> Spyware Encyclopedia Page 94 > NetSphere

NetSphere removal

Spyware NetSphere Information
Name: NetSphere Category: RAT Author: Adam Beefcake McGirr Coded in: Delphi. Compressed with ASPack. Dangerous: Yes

NetSphere is one of RAT spywares.
Finding it on your computer means that your computer is infected with RAT and crucial data could be endangered or even lost.

NetSphere description by Adam Beefcake McGirr:

Vendor: ´ 1 Keylogging Keylogging will not work immediatley. 1st, you must do this: 1. Connect to the target. 2. Open the File System. 3. Upload the keylogging DLL in your local NetSphere directory (khd2.dll) to their C:\WINDOWS\SYSTEM directory, or wherever their WINDOWS\SYSTEM directory is. You can not rename this file. 4. After the upload has finished, go Target > Server > Restart Server. It´s still a little buggy, & for some unknown reason, makes some games (namely Quake II) exit unexpectedly. 2 Newbie Directions 1. The target MUST run the server ("NetSphereServer.exe") on their computer. You can either run this on their computer yourself, or you can rename it to smth & then trick them into running it. 2. Get their IP. There are many ways of doing this; the best way is with ICQ. Go to section 5 fore more detailed instructions. 3. Run the client (NetSphereClient.exe). Enter their IP into the "IP or DNS" box, & hit "Connect". Keep an eye on the status bar. Once it has connected, the "Target" button will become active. You can then do stuff to/on the remote computer. 3. When you are done, hit "Disconnect", or just near the client. 3 Client Parameters NetSphereClient.exe /connect (IP or DNS) You can directly connect to an IP with the /connect parameter. NetSphereClient.exe /debug You can have it display debug info (for your prying eyes) with the /debug parameter. If the client is behaving strangely, you may wanna have it display various tidbits of data, to assist in tracking down your problem. NetSphereClient.exe /noannounce The client won´t try to download the announcements from the NetSphere web server. This is usefull if you do not have internet access from where you´re operating. 4 Server Parameters NetSphereServer.exe /visible You can run the server in Visible mode. You can then configure some extra features through the server´s GUI. 5 Getting an IP from ICQ 1. Right-click on one of your contacts, then select "Info" (near the bottom). 2. Their IP will be in the box labeled "Current/Last IP". 3. Right-click in the IP box, then select "Select All". 4. Right-click in the IP box (again), then select "Copy". 5. Open NetSphere Client. 6. Right-click inside the "IP or DNS" box, then select "Paste". 7. Click on "Connect".

This RAT is also known as:

•Backdoor.NetSphere.127.
• Backdoor.NetSphere.130 .
• Backdoor.NetSphere.131.
• Backdoor.NssKill.

>> Delete NetSphere automatically - Download Spyware Doctor

NetSphere Removal Instructions
Kill the following processes netsphere129.exe, netsphereclient.exe, netsphereserver.exe, nrsvr.exe, ns.exe, nssx.exe
Delete these registry entries HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\nssx
Remove the following files netsphere.txt, netsphere129.exe, netsphereclient.exe, netsphereserver.exe, nrsvr.exe, ns.exe. nssx.exe in Windows\system\

Bookmark NetSphere page

Previous Spyware: Remove NetSource101

Next Spyware: Remove Netsphere 1.27