Showing posts with label trojans. Show all posts
Showing posts with label trojans. Show all posts
How To Check Whether You are Victim of RATS or not ?
1. Now every program has their own process which can be seen on task manager. So the first thing to do is to find out which process the Trojan is being attached to. If you see some unknown process search that on google. A good hacker will always makes sure he hides its process with a Windows based Process, for eg. svchost.exe or something like that.
2. If you cant find, then the next thing you can do is use cmd (to open cmd prompt, Click on Start--->Accessories-->Command prompt).
3. Once Command Prompt is opened, use this command: netstat -an |find /i "listening"
Note: The NETSTAT command will show you whatever ports are open or in use, but it is NOT a port scanning tool!
Now we wonder What this Command does? This command will show all the opening ports. Now check for any unknown port.
4. You can skip step 3 if you want, and can do this instead.
Open command prompt and type netstat -b
Now this command will show you the active connections with the process with their PID (Process Identifier) and also the packets.
Look out for SYN Packets and the Foreign address its been connecting with , check the process its been associated with, check the ports also. If you find that its connecting to some unknown ports, then you can say you have been backdoored.
5. Go to your task manager. On the top of it, click on View---> select Column---> Tick on PID (Process Identifier).
Match the suspicious Process with the Processes In task manager, check PID also.
Now most of the RATs resides on Start up. How to delete them from start up?
a) Go to regedit ---> HKLM\Software\Microsoft\Windows\Current version\Run
On the Right hand side, check for the process name which you find on step 4. if its not their. Check at
HKCU\Software\Microsoft\Windows\Current Version\Run
OR
Open Cmd prompt & type start msconfig. Go to Startup tab, you can check the startup process there.
I hope This Tutorial was easy and comprehensive.
10:50 AM 0
Make Your Own Customized Exe File for Your Trojan Using CreateExt
- Specify a custom file extension in the 'Extension' edit box.
- Specify a name for the file extension in the 'File Type' edit box. This should be something very brief, preferably a single word, and obscure. It does not really matter what this word is, as long as it does NOT clash with any others in the registry. Users will NOT see this value unless they lookin the registry for it.
- Specify a content type for this file extension in the 'Content Type' edit box. Users MAY see this, so make sure it is convincing.
Please Note: It does not really matter if it is the same as another file type, but it does mean Web Browsers may try and interpret a file with this new extension in the same way as other files with the same content type. - Specify a description in the 'Description' edit box. The user DOES see this when Windows Explorer displays files in detailed mode, so make it convincing.
- Set the default icon for the file extension in the 'Default Icon' edit box. It is best to experiment with this feature on your own system first to make sure you have a valid icon. Here are some tips:
- %1 means the default icon of the file. If the file with this extension is an executable, the default icon will be the executable's default icon.
- url.dll,0 means use the 1st icon (zero indexed) in url.dll, which is assumed to be in the Windows/System path. It is usually in the System Folder.
- shell32.dll,64 means use the 65th icon (zero indexed) in shell32.dll, which is assumed to be in the System path. It is usually in the System Folder.
- c:\progra~1\intern~1\iexplore.exe,8 means use the 9th icon (zero indexed) in iexplore.exe, which is assumed to be in the 'c:\Program Files\Internet Explorer\' folder. The file path does NOT have to be in the DOS 8.3 filename format.
Please Note: The icons and their order in shell32.dll varies on different versions of Windows. To ensure you have a valid icon, make sure that the icon exists in the position you have selected within shell32.dll for the target version of Windows. For example, the text document icon is position 64 for Win98's shell32.dll, but position 70 for Win2K's shell32.dll.
- Tick 'Always hide file extension' if required.
- Tick 'Refresh icon cache after creating extension' if required. See the FAQ for more information on why you should use this.
- Tick 'Allow auto-execution with no prompt after download with IE' if required. If you create a web page that automatically tries to download a file from a server using javascript, then this flag should allow the file to be downloaded and executed automatically in Internet Explorer without a prompt box. The javascript does not need to exploit Internet Explorer, just invoke a download. The flag should take care of everything else.
Please Note: This may not work on all versions of Internet Explorer. Patched versions may not be vulnerable. This option has no effect on other Web Browsers. - Finally, click on the 'Generate file...' button (or use 'F9' or on the menu, 'File', 'Generate file...'). A save dialog will popup, so just select your target destination and click on 'Save'.
- If you wish to pack your stub file with an executable packer, you may do so after the file generation.
- There are a few presets at the bottom of the CreateExt configuration window. These are suggested templates for you to use. Feel free to use them. Those presets are also accessible via the 'Preset', 'Other' menu, and the short-cut keys 'Ctrl+F1' to 'Ctrl+F6'.
