Page 1 of Is this a virus?

just reformatted my pc and it went crazy when I first did windows update, restarted, installed avast and it got rid of 9 viruses. (lord knows how I got them i`d be online all of 10 seconds and only on the wondows update site)

Everything seems to be okay now, managed to get XP SP2 installed without any problems, but I have a file called `upnpdrv.exe` that keeps asking for internet access, keeps trying to access `0xDEADBEEF.martiansong.com`

It apparently in my windows\system32 folder although I can`t find it and a search turns up nothing, google turns up nothing and yet avast and trend don`t detect any viruses on my system.

So, does anyone have any idea what it is? and if it is a virus, how do I get rid off it.


Rev

This item was edited on Saturday, 2nd July 2005, 23:01

I don`t know what that file is but it seems like a dialler in which case anti-virus programs will not pick it up (because it is not a virus) but anti-spyware programs such as AdAware or Spybot should. Be careful of some anti-spyware programs whcih actually puts more spyware on your PC.

After you install Windows, it is paramount that the XP firewall is turned on before going on the internet because you will receive viruses and/or spyware within minutes of connecting. Microsoft overlooked the fact that the firewall should be turned on after installing Windows and do not even warn the user that Windows had not enabled the firewall. Good news for SP2 users is that installing SP2 does enable the firewall so for anybody performing a similar install, it is best to either:-

1. Install Windows first and switch on the firewall manually

or

2. Install Windows then XP2 so the firewall is automatically switched on

or

3. Create a Windows XP and SP2 combined installation on one CD

http://securityresponse.symantec.com/avcenter/venc/data/w32.toxbot.c.html
note its very new as they`ve only had a detecion for it since 1st and not available in liveupdate till 6th of july ( wednesday as usual for norton) but there is a removal tool at that address. I found it by looking for martiansong on google

This item was edited on Sunday, 3rd July 2005, 18:55

Hi
Thanks for the replies.

I had tried ad-aware, spy ware, spybot and spy cleaner gold. none of them picked anything up at all. I had tried avast virus scanner, zone alarms, trend, norton, mcafee and the tool for the W32.toxbot all to no avail.

Ended up reformatting again, used killdisk to make sure everything was gone, unplugged my modem and installed sygate and avast before going online, thankfully I seem virus free up to now.


Rev