• Welcome to ForumKorner!
    Join today and become a part of the community.

Tiszys White Hat thread. I'm helping you with everything + Tutorials inside.

Tiszy

Member
Reputation
0
Hello there, my name is Fredrik / Tiszy. I've been active a lot in the White Hat section, and I'm working as a IT-Helper sometimes in real life.
A White Hat is basically a person that helps you with an infection, and other small problems. But I'm more than a White Hat, I can help you with everything! Here's a short list of what I can help you with:

- Bluescreen
- Blackscreen
- Hardware problems
- Software problems
- HDD, CPU, RAM, etc.
- RATs, keylogger, (infected), etc.
- Files
- Lagging, slow computers
- And a LOOOT more!


I'll answer every and all of your questions. I'll be online most of the time :) By the way, if you find it difficult or you're being confused of what I said, I'll be more than happy to help you over skype or teamviewer, or another chatting/viewing programs if you like. I'll write some tutorials in this thread, but if you still need help, you should post a comment. I'll also be very glad if you posted a thank you if I've helped you or the tutorial was good or whatever :) Just a thank you would be great! :D

Infected - Read on​

- Malwarebytes
NB: If you have any other Anti Virus programs installed, BE SURE TO UNINSTALL IT BEFORE YOU INSTALL THIS.
1. Download it(link at the name).
2. Install it(I'd recommend to run is as admin).
3. Run a full scan.
4. This might delete files if you're infected.


- Avast!
NB: If you have any other Anti Virus programs installed, BE SURE TO UNINSTALL IT BEFORE YOU INSTALL THIS.
1. Download it(link at the name).
2. Install it(I'd recommend to run is as admin).
3. Run a full scan.
4. Click "Scan Computer"
5. Click "Boot-time scan"
6. That'll scan your computer before you've loaded windows. That means it'll scan the files and your virus before your virus will run.


