Checking for Keyloggers/Rats/Etc. 01-04-2014, 09:44 PM
#1
Very brief explanation for users using Windows.
Fine print: This is for educational purposes only, though I have a hard time believing you could do anything bad with this info. Furthermore, this is only to be used for the detection of malicious programs that utilize a connection to the internet. (Keyloggers, Specific type of Trojans, etc.) It's also not used to remove said programs, just to see if you have them. You'll need some virus protection to remove them. This is just to prevent people making "OMG AM I KEYLOGGED" threads constantly (I'm not sure how much it happens here, but I've seen it happen a lot other places).
To find Keyloggers (as well as any other malicious program accessing the internet), it's usually not as simple as just opening your Task Manager and finding the process, nor is it as easy as running a virus scan. The fact of the matter is that if a hacker wants their activity to be undetectable, you will not see it. That's all there is to it. Hackers can use complex method of hiding files/processes from such tools to make this sort of 'quick fix' impossible. Though it may be possible with that kid down the block that gave you a Keylogger to mess with you, it's not possible with an educated hacker.
To avoid this, there are several ways to figure out if someone has unauthorized access over your client. The easiest being as follows.
Do this once BEFORE YOU CONNECT TO THE INTERNET IN ANY WAY.
Press the start menu button.
Click "Run". (Windows 7 may not have this by default. Just search it in your "Search programs and files" bar.)
Type "Cmd", and run it.
You should now be in a Command Prompt.
Now enter: netstat -arn
Press enter.
You should now see a list of numbers under "Network Address, Netmask, Gateway Address, Interface, Metric".
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
255.255.255.255 255.255.255.255 255.255.255.255 0.0.0.0 1
If it doesn't look like something like that, and you're not connected to the internet...
Your computer is infected.
If it does, move on.
Next, connect to the internet.
Repeat the "netstat -arn" command mentioned earlier.
You should now see numbers under "Network Destination, Netmask, Gateway Address, Interface, Metric"
If it doesn't list only the network addresses used by your ISP...
You're infected.
As a rule of thumb, it should be something like:
0.0.0.0 0.0.0.0 216.1.104.70 216.1.104.70 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
216.1.104.0 255.255.255.0 216.1.104.70 216.1.104.70 1
216.1.104.70 255.255.255.255 127.0.0.1 127.0.0.1 1
216.1.104.255 255.255.255.255 216.1.104.70 216.1.104.70 1
224.0.0.0 224.0.0.0 216.1.104.70 216.1.104.70 1
255.255.255.255 255.255.255.255 216.1.104.70 216.1.104.70 1
If you see something odd listed here... It's bad.
In the next section you are going to close every program you have using the internet.
You're now going to open up your Command Prompt and type: netstat -an
The only IP listed here after you close everything accessing the internet should be the one assigned to you by your ISP.
If there are any other IPs listed here...
You're infected.
Rule of thumb... Should look like this:
Protocol Local Address Foreign Address State
TCP 0.0.0.0:0 0.0.0.0:0 LISTENING
TCP 216.1.104.32:120 0.0.0.0:0 LISTENING
TCP 216.1.104.32:121 0.0.0.0:0 LISTENING
TCP 216.1.104.32:122 0.0.0.0:0 LISTENING
UDP 216.1.104.32:123 *:*
Listed here, 216.1.104.32... The bolded part will almost always change.
Consider that number your "Session ID".
Last, Go back into your Prompt.
Type in, again: netstat -arn
Look for "Interface list".
You should now see all your active network adapters.
Assuming you still have all your programs closed,
You should only see the net adapters normally used by your computer.
(And possibly a Teamviewer VPN assuming you use Teamviewer. It doesn't like to close its net adapter sometimes.)
If you see something your computer obviously doesn't use normally, (assuming you don't know how to use your control panel to find the network adapters manually) Google is your friend.
Chances are that if it's utilizing half of your network connection with everything closed... It's probably not friendly.
Now, that step won't usually show anything odd, even if you have a virus.
So, I won't go so far as to say you're not infected yet.
The last step... Obviously: Run a virus scan.
Hackers are able to hide viruses from these scans using very simple methods. Naturally though, you can't hide from everything. The more Anti-virus programs you have, the better the chance of picking something up. (Seriously. It may be annoying, but if you're security conscious, it's a must.)
Sources:
Fine print: This is for educational purposes only, though I have a hard time believing you could do anything bad with this info. Furthermore, this is only to be used for the detection of malicious programs that utilize a connection to the internet. (Keyloggers, Specific type of Trojans, etc.) It's also not used to remove said programs, just to see if you have them. You'll need some virus protection to remove them. This is just to prevent people making "OMG AM I KEYLOGGED" threads constantly (I'm not sure how much it happens here, but I've seen it happen a lot other places).
To find Keyloggers (as well as any other malicious program accessing the internet), it's usually not as simple as just opening your Task Manager and finding the process, nor is it as easy as running a virus scan. The fact of the matter is that if a hacker wants their activity to be undetectable, you will not see it. That's all there is to it. Hackers can use complex method of hiding files/processes from such tools to make this sort of 'quick fix' impossible. Though it may be possible with that kid down the block that gave you a Keylogger to mess with you, it's not possible with an educated hacker.
