Re: Dave re upnpclient.exe being w32/backdoor.SO and acrobat.dll WAS Trojan in c:\windows. I can`t delete and neither can F-prot For Windows.

Re: Dave re upnpclient.exe being w32/backdoor.SO and acrobat.dll WAS Trojan in c:\windows. I can`t delete and neither can F-prot For Windows.: Posted by donnie on March 4th, 2005; On Wed, 02 Mar 2005 21:09:21 -0500, Buddy B@yippy.ti.ye wrote:

Disable the Universal Plug & Play Device Host in Services. (Control
Panel > Administrative Tools > Services)
|
|
|
V
http://www.winguides.com/forums/show...sed&sb=5&part=; Posted by David H. Lipman on March 4th, 2005; "donnie" <donnie@queyosepa.org> wrote in message
news:r4gf21hpk5i6s1g1k2i2g1orne11vhf6o0@4ax.com
| On Wed, 02 Mar 2005 21:09:21 -0500, Buddy B@yippy.ti.ye wrote:
|
|| Zone alarm firewall alerted that Process 1508; upnpclient.exe was trying to
|| contact: 65.130.111.232HTTP
||
|| Properties of upnpclient.exe shows:
|| cmd line shortcut is C:\system volume info\upnpclient.exe
| ############################
| Disable the Universal Plug & Play Device Host in Services. (Control
| Panel > Administrative Tools > Services)
| |
| |
| |
| V
|
http://www.winguides.com/forums/show...sed&sb=5&part=

Donnie:

I think that thread is a Red Herring. Otherwise you would see the uPnP IP Multi-cast
address at the FireWall, not 65.130.111.232 @ TCP Port 80.

--
Dave

Similar Posts