Remove Guptachar. Description and removal instructions

Title: Guptachar
Type: Remote Administration Tools	Severity scale: (70 / 100)

Several variants (Guptachar 1.0b, Guptachar 2.0) appeared in the
internet from August 2001 to December 2002. This RAT defers from other
RAT viruses. The attacker does not require a "client" program to
control the infected PC. Any kind of browser can be used, because the
"server" runs like a web server. This virus includes a lot of dangerous
functions like uploading files, browsing files, executing programs,
shutting down and restarting, logging keys, etc. The pest was written
in C++ programming language. The author is an hacker called Ayan
Chakrabarti. The origination place is India.

From the publisher:

"Guptachar Remote Administration Tool
Copyright (C) 2001 Ayan Chakrabarti
Guptachar is a remote administration tool which is distributed under
the GPL (see the file COPYING for details). It differs from most other
remote administration tools in that it doesn't require its own client.
The remote machine can be administered using a web-browser which
supports HTTP authentication. This also means that you can administer a
Guptachar server from machines running almost any OS.
Installing Guptachar
To install Guptachar on a machine you must have the following two files
- install.exe - gupt.exe
Run install.exe and answer the questions that follow to install
Guptachar on that machine.
Please note - Running Gupt.exe directly will start the Guptachar server
itself. However it will not be installed on your system, ie. it will
not run every time you start-up. Also, the IRC Bot will not be active
and your username and password will both be "Anonymous" (without the
quotes).
Uninstalling Guptachar
Guptachar is stored as Gupt.exe in your windows directory. To uninstall
Guptachar, follow these steps -
1. Remove the reference to Gupt.exe (with full path) in the [windows]
section and "run" key of your WIN.INI file.
2. Connect to localhost with your web-browser, give the username and
password and then click on terminate server. Alternatively, reboot your
machine.
3. Delete Gupt.exe from your windows directory.
Making a QuickInstaller
The normal installation program is interactive and will ask you each
time it is run about info on setting up the Guptachar server. If you
want to install Guptachar on many machines with the same options, this
can get to be a pain. So, instead you can make a quick installer. A
quick installer is a stand alone exe that contains the gupt.exe file as
well as installation options within itself and can install Guptachar
without any user interaction required.
To make a quick installer, simple run QINST.EXE (ensure that the file
QINST.MOD is in the current directory). Give the filename for the
output .exe as well as the setup options. QINST.EXE will then create
the QuickInstaller file. Now the file created can be taken to and run
on the machines on which Guptachar has to be installed.
Please note that RUNNING QINST.EXE DOES NOT BY ITSELF INSTALL GUPTACHAR
ON THE MACHINE. Also, the exe file created by QINST.EXE is standalone
and does not require any other file to install Guptachar.
Using Guptachar
Guptachar runs as a web server on port 80. To administer the remote
system, simply type its IP address as the url in your browser. You will
be asked for the username and password and then you will reach the main
page of the Guptachar server from which you can administer the machine
in various ways.
To test the server, after installing it on the machine, you can try
going to http://localhost/
If you have activated the IRC BOT option then you have a very easy way
of knowing the IP address of the machine running Guptachar. Connect to
the irc server yourself and do a /whois on the nick.
To upload a file to the Guptachar server, first upload the file to some
location on the web. Then click on Transfer File in the Guptachar main
page. Give the url to which you uploaded the file as well as the
filename under which you want the file to be stored on the machine.
Optionally, you can also use the auto-upload utility.
Ayan Chakrabarti"

FORUM:
Discuss Guptachar in
spyware removal forum

Guptachar properties:
• Allows remote user connection
• Logs keystrokes
• Hides from the user
• Stays resident in background

Automatic Guptachar removal:

remover for Guptachar

Guptachar manual removal:

Kill processes:
gupt.exe, install.exe, makeqinst.exe, mapit.exe

HELP:
how to kill malicious processes

Delete files:
defs.h, gserver.cpp, gupt.exe, install.exe, makeqinst.exe, mapit.exe, qinst.mod

HELP:
how to remove harmful files

Other programs to remove Guptachar:

• SUPERAntiSpyware - Review - Download
• CounterSpy - Review - Download
• Windows Defender - Review - Download

Information added: 29/03/05
Information updated: 29/03/05

Additional resources related to Guptachar:

Attention: If you know or you have a website or page about Guptachar removal, feel free to add a link to this list: add url

more resources

Post Comment:

Attention: Use this form only if you have additional information about Guptachar parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.