To avoid this, there are several ways to figure out if someone has unauthorized access over your client. The easiest being as follows.
Do this once BEFORE YOU CONNECT TO THE INTERNET IN ANY WAY.
Press the start menu button.
Click "Run". (Windows 7 may not have this by default. Just search it in your "Search programs and files" bar.)
Type "Cmd", and run it.
You should now be in a Command Prompt.
Now enter: netstat -arn
Press enter.
You should now see a list of numbers under "Network Address, Netmask, Gateway Address, Interface, Metric".
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
255.255.255.255 255.255.255.255 255.255.255.255 0.0.0.0 1
If it doesn't look like something like that, and you're not connected to the internet...
Your computer is infected.
If it does, move on.
Next, connect to the internet.
Repeat the "netstat -arn" command mentioned earlier.
You should now see numbers under "Network Destination, Netmask, Gateway Address, Interface, Metric"
If it doesn't list only the network addresses used by your ISP...
You're infected.
As a rule of thumb, it should be something like:
0.0.0.0 0.0.0.0 216.1.104.70 216.1.104.70 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
216.1.104.0 255.255.255.0 216.1.104.70 216.1.104.70 1
216.1.104.70 255.255.255.255 127.0.0.1 127.0.0.1 1
216.1.104.255 255.255.255.255 216.1.104.70 216.1.104.70 1
224.0.0.0 224.0.0.0 216.1.104.70 216.1.104.70 1
255.255.255.255 255.255.255.255 216.1.104.70 216.1.104.70 1
If you see something odd listed here... It's bad.
In the next section you are going to close every program you have using the internet.
You're now going to open up your Command Prompt and type: netstat -an
The only IP listed here after you close everything accessing the internet should be the one assigned to you by your ISP.
If there are any other IPs listed here...
You're infected.
Rule of thumb... Should look like this:
Protocol Local Address Foreign Address State
TCP 0.0.0.0:0 0.0.0.0:0 LISTENING
TCP 216.1.104.32:120 0.0.0.0:0 LISTENING
TCP 216.1.104.32:121 0.0.0.0:0 LISTENING
TCP 216.1.104.32:122 0.0.0.0:0 LISTENING
UDP 216.1.104.32:123 *:*
Listed here, 216.1.104.32... The bolded part will almost always change.
Consider that number your "Session ID".
Last, Go back into your Prompt.
Type in, again: netstat -arn
Look for "Interface list".
You should now see all your active network adapters.
Assuming you still have all your programs closed,
You should only see the net adapters normally used by your computer.
(And possibly a Teamviewer VPN assuming you use Teamviewer. It doesn't like to close its net adapter sometimes.)
If you see something your computer obviously doesn't use normally, (assuming you don't know how to use your control panel to find the network adapters manually) Google is your friend.
Chances are that if it's utilizing half of your network connection with everything closed... It's probably not friendly.
Now, that step won't usually show anything odd, even if you have a virus.
So, I won't go so far as to say you're not infected yet.
The last step... Obviously: Run a virus scan.
Hackers are able to hide viruses from these scans using very simple methods. Naturally though, you can't hide from everything. The more Anti-virus programs you have, the better the chance of picking something up. (Seriously. It may be annoying, but if you're security conscious, it's a must.)
(01-04-2014, 09:48 PM)Emerald Wrote: Also, be sure to check %appdata% and %temp%. Loads of shitty Hackforums RATs are stored there. But very good tutorial! Thanks!
Sources:
Spoiler:
http://answers.microsoft.com/en-us/windo...e5de194b50
http://www.securitygeeks.net/2013/06/how...ogger.html
http://www.ozzu.com/mswindows-forum/keyl...06774.html
http://www.onepiecebay.net/forums/archiv...040779415f
EXPERIENCE. I had a script kiddy friend who always played with this shit. He tried to put rats and keyloggers on all my stuff, took me long enough to figure out how to get rid of them.
Also i made this thread on Se7enSins, my account is "Garrett" over there (if you don't believe me shoot me a PM), so i didn't really copy and paste this.
http://www.securitygeeks.net/2013/06/how...ogger.html
http://www.ozzu.com/mswindows-forum/keyl...06774.html
http://www.onepiecebay.net/forums/archiv...040779415f
EXPERIENCE. I had a script kiddy friend who always played with this shit. He tried to put rats and keyloggers on all my stuff, took me long enough to figure out how to get rid of them.
Also i made this thread on Se7enSins, my account is "Garrett" over there (if you don't believe me shoot me a PM), so i didn't really copy and paste this.
![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
![[Image: acWlFALuv8.png]](http://icap.me/i/acWlFALuv8.png)
![[Image: wondersig-1.png]](http://i1095.photobucket.com/albums/i467/gmlukens/wondersig-1.png)
![[Image: image.jpg]](http://f4aa.3owl.com/image.jpg)
