It seems like uTorrent is running, but not responding....

[sharpdion]

What the problem is:

It seems like uTorrent is running, but not responding. Please close all uTorrent processes and try again.

I tried uninstalling it and re-installing it and restarting the computer but when I try to use it or try to open it it shows that message. I have also tried to go to task manager and tried to end the proccess but it wont end it it will just stay there. When I was uninstalling it I used the progrems add/remove and ccleaner if that helps.

tk

[jewelisheaven]

Does the message pop up after you try to start it yourself after a reboot? Did you tell uT to "run on windows startup"? If you start->run->msconfig do you see entries there for uT? If you're not sure about any of this, can you copy-paste the resulting logfile from a full HiJackThis scan?

[sharpdion]

Yeah I tried to re-enstall then reboot and tried to open it again but it always says that message.And I dont let it run on start ups too.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:24:50 AM, on 2/6/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Analog Devices\SoundMAX\smax4.exe

C:\Program Files\Shaw Secure\Anti-Virus\fsgk32st.exe

C:\Program Files\Shaw Secure\Anti-Virus\FSGK32.EXE

C:\Program Files\Shaw Secure\Common\FSMA32.EXE

C:\Program Files\Shaw Secure\Common\FSMB32.EXE

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\Program Files\Shaw Secure\Common\FCH32.EXE

C:\Program Files\Webroot\Washer\WasherSvc.exe

C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe

C:\Program Files\Shaw Secure\Common\FAMEH32.EXE

C:\Program Files\Shaw Secure\Anti-Virus\fsqh.exe

C:\Program Files\Shaw Secure\Anti-Virus\fssm32.exe

C:\Program Files\Shaw Secure\FWES\Program\fsdfwd.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Shaw Secure\FSAUA\program\fsaua.exe

C:\Program Files\Shaw Secure\FSAUA\program\fsus.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Shaw Secure\Anti-Virus\fsav32.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\Program Files\Webroot\Washer\wwDisp.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O4 - HKLM\..\Run: [soundMax] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO

O4 - HKCU\..\RunOnce: [index Washer] C:\Program Files\Webroot\Washer\WashIdx.exe "IntelPerl"

O15 - Trusted Zone:

O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - http://ebus.sd91.bc.ca/dwa7W.cab

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Shaw Secure\Anti-Virus\fsgk32st.exe

O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Shaw Secure\FSAUA\program\fsaua.exe

O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Shaw Secure\FWES\Program\fsdfwd.exe

O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Shaw Secure\Common\FSMA32.EXE

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Intel® Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe

--

End of file - 3955 bytes3

I think the problem is that I updated it but how do I fix it

DOne I fixed it thx anyway fur ur time bro

[Firon]

you can find extra startup entries with msconfig. It happens when updating from really old versions.

[kaganader]

hey I'm having the same problem, except for uT works for me, but when I close it, it still stays in the Task Manager Processes, I does not close even when I click end Process.

I don't have it to startup with Windows.

I have the port open for it.

Its been working flawlessly untill I believe I updated it.

I tried using Bittorent but I also have this problem with that one too.

I have nothing running that is known to have conflict with it, I have all useless and not needed apps that startup with my comp turn off in msconfig.exe.

here is a pic of the problem

heres a picture of the processes, when I click to open utorrent, another utorrent.exe is executed

My system is:

Windows Vista 32bit

2gig ram

Conroe E6600

Geforce 7300GT

I also have Daemon Running, Pstrip, and Fraps don't know if they would cause any conflict with uT.

I also did a clean install of the newest uTorrent and Bittorent, uninstalled them through add/remove programs, downloaded the newest ones to see if they had this problem, and they did. *Note, I did not have both Bittorrent and Utorrent installed at the same time, I wanted a controlled environment just in case they would conflict with each other.

[Firon]

Can you reboot when it happens? Like, a normal reboot.

[kaganader]

Yes I'm able to reboot my computer. after the reboot and windows loads up I can open it and works onces again flawlessly but once I close it, it stays active well active is not the word, it stays in the list of processes with no intention to leave

I have notice a little lag in performance of my computer as a whole after I close uT and stubbornly stays. Not enough lag or slowdown of my computer to complain about but I have come to notice sliver of lag after I close it.

