Remove RAT's From Your PC 05-14-2017, 12:42 PM
#1
I've seen poorly explained ways to remove RAT's from your PC so I've decided to explain the methods I use.
TL;DR at the bottom of the thread if you want a summary of all the RAT finder programs.
NOTE:
I myself use Windows 10 operating system so I'd say some of these methods may not work for you if you're on a different OS.
What is it?
First of all, RAT stands for Remote Access Tool. Meaning a person will have access to your PC and therefore see everything you're doing and even control it. You get Ratted if you carelessly download unknown files from unreliable sites.
Spotting a RAT?
How do you know if you've been Ratted? Sometimes the Ratter might do suspicious things on your PC without you even knowing it. But the most obvious is if you see your cursor moving, browsers and files open up on their own then you're Ratted. Good Ratters don't make themselves too obvious which is why I'll now show you some tools that'll help you notice hidden RAT's.
RAT spotting tools:
TCPView is one I use daily to monitor every bit of internet traffic that is sent and received.
This tool lets you see which programs/processes are open and what state they're in: 'Established, Listening, Waiting or Closed'. It shows the Local and Remote Port, which Protocol they use, the Address, which Process ID the current Process has and the amount of sent and received packages and bytes.
If you see TCPView detecting oddly Established processes, try close them and permanently block the ports using 'Windows Firewall with Advanced Security'
Top security tip:
If you have access to your router and your router lets you manage your traffic, you want to block the connections on your router firewall instead.
The reason why Task Manager is a worthless tool for finding RAT's is because they hide themselves from the default Windows Task Manager. It's the 101 for every RAT Dev. If you want a Task Manager alternative you can use 'Process Hacker'.
Be sure to research on the specific Port you find suspicious to find out if it can be easily exploited through such as Port 8008 or 8009 that are common browser backdoors.
The most dangerous type of Ratter can be found on your Rootkit. Meaning if you were to wipe and reset your disk completely, you'd still have the Rat or Virus on your Rootkit. Malwarebytes does a splendid job scanning for Rootkits and naturally any malware, but if you definitely want the strongest method of detecting and removing Rootkits, I'd use GMER.
Please note, Malwarebytes will in most cases find the infected program with the RAT, UNLESS the file is archived.
What GMER does, if you go to their website and download their Rootkit scanner, it'll randomly generate a temporary scanner every time you download it to prevent it from being detected and exploited once downloaded.
It is very powerful and please do not remove any unknown false positive results done from the scan, I have like 1 alert but It's needed by Windows which is why I'd not want to remove any positive alerts without a bit of research. Can seriously do damage to your PC.
Before you open any programs always scan them on VirusTotal. Please, do not open any .exe files. If you do and nothing happens, you've been ratted in the most obvious way. If your program works, it still might have a RAT binded to itself.
regedit aka Registry Editor is a place where all your system configurations are found on. This program is found on every Windows machine. Everything on your PC is found here even the files you download and you can freely change any values you want to any of the settings. Don't touch Regedit values if you have no idea about what you're doing.
Navigate to your Run directory like this: HKEY_CURRENT_USER -> SOFTWARE -> Microsoft -> Windows -> CurrentVersion -> Run and in here if there are some odd program names with 1 as value that you're sure about aren't anything important, try remove them and if they don't get removed change their value to 0. This means the RAT would have stayed active even after removal. Navigate through your downloads in Regedit, and remove any trace of the file if it keeps coming back after removal.
If you want to see if the program has a RAT bound to it, download a .NET Decompiler such as Red Gate's .NET Reflector from 2011 or something newer such as ILSpy. They let you see and alter the program code. If you drop your infected file into the decompiler and browse through the code to find any suspicious keywords such as: "Regedit" you'll know there's something fishy going on.
When you're under a RAT attack, simply unplug the network cable from your computer or even better, just shut down your PC and boot it up in safe mode and do my steps. Also even tho RAT's most likely are hidden, Task Manager is still a good first place to look at. If you find your RAT on there, go to Task Managers System Properties and from the Startup Tab simply disable the RAT so that it'll not run immediately once you boot up again.
Summary of the tools I use:
TCPView - Network Monitor
Windows Firewall with Advanced Security - Blocking bad Ports
I recommend Router Firewall for this tho (If possible)
Process Hacker - Better Task Manager
Malwarebytes
GMER - OP Rootkit scanner
"regedit" - Registry Editor
ILSpy or Red Gate's - .NET Decompilers
VirusTotal for scanning any file before download.
Thank you and stay safe.
TL;DR at the bottom of the thread if you want a summary of all the RAT finder programs.