- SpyBot
NB: If you have any other Anti Virus programs installed, BE SURE TO UNINSTALL IT BEFORE YOU INSTALL THIS.
1. Download(link at the name)
Obviously, the first thing you need to do is download Spybot-S&D from our download page. The download page first gives you a bit of donation information; if you like the program, I encourage you to come back later and donate something. But right now, you want to download. The downloads are on the same page, just scroll down a few lines and click Spybot – Search & Destroy 1.6.2. On the next page you will see a table with four download locations. Clicking on one of them will lead you to a page offering the download. Each of these pages is a bit different, but you should be able to find the download link there without problems.
2. Installation
The file you have downloaded will be named spybotsd162.exe or similar. To install Spybot-S&D, all you have to do is run the file, and the installation program will start (if you have downloaded with Internet Explorer, the download dialog will give you the option to open the file directly). The installer will show you the license and ask you for the installation location. You can go with the default settings here and just click your way through the installer by using the Next button. After the installation has finished, you will see a Spybot – Search & Destroy button on your desktop and in your start menu. Click on it to start Spybot-S&D the first time.
3. First run
The first time you start Spybot-S&D, it will display a Wizard, a small window helping you through the first steps. It gives you the possibility to add or remove the icons you have or haven’t created during install, for example. Let’s just say you want them and proceed to the next page. If you are using a proxy in Internet Explorer, Spybot-S&D will show you this proxy and a button will give you the opportunity to use it for Spybot-S&D, too. If the text field is blank, you don’t need to configure anything.
The next page deals with updates. It is very important to keep up-to-date. Using the two buttons this page offers to do the updates for you, you can also do the update at a later point. The last page of the wizard will ask you to read the help file. The help file is always a good resource if you are unsure what to do, so please do at least read the first pages of it.
4. Doing a scan
After the Wizard has finished, you may find yourself on the Settings or Update page. As the default settings are ok right now, and you’ve already updated, let’s ignore them for now and do the first scan. The left side of the program has a navigation bar that can lead you to all functions of the program. The first section there (the top-most button) is labeled Spybot-S&D and leads you to the main page. Right now, you will see only an empty list and a toolbar at the bottom. The first button in this toolbar is named Check for problems – that is the button you’ve got to press to start the scanning. Lean back and watch the scan progress.
5. Interpreting the results
At this point, you could just jump to point 7, and remove the results. Instead we recommend that you first have a look at what all the stuff is that Spybot-S&D detected. The first thing you should know is to distinguish between the red entries, which represent spyware and similar threats, and the green entries, which are usage tracks.
For the usage tracks (I hope you have followed that link to read what they are), removal is non-critical, but depends on your personal preferences. Ignoring the usage tracks for now, you should have a look at the red entries which represent the real threats. While you of course can trust us that we have chosen the targets using strict criteria, you can check for yourself if you click on each product and read the product information that will be shown in a pop-up window.
6. Decision on exceptions
All problems displayed in red are regarded as real threats and should be dealt with. But while you read the product description, you may still decide to keep a threat, or just a usage track. Maybe you don’t want your list of most recently used Word documents removed? At this point you have three options.
You could decide on ignoring all usage tracks. In that case you could open the File sets page on the Settings section of the program, and disable the Usage tracks entries.
Or if you want to just keep all tracks from a specific product, just right-click a product in the results list and choose the corresponding option.
Finally, if you want to keep just one file, that is possible the same way.
7. Removing the threats found
So now you should know about everything you’ve found. It’s time to use the Fix selected problems button. Once you start thinking about removing the usage tracks, too, you may think that ticking all the green entries is hard work. This is for a simple reason – to force you, the newbie – to look at the results. Once you know what you are dealing with, there is a hidden Select all button available for you.
8. Resident
If you use Spybot-S&D’s realtime protection against spyware, nasty spies will not enter your system.
Currently there are three different kinds of protection.
The Immunize function prevents e.g. Tracking Cookies from entering your system. Immunize works with Mozilla Firefox, Internet Explorer and Opera, allowing you to adjust specific settings of the browser to block known spyware installers, (and similar baddies) already included in Spybot-S&D’s database.
You start the Immunize function by clicking on Spybot-S&D → Immunize on the left navigation bar.
Resident SDHelper is a second layer of protection for IE. Immunize function blocks installers by their ActiveX ID, while SDHelper blocks badware that tries to enter using a different method. Thus Internet Explorer cannot download bad files. You start SDHelper by clicking on Tools → Resident on the left navigation bar (therefore Spybot-S&D has to run in Advanced Mode). There you can tick the checkboxes next to Resident “SDHelper” (Internet Explorer bad download blocker) active in order to activate SDHelper.

Resident TeaTimer prevents unwanted files from being installed – no matter how – on your system. It monitors the processes called/initiated perpetually. If known malicious processes want to start, TeaTimer immediately terminates them, giving you three options how to deal with this process in the future:
be informed when the process tries to start again
automatically kill the process
generally allow the process to run
There is also an option to delete the file associated with this process.
If something tries to change critical registry keys, TeaTimer will detect it.
TeaTimer can protect you against such changes by giving you an option: You can either Allow or Deny the change. TeaTimer is always running in the background.

Since Spybot-S&D 1.6 the TeaTimer uses our database where known files are rated as good or dangerous. This database contains several hundreds of thousands entries and is enlarged continuously. Nonetheless now and then there are files which are not contained yet. In these cases and if you use older Spybot versions Resident TeaTimer will ask your permission for every change. If you are not sure if you should allow the change, there is a simple rule of thumb:
If you have been installing something and/or if you judge the file that is going to be installed as good because you know its name, you can proceed by allowing the registry change (same thing if you or Spybot-S&D were deleting an application). But if the message comes out of the blue sky while you were surfing the web, you should get cautious. In this case it is better to deny the registry change.
You start Resident TeaTimer by clicking on Tools → Resident on the left navigation bar (therefore Spybot-S&D has to run in Advanced Mode). There you can tick the checkboxes next to Resident “TeaTimer” (Protection of over-all system settings) active in order to activate TeaTimer.
Of course it is possible to revise each of your personal decisions. That could be necessary if you have denied some process which turns out as a good one later. You do so by right clicking on the TeaTimer symbol in the system tray – it is the blue one with the lock. (If you cannot see the symbol, it is probably hidden. Just click on the arrows in the system tray to show all hidden symbols.) A window appears where you have to click on Settings to modify your personal lists of registry changes and processes.