But that is of no concern to me( The Lag), I would just like to use uT without having to restart my computer every time I want to use it.

Am I one of two that has this problem or do a few fellow uT users have this? I only went back a couple of pages of post to see about this.

*Edit*

Explorer.exe keeps on hanging and fails to respond. Before I jump to a conclusion that uT was causing this, I restarted my computer, to where uT was not running or stuck in the processes list. I open many folders, Pictures, Music, random game folders just to see if I can cause explorer.exe to crash and not respond. I could not get it to crash as much as I tried to.

Now I tried it when uT is stuck in the processes list. I open up one folder, the folder containing one anime video, click to open it, explorer.exe hangs, folder is not responding. i close explorer.exe and restart it, try it again, this time I try to open uT not from my shortcut on the desktop but from the folder in the program files dir. after I click it, I don't get the error of uT is already running but the folder becomes not responsive again. It seems when uT is stuck in the processes list and I try to open up something from a folder this happens.

I'm not saying this would happen to everyone, hence everyone has different OS's but this could just be something with vista along with the uT hanging in the processes list.

I did not have any trouble opening Firefox,IE, or a modified Firefox. only with folders I got explorer.exe to hang till I had to manually crash it and restart it.

Sorry if my post is quite long, I feel that I should keep what I find flowing fluently, and in an organized manner then to keep on reposting.

*Another Edit*

Okay along with uT stubbornly not wanting to close, now explorer.exe does not want to close and restart after the folders freeze up. I have a picture along with this.

also I do not have any viruses or malware in my computer. I have scanned with AVG, Zone alarm, Kapersky( Even tho the newest ZA has bought the Kapersky AV engine) Mcafee, and Nod32 ( pick up a false positive). i know your thinking why the hell do I have all this. I only have it for testing purposes. No I do not have them all on my computer all at once, I only installed them to resolve my mind thinking I was infected(took them out after I tested out my virus/malware theory), and this was done way after I started having problems with uT, so the idea of uT having conflict with AV or firewall is out and having viruses or malware.

Only way I can fix this is EITHER I don't use uTorrent, or restart my computer every time I use uTorrent.

[Switeck]

A HijackThis! log might be more revealing.

[jewelisheaven]

... try running at the start->run or command prompt "path\to\utorrent.exe" /BRINGTOFRONT ... it will pop up the window if it is responsive. It should also pop up any windows ... I have a feeling on close uT is set bt.graceful_shutdown = TRUE, but why it isn't showing the window I don't know.

Did you append any parameters like /HIDE or /MINIMIZED to uT's shortcut?

[kaganader]

@jewelisheaven, I have seen you post this to many post, its not hidden minimized, with no parameters attach to the uT shortcut. I did try this as I saw you said this to many people though.

@Switeck

ok ill do a HijackThis later today, thus I have work in a little bit so ill post it later.

*Edit*

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 2:01:04 , on 2/10/2008

Platform: Windows Vista (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16575)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe

C:\Windows\sttray.exe

C:\Windows\System32\wpcumi.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\DAEMON Tools Pro\DTProAgent.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\ehome\ehtray.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\PowerStrip\PStrip.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\Taskmgr.exe

C:\Program Files\lolifox\lolifox.exe

C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrobat.exe

C:\Program Files\AIM6\aim6.exe

C:\Program Files\AIM6\aolsoftware.exe

C:\Program Files\Winamp\winamp.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Users\kaganader\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 69.122.149.43

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll

O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup

O4 - HKLM\..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe

O4 - HKLM\..\Run: [sigmatelSysTrayApp] sttray.exe

O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe

O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [sidebar] "C:\Program Files\Windows Sidebar\Sidebar.exe" /autorun

O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-21-1318583800-2043717559-799671552-1004\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'IUSR_NMPR')

O4 - Startup: PowerStrip.lnk = C:\Program Files\PowerStrip\PStrip.exe

O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe

O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: Ïðåâåäè - {60237576-b24c-4ba9-9740-c9f3ec9db557} - C:\PROGRA~1\SkyCode\WebTrance30\wt2ie.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O13 - Gopher Prefix:

O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Intel® Software Services Manager (ISSM) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe

O23 - Service: Intel® Viiv Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe

O23 - Service: Intel® Remoting Service (Remote UI Service) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe

--

End of file - 9951 bytes

[Ultima]

Hrm. Try uninstalling ZA for now to see if the problem persists. Also, what version of µTorrent are you using?