NOTE:
I myself use Windows 10 operating system so I'd say some of these methods may not work for you if you're on a different OS.
What is it?
First of all, RAT stands for Remote Access Tool. Meaning a person will have access to your PC and therefore see everything you're doing and even control it. You get Ratted if you carelessly download unknown files from unreliable sites.
Spotting a RAT?
How do you know if you've been Ratted? Sometimes the Ratter might do suspicious things on your PC without you even knowing it. But the most obvious is if you see your cursor moving, browsers and files open up on their own then you're Ratted. Good Ratters don't make themselves too obvious which is why I'll now show you some tools that'll help you notice hidden RAT's.
RAT spotting tools:
TCPView is one I use daily to monitor every bit of internet traffic that is sent and received.
This tool lets you see which programs/processes are open and what state they're in: 'Established, Listening, Waiting or Closed'. It shows the Local and Remote Port, which Protocol they use, the Address, which Process ID the current Process has and the amount of sent and received packages and bytes.
If you see TCPView detecting oddly Established processes, try close them and permanently block the ports using 'Windows Firewall with Advanced Security'
Top security tip:
If you have access to your router and your router lets you manage your traffic, you want to block the connections on your router firewall instead.
The reason why Task Manager is a worthless tool for finding RAT's is because they hide themselves from the default Windows Task Manager. It's the 101 for every RAT Dev. If you want a Task Manager alternative you can use 'Process Hacker'.
Be sure to research on the specific Port you find suspicious to find out if it can be easily exploited through such as Port 8008 or 8009 that are common browser backdoors.
The most dangerous type of Ratter can be found on your Rootkit. Meaning if you were to wipe and reset your disk completely, you'd still have the Rat or Virus on your Rootkit. Malwarebytes does a splendid job scanning for Rootkits and naturally any malware, but if you definitely want the strongest method of detecting and removing Rootkits, I'd use GMER.
Please note, Malwarebytes will in most cases find the infected program with the RAT, UNLESS the file is archived.
What GMER does, if you go to their website and download their Rootkit scanner, it'll randomly generate a temporary scanner every time you download it to prevent it from being detected and exploited once downloaded.
It is very powerful and please do not remove any unknown false positive results done from the scan, I have like 1 alert but It's needed by Windows which is why I'd not want to remove any positive alerts without a bit of research. Can seriously do damage to your PC.
Before you open any programs always scan them on VirusTotal. Please, do not open any .exe files. If you do and nothing happens, you've been ratted in the most obvious way. If your program works, it still might have a RAT binded to itself.
regedit aka Registry Editor is a place where all your system configurations are found on. This program is found on every Windows machine. Everything on your PC is found here even the files you download and you can freely change any values you want to any of the settings. Don't touch Regedit values if you have no idea about what you're doing.
Navigate to your Run directory like this: HKEY_CURRENT_USER -> SOFTWARE -> Microsoft -> Windows -> CurrentVersion -> Run and in here if there are some odd program names with 1 as value that you're sure about aren't anything important, try remove them and if they don't get removed change their value to 0. This means the RAT would have stayed active even after removal. Navigate through your downloads in Regedit, and remove any trace of the file if it keeps coming back after removal.
If you want to see if the program has a RAT bound to it, download a .NET Decompiler such as Red Gate's .NET Reflector from 2011 or something newer such as ILSpy. They let you see and alter the program code. If you drop your infected file into the decompiler and browse through the code to find any suspicious keywords such as: "Regedit" you'll know there's something fishy going on.
When you're under a RAT attack, simply unplug the network cable from your computer or even better, just shut down your PC and boot it up in safe mode and do my steps. Also even tho RAT's most likely are hidden, Task Manager is still a good first place to look at. If you find your RAT on there, go to Task Managers System Properties and from the Startup Tab simply disable the RAT so that it'll not run immediately once you boot up again.
Summary of the tools I use:
TCPView - Network Monitor
Windows Firewall with Advanced Security - Blocking bad Ports
I recommend Router Firewall for this tho (If possible)
Process Hacker - Better Task Manager
Malwarebytes
GMER - OP Rootkit scanner
"regedit" - Registry Editor
ILSpy or Red Gate's - .NET Decompilers
VirusTotal for scanning any file before download.
Thank you and stay safe.
![[Image: hJkWWcF.png]](http://i.imgur.com/hJkWWcF.png)
![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
![[Image: 4aeb044653a17ba3f4588cdf214cdf77.gif]](http://i.picasion.com/pic85/4aeb044653a17ba3f4588cdf214cdf77.gif)
![[Image: ouxiEMk.png]](http://i.imgur.com/ouxiEMk.png)