This is NOT written by me. Original: HERE

- MSConfig
1. Open your start menu.
2. Search: "msconfig" without the quotes.
3. Click "Startup".
4. Uncheck everything except your AV.


- Safe Mode
1. Restart your computer and start it in Safe Mode.
2. Run a scan with any AV.


- TFC
1. Download it(link at the name)
2. Close every program you have open.
3. If you fail to close/didn't remember anything, it'll close it automatically without saving.
4. I'd recommend to run it as admin, but you can run it normally too(If you don't run it as admin, it'll ask for access).
5. Click the "Start" button, and don't run any games or close it before it've been done.
6. It'll sometimes reboot automatically, but if it doesn't, make sure you reboot.



Slow Computer - Read on​


- CCleaner
1. Download it(link at the name).
2. Install it(I'd recommend to run is as admin).
3. Click on "Windows" and tick all of the boxes.
4. Click "Run Cleaner"
5. Click on "Applications" and tick all of the boxes.
6. Click "Run Cleaner"
7. Click on "Registry" and tick all of the boxes.
8. Click "Scan for Issues"
9. Click "Fix selected issues"


- TFC
1. Download it(link at the name)
2. Close every program you have open.
3. If you fail to close/didn't remember anything, it'll close it automatically without saving.
4. I'd recommend to run it as admin, but you can run it normally too(If you don't run it as admin, it'll ask for access).
5. Click the "Start" button, and don't run any games or close it before it've been done.
6. It'll sometimes reboot automatically, but if it doesn't, make sure you reboot.


- Drivers up to date?
1. Start menu.
2. Right click "Computer" / "My Computer"
3. Click "Manage"
4. Click "Device Manager"
5. Click on all the devices you see and click;
(*. NB: If you've installed the drivers via a CD, click: "Browse my computer for driver software" then do;)
6. "Search automatically for updated driver software.
7. Right click the device and click "Properties".
8. Look at the "Device status", if it says: "This device is working properly." the device/driver is working, if it says something else, tell me.


- Areo
(*. NB: This is only necessary if you know you got a bad CPU and you got 1GB RAM/Memory.)

1. Right click your desktop.
2. Click "Personalize".
3. Look at the "Basic and High Contrast Themes"
4. Click on "Windows Classic"


- MSConfig
1. Open your start menu.
2. Search: "msconfig" without the quotes.
3. Click "Startup".
4. Uncheck everything except your AV.
5. Click "Boot"
4. Change the Timeout(default 30sec) to 60sec. This might slow your booting.
4


- Delete unnecessary programs
1. Open your start menu.
2. Click "Control Panel"
3. Make sure it is: View by: Category - then you'll find: Programs; Uninstall a program < Click that.
4. Delete programs that you don't need.



- System Restore
(*. NB: This is only necessary if your PC was a lot faster earlier, and you've followed my tutorial steps by steps.)

1. Click on the Start Menu
2. Search: "System Restore"(without the quotes).
3. Click "Next".
4. Choose a time that you know you didn't have the problem(lagging, slow computer, virus, etc.) or had any issues.
5. Click "Next" and finish the system restore/rollback.



Still slow, still think you're infected?​
Slow? It could be that one of your drivers need an update, or it could be a hardware fault.
Infected? Maybe you've followed my TUT, but got infected 3 days after? Well, there are tons of way of spreading. One way is USB spreading. If you've plugged in your USB that are infected, you'll be infected too. There's also viruses at Facebook that can easily hack your computer too.
This is just a tip if you get infected a lot.

But if you don't think it's something that I said above, try this:

- Format/reinstall your HDD
(*. NB: This is only necessary followed my steps by steps, and other tutorials here on HackForums.)
(*. You might need to have another computer to do this.)

1. For laptops you can just restart your computer, click ESC while it's booting, and look up "Reinstall Windows". (It's very easy on how you reinstall, so I won't put a tutorial here.
2. For desktops, you you have to go on another computer.
3. You could just connect your HDD to your another MOBO, or you need any kind of a HDD wire/cable so you can connect it to your computer.
4. Right click the HDD.
5. Click "Format".
6. Click "Start format".
7. That'll format your hardisk 100%.