Any Suggestions or Query, feel free to Comment, bt Pls Dnt Spam.
Enjoy Hacking Enjoy Hackton
9:52 PM 0
List Of All The Trojans And Their Port Numbers : Hacking tricks
----------------------------------
Well Known Trojans and Their Ports
----------------------------------
8 ICMP Ping Attack
9 UDP Chargen
19 UDP Chargen
21 TCP FTP service
23 TCP TELNET Service
25 TCP Several trojans use this port
31 TCP Agent 31 Hacker's Paradise
41 TCP Deep Throat
53 TCP DNS service
58 TCP DM Setup
79 TCP Firehotcker
80 TCP Executor
99 TCP Hidden Port 2.0
110 TCP ProMail Trojan
113 TCP Kazimas
121 TCP Jammer Killah
129 TCP Password Generator Protocol
135 TCP UDP Netbios Remote procedure call
137 TCP UDP Netbios name (DoS attacks)
138 TCP UDP Netbios datagram
139 TCP UDP Netbios session (DoS attacks)
146 TCP Infector 1.3
421 TCP Tcp Wrappers
456 TCP Hacker's Paradise
531 TCP Rasmin
555 TCP Stealth Spy Phaze
666 TCP Attack FTP
911 TCP Dark Shadow
999 TCP DeepThroat
9400 TCP In Command
9999 TCP The Prayer 1.0 - 2.0
1000 TCP Der Spaeher
1001 TCP Silencer WebEx
1011 TCP Doly Trojan
1012 TCP Doly Trojan
1015 TCP Doly Trojan
1024 TCP NetSpy
1025 UDP Maverick's Matrix
1027 TCP ICQ
1029 TCP ICQ
1032 TCP ICQ
1033 TCP ICQ Trojan
1033 TCP Exploit Descent Manager Module
1042 TCP Rasmin
1045 TCP Rasmin
1080 TCP Socks/Wingate
1090 TCP Xtreme
1170 TCP Voice Streaming Audio
1207 TCP SoftWar
1234 TCP Ultors Trojan
1243 TCP Sub Seven
1245 TCP VooDoo Doll
1257 TCP Sub Seven 2.1
1269 TCP Maverick's Matrix
1492 TCP Ftp 99CMP Trojan
1349 UDP BackOrifice DLL Comm
1394 TCP Gofriller BackDoor
1492 TCP FTP99CMP
1509 TCP Psyber Streaming Server
1600 TCP Shivka-Burka
1807 TCP SpySender
1981 TCP Shockrave Trojan
1999 TCP BackDoor Trojan
2000 TCP Remote Explorer
2000 UDP Remote Explorer/CallBook
2001 TCP Trojan Cow
2023 TCP Unknown Trojan
2086 TCP Netscape/Corba exploit
2023 TCP Ripper
2115 TCP Bugs
2140 TCP Deep Throat
2140 UDP Deep Throat
2283 TCP Unknown Trojan
2583 UDP Unknown Trojan
2565 TCP Striker
2583 TCP WinCrash
2716 TCP The Prayer 1.2 - 1.3
2721 TCP Phase Zero
2801 TCP Phineas Phucker
2989 UDP Rat
3024 TCP WinCrash
3129 TCP Master's Paradise
3150 TCP Deep Throat
3150 UDP Deep Throat
3587 UDP Sh*tHead trojan
3587 TCP Sh*tHead trojan
3700 TCP Portal of Doom
4092 TCP WinCrash
4321 TCP SchoolBus
4567 TCP File Nail
4590 TCP ICQ Trojan
4950 TCP Unknown trojan
5000 TCP Sokets de Trois v1.
5001 TCP Sokets de Trois v1.
5011 TCP OOTLT
5031 TCP Net Metropolitan
5032 TCP Net Metropolitan
5321 TCP Firehotcker
5400 TCP Blade Runner
5401 TCP Blade Runner
5402 TCP Blade Runner
5501 UDP
5521 TCP Illusion Mailer
5550 TCP X-Tcp Trojan
5555 TCP ServeMe
5556 TCP BO Facil
5557 TCP BO Facil
5569 TCP Robo-Hack
5666 TCP (PC Crasher)
5742 TCP (WinCrash)
6400 TCP (The Thing)
6667 TCP Sub-7 2.1 (new icq port)
6670 TCP (Deep Throat)
6711 TCP Sub Seven
6712 TCP Sub Seven
6713 TCP Sub Seven
6723 TCP MStream (Attacker to handler)
6771 TCP Deep Throat
6776 TCP Sub Seven
6838 UDP MStream (Agent to handler)
6939 TCP Indoctrination
6969 TCP Gate Crasher Priority
