It seems I’ve a Trojan horse that is coming again and again. Every time I scan my Windows/System32 folder file called supu.exe is present and it is infected with Win32:Plexus [Wrm]
I did through scan including archive scan 2 times but I could not find any infected file. I dont use IE or Outlook instead I use Firefox and Thunderbird. I’m stilll getting this virus and my firewall always tells me that some request is trying to connect remote host!
How do i monitor one folder and find out which program is creating this file? Or how do i stop this virus and the program that is writing this file?
1] Go HERE and install ALL security patches/updates
2] Install a firewall (ZoneAlarm, Kerio and Sygate offer free ones)
3] Run a full system scan
4] Run HijackThis and post the log here
The virus makes use of a exploit in windows. If you would have had installed ALL security patches/updates your system wouldn’t have gotten infected in the first place.
The fact that you don’t use IE doesn’t get rid of some of the vulnerabilities as IE is integrated deeply into the Windows OS.
You will need IE in order to connect to windows update (as Eddy stated, you need to patch your OS) in order to get your OS patched. So regardless of if you use IE on not, you need to keep IE up to date. Untill MS removes integration from the OS and allows other browsers to connect and update the OS (don’t hold your breath), you will need IE.
Connecting to the windows update site without IE (or some of the IE based browsers, Avant), it won’t work as MS uses activex and Firefox doesn’t support activex.