1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

What is stuffer.exe brought by Statblaster 7.0??

Discussion in 'Link Building' started by omoxx, Mar 1, 2010.

  1. omoxx

    omoxx Regular Member

    Joined:
    Feb 21, 2008
    Messages:
    346
    Likes Received:
    18
    Be aware!! this : after you run it, puts stuffer.exe into temp folder and runs it up right after Statblaster 7.0 does its job.

    That stuffer.exe changes your internet connection option to Proxy and opens port and tries to connect to external server, etc.

    :confused:
     
    • Thanks Thanks x 5
    Last edited: Mar 1, 2010
  2. mic141414

    mic141414 Regular Member

    Joined:
    Jul 3, 2008
    Messages:
    344
    Likes Received:
    117
    Location:
    USA
    Home Page:
    thank you very much now i understand why my IE or Firefox couldnt connect to Internet (change connection settings) but problem is that i cannot find stuffer.exe anywhere.
     
  3. richcamp

    richcamp Regular Member

    Joined:
    Oct 5, 2009
    Messages:
    315
    Likes Received:
    119
    Does stuffer.exe only appear when you open statblaster and dissapear when you close it or does it stays on your temp folder?

    I couln't find it either
     
  4. mic141414

    mic141414 Regular Member

    Joined:
    Jul 3, 2008
    Messages:
    344
    Likes Received:
    117
    Location:
    USA
    Home Page:
    i opened statblaster ..and finally found stuffer in \AppData\Local\Temp\nsf8334.tmp
    Cannot remove it with unlocker so i will reboot and see if unlocker can remove this shit
    Thank you omoxx for that as i was pissed off to have my connection changed and no antivirus or malware found anything
     
  5. mic141414

    mic141414 Regular Member

    Joined:
    Jul 3, 2008
    Messages:
    344
    Likes Received:
    117
    Location:
    USA
    Home Page:
    ok the folder is removed but the connection was changed again
    so i dont know how to get rid of it for good and of course statblaster is not anymore present on my pc
    Damn
     
  6. kranium

    kranium Newbie

    Joined:
    Dec 27, 2008
    Messages:
    22
    Likes Received:
    3
    What a mess this Statsblaster has turned out to be. What O/S are you guys running? I just ran it on Windows 7 x64 and can't find any traces of stuffer.exe or of any attempted changes to my proxy or firewall settings? I'm also running Microsoft Security Essentials and it has failed to detect anything, I'll try running a Malwarebytes scan and see if anything turns up. You might want to try a rootkit revealer (Sophos Anti-rootkit is a good one) to see if it can pick anything up also.
     
    Last edited: Mar 1, 2010
  7. khabibf

    khabibf Junior Member

    Joined:
    Feb 15, 2009
    Messages:
    174
    Likes Received:
    10
    Mine too.
    I got my internet connection very very slow...
    :-( I need to reinstall my wind**s. And I put deepfreezee on it.
     
  8. jaybird

    jaybird Regular Member

    Joined:
    Oct 26, 2009
    Messages:
    212
    Likes Received:
    75
    Location:
    {Over|Above|Below} the {Rainbow|Misty Clouds|Sunse
    I beleive this is one of the problems I have been tracking down with Scrapebox acting badly at times , I noticed it after I would run statblaster ...

    It either hides (renames itself) or deletes itself after a reboot or shutdown...

    I'd like to kick some assssssssss :swordfigh
     
  9. pgaoroagnloeid

    pgaoroagnloeid Junior Member

    Joined:
    Aug 11, 2008
    Messages:
    108
    Likes Received:
    25
    anyone know what needs to be done?
     
  10. kranium

    kranium Newbie

    Joined:
    Dec 27, 2008
    Messages:
    22
    Likes Received:
    3
    Try downloading Malwarebytes and running a full scan. Remove everything it finds. Then download Microsoft Security Essentials (if you have a legit copy of Windows), do a full scan and remove anything it finds. Download Sophos Anti-Rootkit and remove anything that it finds that looks suspicious to you. You can also try Trend Micro's free Housecall utility and Microsoft's latest Malicious Software Tool if all else fails.
     
