recurrent trojan

system · 2007-02-14T01:41:42.000Z

I performed a search and couldn’t find any information concerning a malicious program calling itself “stup9x.exe” It is directly related to and generates the win32 downloader Trojan. I was wondering if the avast user community forums had any ideas on how to remove this as it is hidden somewhere deep in the system. This malware creates a folder labeled “_” and in the folder are around 100 compressed files. Deleting this _ folder doesn’t seem to make any difference. It also generates a .jpg file in the folder \localsettings\temporaryinternetfiles\Content.IE5\h8jdmtns. Avast catches these and places them into the virus chest. I turned off the system restore and ran boot scan and even a full system scan to no avail. I have a suspicion this is a key logger as it attempts to access the internet every 15 minutes. I think I will have to get into the registry to scour this out.

Thank you in advance for any help rendered.
I use Win XP Pro SP2 and Mozilla Firefox

system · 2007-02-14T03:07:45.000Z

Welcome to the forum, Cathode_Ray.

Prevx identifies a downloader using the file name stup9x.exe as Drev A (2nd from the bottom of the list)

http://virusinfo.prevx.com/pxresearchfiles.asp

Try scanning with the free version of Prevx, which you can download here, to see of it solves the problem

http://info.prevx.com/downloadremove.asp

system · 2007-02-15T05:55:18.000Z

Previx did indeed work. I ended up going through the registry anyway. I am always a little leery of items that say they perform a function for free, mainly they just identify it and removal is where they hit you in the pocketbook. But Previx turned out to be OK. I think I might include this in my arsenal along with Avast and Ad-aware. So purchasing it is not a problem now that they do what they say. I am just a hardcore principle kinda guy. Thanks for your help.

system · 2007-02-15T12:21:01.000Z

Rather than a crippled version of the program, Prevx time-limits their demo to 30 days from the first detection. It really is a good program, though heavy on resources.

I’m glad things worked out for you.

Announcements