Remove HTTP RAT. Description and removal instructions

Title: HTTP RAT
Type: Remote Administration Tools	Severity scale: (65 / 100)

This is a big RAT virus family. Several versions (HTTP RAT 0.1a, HTTP
RAT 0.1b, HTTP RAT 0.2, HTTP RAT 0.21, HTTP RAT 0.2i, HTTP RAT 0.3,
HTTP RAT 0.31) appeared in the internet from March 2003 to September
2003. The author of this pest is a hacker called Zombie. The
programming language is C. All versions have the ability to disable
Firewall protection of the victim. The RAT also includes a "notify"
ability: when the virus infects the victim's PC it automatically sends
a letter to the hacker.

From the publisher:

"[HTTP_RAT 0.31]
coded in C. works on win9x/2000/xp
[What is it]
HTTP_RAT is a "web-server" that allows you to browse victim's computer
with any browser on any OS(!). It sends victim's ip adress to your
email adress, so u have just to open http://his_ip[:port] in your
browser.
[How to use]
Run httprat.exe, fill in your email addresss & smtp server(s) and click
[Create]. It will make a file called httpserver.exe. Send that file to
victim. When victim opens it u'll get mail with instructions.
[Features]
server size: 30kb view/kill processes browse/download/execute/delete
files close firewalls b4 running hmm.. that's all 4 now ;]
these will be added in next version:
file uploading
screen capture
registry editing(maybe)
better hiding/startup methods
automatically find smtp server
[something useful that u can suggest]
zombie"

FORUM:
Discuss HTTP RAT in
spyware removal forum

HTTP RAT properties:
• Allows remote user connection
• Sends out logs by FTP or email
• Hides from the user
• Stays resident in background

Automatic HTTP RAT removal:

remover for HTTP RAT

HTTP RAT manual removal:

Kill processes:
httprat.exe, httprat01a.exe, httpserver.exe, [system, root]\\cookies\\ck16.exe, [system, root]\\cookies\\ck412.exe, [system, root]\\cookies\\ckmgr.exe, [system, root]\\cookies\\sys412.exe

HELP:
how to kill malicious processes

Delete registry values:
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\ntmgr HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\win16

HELP:
how to remove registry entries

Delete files:
httprat.exe, httprat01a.exe, httpserver.exe, readme.ru.txt, readme.txt, [system root]\\cookies\\ck16.exe, [system root]\\cookies\\ck412.exe, [system root]\\cookies\\ckmgr.exe, [system root]\\cookies\\sys412.exe

HELP:
how to remove harmful files

Other programs to remove HTTP RAT:

• SUPERAntiSpyware - Review - Download
• CounterSpy - Review - Download
• Windows Defender - Review - Download

Information added: 30/03/05
Information updated: 30/03/05

Additional resources related to HTTP RAT:

Attention: If you know or you have a website or page about HTTP RAT removal, feel free to add a link to this list: add url

more resources

Post Comment:

Attention: Use this form only if you have additional information about HTTP RAT parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.