utorent and windows 7 64 bit

pirate13xx · January 18, 2010

i have found a bug in Utorrent 1.8.5 build 17414

running on windows 7 ultimate 64 bit

the application would hang/freeze occasionally usually it would fix itself and start working again, however sometimes i would need to open up task manager and kill the process then start up Utorrent again. this was a minor inconvenience, until i found out that Utorrent was reporting a bad ratio to one of my trackers(apparently i was uploading more than i actually had), which they were not happy about.

i have used utorrent for some time and this is the first problem i have run into

i am reluctant to downgrade back to xp, as i have everything set up just the way i like it.

i figured someone here would like to know about this

moogly · January 18, 2010

Maybe hostile software injected into µT.

Post Hijackthis and Process Explorer logs when uT is running (and freezing if possible).

Select utorrent.exe and enable DLL mode (ctrl+D) in PE.

Guide: http://forum.utorrent.com/viewtopic.php?id=29748

pirate13xx · January 18, 2010

http://pastebin.com/m3df7eeeb

heres the text, i do see a few odd things in it, maybee you could point out whats wrong

moogly · January 19, 2010

And about Process Explorer log?

NB: copy/paste the logs directly in your post (without CODE tag), easily to read, thx.

pirate13xx · January 19, 2010

1.

Logfile of Trend Micro HijackThis v2.0.3 (BETA)

2.

Scan saved at 3:51:12 PM, on 1/18/2010

3.

Platform: Unknown Windows (WinNT 6.01.3504)

4.

MSIE: Internet Explorer v8.00 (8.00.7600.16384)

5.

Boot mode: Normal

6.

7.

Running processes:

8.

C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe

9.

C:\Program Files (x86)\Curse\CurseClient.exe

10.

C:\Program Files (x86)\PrinterShare\paConsole.exe

11.

C:\Program Files (x86)\PdaNet for iPhone\PdaNetPC.exe

12.

C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

13.

C:\Program Files (x86)\ScanSoft\TextBridgePro11.0\opware32.exe

14.

C:\Program Files (x86)\AVG\AVG8\avgtray.exe

15.

C:\Program Files (x86)\iTunes\iTunesHelper.exe

16.

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

17.

C:\Program Files (x86)\mIRC\mirc.exe

18.

C:\Program Files (x86)\uTorrent\uTorrent.exe

19.

C:\Program Files (x86)\TrendMicro\HiJackThis\HiJackThis.exe

20.

21.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

22.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.i.com.ua/~video/

23.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

24.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

25.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

26.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

27.

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

28.

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

29.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

30.

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks=

31.

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com,

32.

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

33.

F2 - REG:system.ini: UserInit=userinit.exe

34.

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

35.

O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll

36.

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG8\avgssie.dll

37.

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL

38.

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

39.

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

40.

O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll

41.

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

42.

O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE

43.

O4 - HKLM\..\Run: [Omnipage] C:\Program Files (x86)\ScanSoft\TextBridgePro11.0\opware32.exe

44.

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

45.

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~2\AVG\AVG8\avgtray.exe

46.

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

47.

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

48.

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe" -autorun

49.

O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe"

50.

O4 - HKCU\..\Run: [CurseClient] C:\Program Files (x86)\Curse\CurseClient.exe -silent

51.

O4 - HKCU\..\Run: [PrinterShare] C:\Program Files (x86)\PrinterShare\paConsole.exe -minimized

52.

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

53.

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

54.

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

55.

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

56.

O4 - Startup: PdaNet Desktop.lnk = C:\Program Files (x86)\PdaNet for iPhone\PdaNetPC.exe

57.

O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

58.

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

59.

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

60.

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

61.

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

62.

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

63.

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

64.

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

65.

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

66.

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

67.

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

68.

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe

69.

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

70.

O13 - Gopher Prefix:

71.

O16 - DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} (Bl_camera Control) - http://192.168.0.253/bl_camera.cab

72.

O17 - HKLM\System\CCS\Services\Tcpip\..\{E9DC8075-B5F7-40D3-88BF-4EE298DAC664}: NameServer = 209.15.224.244,209.115.224.254

73.

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL

74.

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG8\avgpp.dll

75.

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files (x86)\Lavasoft\Ad-Aware 2007\aawservice.exe

76.

O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe

77.

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

78.

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

79.

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~2\AVG\AVG8\avgemc.exe

80.

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~2\AVG\AVG8\avgwdsvc.exe

81.

O23 - Service: Avid SDM Service (AvidSDMService) - Unknown owner - C:\Windows\system32\AvidSDMService.exe (file missing)

82.

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe

83.

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

84.

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

85.

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

86.

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

87.

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

88.

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

89.

O23 - Service: ManageEngineOpManagerApache - Apache Software Foundation - C:\PROGRA~2\ADVENT~1\ME\OPMANA~1\apache\bin\Apache.exe

90.

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

91.

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

92.

O23 - Service: ManageEngine OpManager (OpManager) - Unknown owner - C:\PROGRA~2\ADVENT~1\ME\OPMANA~1\wrapper.exe

93.

