Stunnel-4.10

[jblifestyles]

I found this program on my computer yesterday. It apparently installed itself because I have no recollection of doing such. I discovered it running, and don't know what to do. It appears in task manager, along with a Proxydaemon.exe I found the folder it is in on the C: drive. It is in folder SSL - and has 3 files - connect.conf , stunnel.conf , and Stunnel-4.10.exe

I opened the .conf files as text, and got the following:

connect.conf:
useIE=yes
direct=yes
proxy=???
final=???
useAuth=no
username=???
password=???

stunnel.conf:
client=yes
taskbar=no

[DIRECT]
accept=8302
connect=216.148.249.17:443

[PROXY-DAEMON]
accept=8303
connect=127.0.0.1:8310
--------------------------------------------------

The program autostarts when I start windows... it does not appear in msconfig, so I cannot disable it. It does not show up in add/remove programs, so I cannot uninstall it.

I changed the taskbar to =yes in stunnel.conf so I could see the options. Then ran stunnel. windows firewall obviously blocked it, but I was able to get this log file:

log:
2006.11.25 12:10:54 LOG5[2244:2500]: stunnel 4.10 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.7f 22 Mar 2005
2006.11.25 12:10:54 LOG5[2244:2696]: No limit detected for the number of clients



If anyone has an idea of how I should handle this situation, I would appreciate it.

Thanks

 

[Ian]

That doesn't seem good at all, and I'd suggest removing it ASAP. Hopefully as you say windows firewall has stopped it.

You should be able to delete the file using this application (it will unlock anything in use):

http://ccollomb.free.fr/unlocker/

Running HijackThis will allow us to see how the file is loading up:

http://www.spywareinfo.com/~merijn/programs.php#hijackthis

"Stunnel is a program that allows you to encrypt arbitrary TCP connections inside SSL (Secure Sockets Layer). Stunnel can allow you to secure non-SSL aware daemons and protocols (like POP, IMAP, LDAP, etc) by having Stunnel provide the encryption, requiring no changes to the daemon's code."

http://www.net-security.org/software.php?id=271