upnpclient.exe

I installed several programs the other day and not soon after, my firewall told me that this file was attemping to access the net.

I blocked it but now I can't get rid of it.

I couldn't find out much about it though....one site was talking about it being a trojan but nothing I have scanned with sees it.

I uninstalled the programs I had installed because I didn't know which one put this file here.

It shows up in windows/prefetch, and I can delete it/rename it/ move it....but when I restart my computer.....there it is again. So something keeps reinserting it into prefetch.

Anybody have any ideas?

Running Windows XP SP2

 

This is what my firewall tells me.

Application upnpclient.exe trying to establish a connection to the remote address dyn-8-99.myactv.net and by the port HTTP (80).

 

SportsNut,

I found some information on upnpclient.exe and I think the first thing you should do is in task manager see if this process MSLib16s is running under the applications tab.

Both of these are considered suspect right now (as far as I can find out) and are using the feature described here by Microsoft Support, http://www.microsoft.com/Downloads/...FamilyID=D17CBEB5-7478-4147-B4BA-E6CF686A352B

The good news is when you get rid of them this patch should prevent further problems considering you are updated on everything.

Use WinPatrol here, http://majorgeeks.com/download3380.html to try to kill the Active process and remove it from the startup list.

Make sure System Restore is OFF and you have Enabled the Viewing of Hidden Files.

Look in C:\Windows\Prefetch for accdisk and delete any entries.

As I said, this is all I could locate for you and this does seem to be fairly new. If the problems continue check with the guy’s in Spyware, maybe they have a little more info and can help.

Good luck,

Steve

 

It is a trojan/keylogger.

It will try to send the captured information to a host on port 80.

Fore more info read:
http://www.wilderssecurity.com/showthread.php?t=54750

It can be detected with DiamondCS TDS-3 Evaluation
http://tds.diamondcs.com.au/index.php?page=download
Remember to update the database for this program, at:
http://tds.diamondcs.com.au/index.php?page=update

Mcafee might detect it as PassDump.c,
if "find unknown program viruses"/heurestic is enabled.