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

94.

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

95.

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

96.

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

97.

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

98.

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

99.

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

100.

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

101.

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

102.

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

103.

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

104.

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

105.

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

106.

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

107.

108.

--

109.

End of file - 11167 bytes

and processes

Process PID CPU Description Company Name

System Idle Process 0 85.63

Interrupts n/a Hardware Interrupts

DPCs n/a Deferred Procedure Calls

System 4 1.54

smss.exe 296 Windows Session Manager Microsoft Corporation

csrss.exe 372 Client Server Runtime Process Microsoft Corporation

wininit.exe 432 Windows Start-Up Application Microsoft Corporation

services.exe 496 Services and Controller app Microsoft Corporation

svchost.exe 652 Host Process for Windows Services Microsoft Corporation

svchost.exe 728 Host Process for Windows Services Microsoft Corporation

svchost.exe 812 Host Process for Windows Services Microsoft Corporation

audiodg.exe 3500 Windows Audio Device Graph Isolation Microsoft Corporation

svchost.exe 880 Host Process for Windows Services Microsoft Corporation

dwm.exe 2164 1.54 Desktop Window Manager Microsoft Corporation

svchost.exe 956 Host Process for Windows Services Microsoft Corporation

svchost.exe 364 Host Process for Windows Services Microsoft Corporation

svchost.exe 1124 Host Process for Windows Services Microsoft Corporation

aawservice.exe 1176 Ad-Aware 2007 Service Lavasoft

spoolsv.exe 1396 Spooler SubSystem App Microsoft Corporation

svchost.exe 1424 Host Process for Windows Services Microsoft Corporation

taskhost.exe 1492 Host Process for Windows Tasks Microsoft Corporation

AppleMobileDeviceService.exe 1584 Apple Mobile Device Service Apple Inc.

avgwdsvc.exe 1624 AVG Watchdog Service AVG Technologies CZ, s.r.o.

avgrsa.exe 208 AVG Resident Shield Service AVG Technologies CZ, s.r.o.

avgnsa.exe 1064 AVG Network scanner Service AVG Technologies CZ, s.r.o.

mDNSResponder.exe 1656 Bonjour Service Apple Inc.

svchost.exe 1704 Host Process for Windows Services Microsoft Corporation

svchost.exe 1788 Host Process for Windows Services Microsoft Corporation

avgemc.exe 1972 AVG E-Mail Scanner AVG Technologies CZ, s.r.o.

avgcsrvx.exe 1856 AVG Scanning Core Module - Server Part AVG Technologies CZ, s.r.o.

svchost.exe 2476 Host Process for Windows Services Microsoft Corporation

SearchIndexer.exe 3016 Microsoft Windows Search Indexer Microsoft Corporation

iPodService.exe 3460 iPodService Module (64-bit) Apple Inc.

FNPLicensingService.exe 3592 Activation Licensing Service Macrovision Europe Ltd.

svchost.exe 2724 Host Process for Windows Services Microsoft Corporation

msiexec.exe 1980 Windows® installer Microsoft Corporation

msiexec.exe 976 Windows® installer Microsoft Corporation

lsass.exe 504 Local Security Authority Process Microsoft Corporation

lsm.exe 512 Local Session Manager Service Microsoft Corporation

csrss.exe 448 Client Server Runtime Process Microsoft Corporation

winlogon.exe 560 Windows Logon Application Microsoft Corporation

explorer.exe 2220 Windows Explorer Microsoft Corporation

daemon.exe 2764 DAEMON Tools Lite DT Soft Ltd

uTorrent.exe 2864 µTorrent BitTorrent, Inc.

CurseClient.exe 3008

paConsole.exe 2556 PrinterAnywhere Console PrinterAnywhere

PdaNetPC.exe 2648

firefox.exe 3992 10.03 Firefox Mozilla Corporation

Ad-Aware2007.exe 1000 Lavasoft AB

msconfig.exe 2344 System Configuration Utility Microsoft Corporation

Acrotray.exe 2848 AcroTray Adobe Systems Inc.

opware32.exe 848 OCR Aware (32-bit) ScanSoft, Inc

avgtray.exe 1304 AVG Tray Monitor AVG Technologies CZ, s.r.o.

iTunesHelper.exe 2924 iTunesHelper Apple Inc.

aaw2008_upd.exe 3224 Ad-Aware Lavasoft

procexp.exe 3536 Sysinternals Process Explorer Sysinternals - www.sysinternals.com

procexp64.exe 2892 Sysinternals Process Explorer Sysinternals - www.sysinternals.com

sry for the spam lol

moogly · January 19, 2010

Your PE log is incomplete: Select utorrent.exe and enable DLL mode (ctrl+D) in PE.

pirate13xx · January 19, 2010

oops sry

Process PID CPU Description Company Name

System Idle Process 0 71.52

Interrupts n/a 0.75 Hardware Interrupts

DPCs n/a Deferred Procedure Calls

System 4 3.01