- BONUS: Need an OS? Only W7, post a comment/PM/skype if you need another OS.
Windows 7 Professional 32-Bit (x86 = 32 bit 1GB RAM is required) Digital River Download:
http://msft-dnl.digitalrivercontent.net/msvista/pub/X15-65804/X15-65804.iso

Windows 7 Professional 64-Bit (x64 = 64 bit 2GB RAM is required) Digital River Download:
http://msft-dnl.digitalrivercontent.net/msvista/pub/X15-65805/X15-65805.iso


1. As you see, it's a .iso file, that means you have to burn it into a disk. If you need help with that, I can do it for you. You don't need any software or anything to burn a disk.

2. After you've downloaded and burned it into the disk, restart your computer and make your DVD as number 1. boot. Boot the CD.

3. When you're booting it, you can choose between:
- Upgrading
- A new copy of windows

4. Don't care about the Upgrading, but focus on a new copy of windows. It'll take your old Windows, which you're on now and put it:
C:/Computer/Windows.000

You can access all of your files, etc. there.

5. Complete the installation from the disk, it'll take from 10-30 minutes, it depends on your disk, cpu, etc.
When it's done, you can access your old files, but as you might saw, it's only 30 days...

6. If you send me a PM regarding this, or add me on skype, I can give you a program that gives you the full version of the Windows 7 Pro :) You can also upgrade to Ultimate for free ;)


DDoSed/Booted/Doxed/Botnet?​

What's a DDoS?
It's a cyberattack in which many, usuallycompromised, computers send a series of packets, data, ortransactions over the network to the intended attack victim(or victims) in an attempt to make one or more computer-based services (such as a web application) unavailable tothe intended users.

What's booted/booting?
Booting is a process in which your computer gets initialized. This process includes initilizing all your hadware components in your computer and get them to work together and to load your default operating system which will make your computer operational.
- Ganderton


What's Doxing/doxed?
A person will have every detail of you. Sometimes, it's an easily dox, they might just have your IP, but sometomes they could have your birth number, details about your family, etc.


Botnet/Zombie?
If you're a zombie, you can get DDoSed, etc. A zombie is a tester for the hacking tools.


Common ways to get DDosed and doxed:
-
Through skype
- Through website
- Through servers


I would say that skype is the easiest way to get the IP of a person and begin to dox/DDoS him. If you call the hacker, they can easily find your IP within few seconds. There are also programs out there, for example "Skype IPlogger". You put in the victim name, and you'll get all of the IPs that have been logged at that skype. So beware when you're adding persons on skype.
When you're visiting a website, you'll leave your IP. For example the owner of retros/private servers have a log of every IP that have logged on an account.
Through servers, I mean being hacked. Download a RAT/Keylogger, or something. Well, they could easily browse through your documents and find personal stuff that are important to start a dox, and they can find your IP on the RAT.


How to prevent it:
-Use Proxy/VPN
- Scan weekly
- Look at your traffic
- Beware when your visiting
- Skype...


- Use Proxy/VPN
1. There are many Proxys and VPNs for free out there. You should use it if you got many personal documents and stuff you don't want to show the world. Use a Proxy or VPN if you want to stay safe online. A Proxy/VPN is changing your IP.
2. Here's one I really suggest you: Hot Spot Shield


- Do a full scan weekly
1
. Do a full scan with your AV weekly. That will prevent your computer to have a lot of virus.
2. I'll recommend to do at least one full scan each month


- Look at your traffic
1
. This video will tell you everything: LINK

- Beware when your visiting
Runescape RSPS(RuneScape Private Server), Habbo retros, CSS no steam client, you name it...
They can EASILY grab your IP, so do a huge research before you "join" or "visit" something. Sometimes you could be ripped your IP when you're visiting a website.


- Skype...
1
. Never add a person that you don't know.
2. Never call a person if you don't know who he is. They can use netstat to grab your IP just for calling.
 
Top