    • Thanks Thanks x 1
  11. omoxx

    omoxx Regular Member

    Joined:
    Feb 21, 2008
    Messages:
    346
    Likes Received:
    18
    I don't know if stuffer.exe was present in previous versions of Statblaster: I remember using release 4.1 and nothing of this happened!

    Where is Syctos, the author and responsible of this?

    Thanxxx
     
  12. Hellfire

    Hellfire Regular Member

    Joined:
    Jun 27, 2009
    Messages:
    241
    Likes Received:
    150
    Occupation:
    Student
    Location:
    Norway
    Here you go :D
    Code:
    http://www.symantec.com/security_response/writeup.jsp?docid=2003-111112-0532-99&tabid=3
     
  13. kranium

    kranium Newbie

    Joined:
    Dec 27, 2008
    Messages:
    22
    Likes Received:
    3
    That's for a different executable, just happens to have the same name. That won't work for those that are infected from this Statblaster, unfortunately.
     
    Last edited: Mar 1, 2010
  14. jaybird

    jaybird Regular Member

    Joined:
    Oct 26, 2009
    Messages:
    212
    Likes Received:
    75
    Location:
    {Over|Above|Below} the {Rainbow|Misty Clouds|Sunse
    Running TrendMicro RUBOTTED now ... its free and saved my PC one time

    Will report back

    Jaybird


    No Bot activity, but it runs in the tray and will inform me of any connections(and to where) ...I'll try to keep this updated

    [​IMG]


    [​IMG]

    Jaybird
     
    Last edited: Mar 1, 2010
  15. mic141414

    mic141414 Regular Member

    Joined:
    Jul 3, 2008
    Messages:
    344
    Likes Received:
    117
    Location:
    USA
    Home Page:
    Malwarebytes didnt find anything
    i am trying Anti rootkit now

    If anyone finds the solution please let us know Thanks
     
  16. jaybird

    jaybird Regular Member

    Joined:
    Oct 26, 2009
    Messages:
    212
    Likes Received:
    75
    Location:
    {Over|Above|Below} the {Rainbow|Misty Clouds|Sunse
    SuperAntiSpyware found nothing ...
     
  17. kranium

    kranium Newbie

    Joined:
    Dec 27, 2008
    Messages:
    22
    Likes Received:
    3
    I'm beginning to suspect that this might have been a drive-by infection from one of the shady websites on the list that was pinged by statblaster, and may not have been caused by statblaster itself. I have run every tool I can think of to detect a rootkit or malware on my system and can't find anything. I did not use the original 30,000+ URL list that was provided, I used the cleaned up one that had all the foreign domains removed. I wonder if maybe it was one of those sites that infected people when stablaster hit it.
     
  18. kranium

    kranium Newbie

    Joined:
    Dec 27, 2008
    Messages:
    22
    Likes Received:
    3
    TCPView Works good for this too, if you want to watch raw real time connections from individual processes.
     
  19. jaybird

    jaybird Regular Member

    Joined:
    Oct 26, 2009
    Messages:
    212
    Likes Received:
    75
    Location:
    {Over|Above|Below} the {Rainbow|Misty Clouds|Sunse
    @ kranium :

    I am thinking the same thing ... Yesterday AVG caught and removed several tmp files from a blaster run yesterday ... from my temp folder.

    Maybe that did it ... after I rebooted it has all been well.

    I used TCPView for years, but havent in a while... thanks

    Jaybird
     
  20. j0b0123

    j0b0123 Regular Member

    Joined:
    Oct 30, 2009
    Messages:
    262
    Likes Received:
    218
    Occupation:
    professional trader - stocks, forex, futures
    Location:
    Las Vegas, USA
    Home Page:
    That is my guess, I have NOD32 running, and when I use statblaster it will flag some of the sites and say it blocks connection to them.