6970 TCP Gate Crasher
7000 TCP Remote Grab
7028 TCP Unknown trojan
7028 UDP Uknown Trojan
7300 TCP Net Monitor
7301 TCP Net Monitor
7302 TCP Net Monitor
7303 TCP Net Monitor
7304 TCP Net Monitor
7305 TCP Net Monitor
7306 TCP Net Monitor
7307 TCP Net Monitor
7308 TCP Net Monitor
7309 TCP Net Monitor
7323 TCP Sygate Backdoor
7323 UDP Sygate Backdoor
7597 TCP QaZ Trojan Communications
7789 TCP ICKiller
7983 UDP MStream (handler to Agent)
8783 TCP
9325 UDP MStream (agent to handler)
9872 TCP Portal of Doom
9873 TCP Portal of Doom
9874 TCP Portal of Doom
9875 TCP Portal of Doom
9989 TCP iNi-Killer
10067 TCP Portal of Doom
10067 UDP Portal of Doom
10167 TCP Portal of Doom
10167 UDP Portal of Doom
10498 UDP Handler to Agent
10520 TCP Acid Shivers
10607 TCP Coma
10666 UDP Ambush
11000 TCP Senna Spy
11223 TCP Progenic Trojan
12076 TCP GJamer
12223 TCP Hack'99 KeyLogger
12361 TCP TCP Whack-a-mole
12362 TCP TCP Whack-a-mole
12345 TCP Netbus Ultor's Trojan
12346 TCP Netbus
12361 TCP TCP Whack-a-mole
12362 TCP TCP Whack-a-mole
12456 TCP NetBus
12631 TCP WhackJob
12701 TCP Eclipse 2000
12754 TCP MStream (Attacker to handler)
13000 TCP Senna Spy
13700 TCP Unknown Trojan
15104 TCP MStream (Attacker to handler)
16660 TCP Stacheldraht
16969 TCP Priority
18753 TCP shaft Handler to agent(s)
20000 TCP Millennium
20001 TCP Millennium
20034 TCP (NetBus 2 Pro)
20432 TCP shaft Client to handler(s)
20433 UDP shaft Agent to handler(s)
21544 TCP Unknown Trojan
21554 TCP GirlFriend
22222 TCP Prosiak
20203 TCP Logged!
20331 TCP Unknown Trojan
23456 TCP EvilFTP UglyFTP
24680 TCP
24680 UDP
26274 TCP Delta Source
26274 UDP Delta Source
27665 TCP Trin00/TFN2K
27374 UDP Sub-7 2.1
27374 TCP Sub-7 2.1
27444 UDP Trin00/TFN2K
27573 UDP Sub-7 2.1
27573 TCP Sub-7 2.1
27665 TCP Trin00 DoS Attack
29891 TCP The Unexplained
30029 TCP AOL Trojan
30999 TCP Kuang2 Trojan
30100 TCP NetSphere
30101 TCP NetSphere
30102 TCP NetSphere
30303 TCP Sockets de Troie
31335 UDP Trin00 DoS Attack
31337 UDP Backorifice/BO-2K
31337 TCP Netpatch
31338 TCP NetSpy DK
31338 UDP Deep BO
31339 TCP NetSpy DK
31666 TCP BOWhack
31785 TCP Hack'a'Tack
31789 UDP Hack'a'Tack
31790 UDP Hack`a'Tack
31791 UDP Hack'a'Tack
32418 TCP Acid Battery
33333 TCP Prosiak
33390 UDP Unknown trojan
34324 TCP BigGluck TN
34555 UDP Trin00 Ping/Pong Response
33911 UDP Trojan Spirit 2001
40421 TCP Master's Paradise Trojan
40412 TCP The Spy
40422 TCP Master's Paradise
40423 TCP Master's Paradise
40425 TCP Master's Paradise
40426 TCP Master's Paradise
47252 TCP Delta Source
47262 UDP Delta Source
49301 UDP Online KeyLogger
50505 TCP Sokets de Trois v2.
50766 TCP Fore 1.0 Trojan
50776 TCP Fore
53001 TCP Remote Windows Shutdown
54320 TCP Back Orifice 2000
54320 UDP Back Orifice
54321 TCP School Bus Back Orifice
54321 UDP Back Orifice 2000
57341 UDP Net Raider Trojan
57341 TCP Net Raider Trojan
60000 TCP Deep Throat
61603 TCP Bunker-Hill Trojan
61348 TCP Bunker-HillTrojan
61466 TCP Telecommando
63485 TCP Bunker-Hill Trojan
65000 TCP Devil
65000 TCP Stacheldraht
9:25 PM 0
Subscribe to:
Posts (Atom)
Posts
