Help with RAT

Hey, a couple of my friends have been rat'ed and we're trying to find the corrupt file. My concern is that it's disguised as a microsoft folder in the sys32 folder; is there an easy way of detecting fraud in there? Also I was wondering if the rat would be listed as a network source going out and the best way to detect that.

Since RS07 Doesn't have the account guardian in place that it would be a lot easier for ratters to do what they do

Thanks in advanced

 

If you have any decent RAT then you will prob have to reformat your comp. ( even then sometimes they re-install.. )

 

wouldn't it best to do a system restore of your computer/laptop?

just back up files that you need; music, documents, videos etc.

 

close all programs

go to cmd

netstat -b

see what files are making a connection, one of these is the RAT

 

I would personally just reformat if I ever got a RAT. You can never be sure its gone even if Malwarebytes or something kills it.

 

Your best bet is to register at www.hackforums.net and go to white hat help section and follow the instructions. I got a really annoying RAT on all my computers and they helped deleted them, all my computers are working fine now

 

If I ever get a problem that could compromise my PayPal or Internet Banking I just reformat, better to be safe than sorry.

 

You might find this useful:

https://tribot.org/forums/showthread.php?tid=4176

Worst thing that could happen is that you learn to use wireshark which is kind of awesome.

 

Reformat immediately, and then change all of your passwords.

 

Only type with your on screen keyboard until you've gotten rid of the rat. i would format the hdd to be honest.

 

No need to format your pc just because you have a rat.
And on screen keyboard wouldn't help, since ratter can see your desktop.

I'd recommend you to download Malwarebytes and do a quick scan with it, no full scan needed.
After that go to 'run' field and search for 'msconfig' (Assuming you have windows, i got no experience with other OSes at all)
In msconfig open startup tab and search for Unknown manufacturer, and also the commands where they point to. If it seems fishy, then it is probably the rat(Or some other virus )

Anyways, i hope you can get somewhere with this, and i see this thread is about a week old, so i don't know if they have formatted their pc's, but it was not necessary at any point.

 

Download these two programs:

MaleWareBytes - do a full system scan.

ComboFix - will actually find your rat and get rid of it, better than MalewareBytes IMO

 

this.