KingDDD's Trainer is a Random Access Trojan [RAT]

Printable View

06-20-2009
Legify

KingDDD's Trainer is a Random Access Trojan [RAT]

Backdoor.Turkojan: Backdoor.Turkojan provides a remote attacker unauthorized access to an infected machine. It can steal passwords, log keystrokes, create screenshots, and control the infected system.

Rootkit.Agent: Rootkit.Agent is a trojan that hijack browser in order to produce popup advertisements from known badsites and also have rootkit functionality in order to hide itself as system driver.

Delete the following files to rid yourself of this beast, also, get a good AntiVirus and spyware remover to kill it off.

Files created upon execution:
%Windir%\cmsetac.dll
%Windir%\KB8888239.log
%Windir%\mstwain32.exe
%Windir%\ntdt c stp.dll --No Spaces, Dumb Filter
%System%\drivers\oreans32.sys
06-20-2009
pimpinallovertheworld666

Thank you Legify...for posting the remedy for this disaster...:)
06-20-2009
Legify

Quote:

Originally Posted by pimpinallovertheworld666

Thank you Legify...for posting the remedy for this disaster...:)

I just hope Obama sees this to ban the fucker.
06-20-2009
pimpinallovertheworld666

Quote:

Originally Posted by Legify

I just hope Obama sees this to ban the fucker.

HE will...OBAMA see's everything...no matter what u try and do to hide it...he WILL FIND IT! :eek::eek::eek: and ppl like that scare the hell outta me! bobo but i like em cuz they can be the greatest protectors we ever have...:)
06-20-2009
Obama

Quote:

Originally Posted by pimpinallovertheworld666

HE will...OBAMA see's everything...no matter what u try and do to hide it...he WILL FIND IT! :eek::eek::eek: and ppl like that scare the hell outta me! bobo but i like em cuz they can be the greatest protectors we ever have...:)

BOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO

https://webpages.csus.edu/~av289/hiding1.jpg
06-20-2009
pimpinallovertheworld666

Quote:

Originally Posted by Obama

BOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO

https://webpages.csus.edu/~av289/hiding1.jpg

IDK...wats this...i complimented u...? wdf? :confused:

U know everything...that goes on in the site at least...:p
06-20-2009
tommyvo54

Can anybody team view me to delete the viruses. D:
06-20-2009
pimpinallovertheworld666

Quote:

Originally Posted by tommyvo54

Can anybody team view me to delete the viruses. D:

Doesn't anyone ever read the comments before they download? :confused:

Haven't you ever heard the phrase "Look, Read before you buy..." come on seriously...:(

Also Tommy...I'd recommend having one of the Mods or Admins do it...not one of these choobs...
That or Legify...
06-20-2009
tommyvo54

xD, i did, but i kinda was in a hurry.. so can you TV me?
06-20-2009
pimpinallovertheworld666

Quote:

Originally Posted by tommyvo54

xD, i did, but i kinda was in a hurry.. so can you TV me?

Nope...I don't do that stuff any more...I don't want to be held responsible for any thing that happens...and usually with my luck streak, something will and I don't know what system your running and I don't want to know...OK?:)
06-20-2009
IceGuru

I know i don't have many post so you will say no but if you catch me in pm before i leave ill TV you
06-20-2009
Mouzie

Legify get the glory.

WHY...WHY!!!

Okay, nice job. We have many people saved

>>; Well not that one guy.
06-20-2009
ArchPure

Quote:

Originally Posted by pimpinallovertheworld666

Nope...I don't do that stuff any more...I don't want to be held responsible for any thing that happens...and usually with my luck streak, something will and I don't know what system your running and I don't want to know...OK?:)

sounds like you have a reallly bad luck strea. btw, foolets speedhack works w/o d/c for me... [well that was yesterday, now today it d/cs me... i wonder why...]
06-20-2009
pimpinallovertheworld666

Quote:

Originally Posted by ArchPure

sounds like you have a reallly bad luck strea. btw, foolets speedhack works w/o d/c for me... [well that was yesterday, now today it d/cs me... i wonder why...]

