking about.
You do realize that your registry will most likely be disabled, right? The crypted stub will be visible in the task manager, yeah. But you do know it hides itself and clones a process right?