What is stuffer.exe brought by Statblaster 7.0??

[omoxx]

Be aware!! this : after you run it, puts stuffer.exe into temp folder and runs it up right after Statblaster 7.0 does its job.

That stuffer.exe changes your internet connection option to Proxy and opens port and tries to connect to external server, etc.

 

[mic141414]

thank you very much now i understand why my IE or Firefox couldnt connect to Internet (change connection settings) but problem is that i cannot find stuffer.exe anywhere.

 

[richcamp]

Does stuffer.exe only appear when you open statblaster and dissapear when you close it or does it stays on your temp folder?

I couln't find it either

 

[mic141414]

i opened statblaster ..and finally found stuffer in \AppData\Local\Temp\nsf8334.tmp
Cannot remove it with unlocker so i will reboot and see if unlocker can remove this shit
Thank you omoxx for that as i was pissed off to have my connection changed and no antivirus or malware found anything

 

[mic141414]

ok the folder is removed but the connection was changed again
so i dont know how to get rid of it for good and of course statblaster is not anymore present on my pc
Damn

 

[kranium]

What a mess this Statsblaster has turned out to be. What O/S are you guys running? I just ran it on Windows 7 x64 and can't find any traces of stuffer.exe or of any attempted changes to my proxy or firewall settings? I'm also running Microsoft Security Essentials and it has failed to detect anything, I'll try running a Malwarebytes scan and see if anything turns up. You might want to try a rootkit revealer (Sophos Anti-rootkit is a good one) to see if it can pick anything up also.

 

[khabibf]

Mine too.
I got my internet connection very very slow...
:-( I need to reinstall my wind**s. And I put deepfreezee on it.

 

[jaybird]

I beleive this is one of the problems I have been tracking down with Scrapebox acting badly at times , I noticed it after I would run statblaster ...

It either hides (renames itself) or deletes itself after a reboot or shutdown...

I'd like to kick some assssssssss :swordfigh

 

[pgaoroagnloeid]

anyone know what needs to be done?

 

[kranium]

anyone know what needs to be done?

Try downloading Malwarebytes and running a full scan. Remove everything it finds. Then download Microsoft Security Essentials (if you have a legit copy of Windows), do a full scan and remove anything it finds. Download Sophos Anti-Rootkit and remove anything that it finds that looks suspicious to you. You can also try Trend Micro's free Housecall utility and Microsoft's latest Malicious Software Tool if all else fails.

 

[omoxx]

I don't know if stuffer.exe was present in previous versions of Statblaster: I remember using release 4.1 and nothing of this happened!

Where is Syctos, the author and responsible of this?

Thanxxx

 

[Hellfire]

Here you go

http://www.symantec.com/security_response/writeup.jsp?docid=2003-111112-0532-99&tabid=3

 

[kranium]

Here you go

http://www.symantec.com/security_response/writeup.jsp?docid=2003-111112-0532-99&tabid=3

That's for a different executable, just happens to have the same name. That won't work for those that are infected from this Statblaster, unfortunately.

 

[jaybird]

Running TrendMicro RUBOTTED now ... its free and saved my PC one time

Will report back

Jaybird


No Bot activity, but it runs in the tray and will inform me of any connections(and to where) ...I'll try to keep this updated

Jaybird

 

[mic141414]

Malwarebytes didnt find anything
i am trying Anti rootkit now

If anyone finds the solution please let us know Thanks

 

[jaybird]

SuperAntiSpyware found nothing ...

 

[kranium]

I'm beginning to suspect that this might have been a drive-by infection from one of the shady websites on the list that was pinged by statblaster, and may not have been caused by statblaster itself. I have run every tool I can think of to detect a rootkit or malware on my system and can't find anything. I did not use the original 30,000+ URL list that was provided, I used the cleaned up one that had all the foreign domains removed. I wonder if maybe it was one of those sites that infected people when stablaster hit it.

 

[kranium]

No Bot activity, but it runs in the tray and will inform me of any connections(and to where) ...I'll try to keep this updated

Jaybird

TCPView Works good for this too, if you want to watch raw real time connections from individual processes.

 

[jaybird]

@ kranium :

I am thinking the same thing ... Yesterday AVG caught and removed several tmp files from a blaster run yesterday ... from my temp folder.

Maybe that did it ... after I rebooted it has all been well.

I used TCPView for years, but havent in a while... thanks

Jaybird

 

[j0b0123]

I'm beginning to suspect that this might have been a drive-by infection from one of the shady websites on the list that was pinged by statblaster, and may not have been caused by statblaster itself. I have run every tool I can think of to detect a rootkit or malware on my system and can't find anything. I did not use the original 30,000+ URL list that was provided, I used the cleaned up one that had all the foreign domains removed. I wonder if maybe it was one of those sites that infected people when stablaster hit it.

That is my guess, I have NOD32 running, and when I use statblaster it will flag some of the sites and say it blocks connection to them.