Guess ur lucks as good as mine hahahhahahahah :D
Always some bs probem...:rolleyes:
06-20-2009
wobbleguts

Hey legify i cant find the cmsetac.dll mine is called cmsteacl.dll so do you reckon its the same thing or not and i deleted the mstwain32.exe which prduces all trhe trojans once my AV gets rid of them all (I'm on Trend Micro) and then it says restart computer and i do that then i just get more so im guessing the mstwain32.exe produces them and i deleted that and now im doing a full virius scan on trend and seeing what it come up with will edit post if they are all gone :) Thanks in advance ill press "thanks " if you help me with the dll :P
06-20-2009
KingDDD

you have been reported for bullshitting me
06-20-2009
kiddieboy12

ugh would you please stop putting al the henti anime CRAP, (not flaming) it annoying, it not like they are sexy/
06-20-2009
pureskillx3

Hi

Quote:

Originally Posted by KingDDD

you have been reported for bullshitting me

Lol I rather trust Legify then you....... i have many reasons =]
06-20-2009
riceking

Lmao at your thread Remote Access Trojan, what a noob, :dwug:

Freaking do your studying before thinking your all that...
Remote Administration Tool - Wikipedia, the free encyclopedia

Remote Administration Tool = RAT (Not Remote Access Trojan)
bobobobobobobobobobobobobobobobobobo

(Thank me if you like the info you read from wiki =))
06-20-2009
Ayex

Dose anyone know what folder there in WINDOWS ect...:eek:
06-21-2009
Ayex

Okay I got most of them but I cant get rid of ntd***tp.dll :mad:

sorry for the double post
06-21-2009
HackPack

we have another RAT...i thought it was over and people learned their lesson the first time around with Maximo...i sure did.bobo

Legify nice job, saved some people with PC's wrecked from a trojan/RAT...
06-21-2009
riceking

Quote:

Originally Posted by Ayex

Okay I got most of them but I cant get rid of ntd***tp.dll :mad:

sorry for the double post

Things to note: If that file you ran was not detected by antiviruses your screwed

File-> .dlls
delete .dlls
File makes more .dlls

so its hopeless, you need to tough it out, who made this RAT... when infected by a RAT you will start getting "Error 202 at AKJDSFSA" and explorer.exe will close so good luck
06-21-2009
HackPack

good luck on getting rid of it

do any1 try system restore? that's what got rid of mine before on the Maximo RAT. i did that first but thought it was still there so i went crazy on security lol...then i realized shortly i wasted my time on cleaning my pc of viruses when there werent any.

Try system restore.
06-21-2009
tooktheriver2

how do u know if u have it
06-21-2009
riceking

uhhhh crazy stuff happens to your computer, mouse control, pop ups
06-21-2009
~Katlyn~

Quote:

Originally Posted by riceking

Things to note: If that file you ran was not detected by antiviruses your screwed

File-> .dlls
delete .dlls
File makes more .dlls

so its hopeless, you need to tough it out, who made this RAT... when infected by a RAT you will start getting "Error 202 at AKJDSFSA" and explorer.exe will close so good luck

i think i deleted that file.
i just turned on UAC, and downloaded Avast!
06-22-2009
Ayex

My anti virus got it, it was just in quarantine...well i think i got it :eek:
06-22-2009
Mouzie

Quote:

Originally Posted by Ayex

My anti virus got it, it was just in quarantine...well i think i got it :eek:

Notes, it'll still spread.

What you really wants to get is the following

Ad-Aware; it'll tackles ANY programs that will attack and attach itself to the System32 Folder.

Malwarebtyes: This program is design to rips and beat the shit out of Malwares, the program with Ad-Aware will be your saints.

Notes: Both are free.

Also try and get Sandboxie, this allow you to open shit up in a safe area without Malwares and shit trying to nibbles onto your PC hard drive.

NOTES: The root kit will might prevent you from getting into sites that have this. Put it on a CD and install it onto the computer.

YOU MUST THEN SMASH OR BURN THE CD; this will prevent the virus some latching onto the CD. Which is common escape routes.