[Firon]

I'd try ditching Zone Alarm.

[kaganader]

ZA I left in there just as some protection. I tried it without ZA, still the same problem. I'm using 1.7.7, This started happening after the update if I remember.

[Ultima]

What does "without" mean? Uninstalled, or simply disabled/exited? If the latter, then that won't do you any good -- only an uninstall would (possibly) make a difference.

[kaganader]

I completely uninstalled ZA and restarted the computer.

Any ideas on what could be causing this?

[conrad]

i have the exact same problem with both bittorrent and utorrent (no im not running both at the same time, i tried utorrent and because of this prob went to bittorrent)

Has anyone been able to solve this problem?

[jewelisheaven]

wpclsp.dll should not be listed multiple times. Additionally i searched the first three results pages for any actual description of it and all that came up was... surprise HJT logs :/ I don't want to say remove them all but.. removing all but one may help since LSP (layered service providers) are a frequent means for hijackers to get into your system.

Conrad I don't see your logs anywhere??

[conrad]

Logfile of HijackThis v1.99.1

Scan saved at 10:42:15 PM, on 2/20/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\PC Tools Firewall Plus\FWService.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Program Files\Spyware Doctor\pctsSvc.exe

C:\Program Files\Spyware Doctor\pctsTray.exe

C:\Program Files\ThreatFire\TFService.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Google\Google Pinyin\GooglePinyinDaemon.exe

C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

C:\Program Files\Google\Google Talk\googletalk.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\ThreatFire\TFTray.exe

C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe

C:\Program Files\RMClock\RMClock.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\Launchy\Launchy.exe

C:\Program Files\Vidalia Bundle\Privoxy\privoxy.exe

C:\Program Files\VirtuaWin\VirtuaWin.exe

C:\Program Files\Vidalia Bundle\Tor\tor.exe

C:\Program Files\Last.fm\LastFMHelper.exe

C:\Program Files\VirtuaWin\modules\VWAssigner.exe

C:\Program Files\VirtuaWin\modules\WinList.exe

C:\Program Files\OpenOffice.org 2.3\program\soffice.exe

C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll

O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start

O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"

O4 - HKLM\..\Run: [Google IME Autoupdater] "C:\Program Files\Google\Google Pinyin\GooglePinyinDaemon.exe"

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe

O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKLM\..\Run: [iSTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"

O4 - HKCU\..\Run: [RMClock] "C:\Program Files\RMClock\RMClockLauncher.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Vidalia] "C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe"

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe

O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe

O4 - Global Startup: BTTray.lnk = ?

O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe

O4 - Global Startup: Privoxy.lnk = C:\Program Files\Vidalia Bundle\Privoxy\privoxy.exe

O4 - Global Startup: VirtuaWin.lnk = C:\Program Files\VirtuaWin\VirtuaWin.exe

O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1202069690625

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{275806ED-85F6-446E-AEBD-488B3AD61899}: NameServer = 202.106.195.68

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe

O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe

here is my log thankyou!

thank you

[jewelisheaven]

Uninstall Spyware Doctor, then PCTools checking uT between each step. I'm thinking if you can't kill uTorrent.exe, you'll need to reboot.

If you provide additional Process Explorer DLL list it would make sure nothing is injected there. http://sysinternals.com, get process explorer, open procexp.exe, Ctrl-L, Ctrl-D, click utorrent.exe, Ctrl-A, and copy-paste into a post.

[conrad]

I live in China which is a very hostile computing environment. Running my system without pctools or some kind of protections seems suicidal. I am running a registered version of pctools/threatfire/and their firewall. Is there anyway I can do diagnosis w/o dropping my virus/malware protection?

Process PID CPU Description Company Name

System Idle Process 0 56.72

Interrupts n/a 1.49 Hardware Interrupts

DPCs n/a 4.48 Deferred Procedure Calls

System 4

smss.exe 1028 Windows NT Session Manager Microsoft Corporation

csrss.exe 1144 Client Server Runtime Process Microsoft Corporation

winlogon.exe 1180 Windows NT Logon Application Microsoft Corporation

services.exe 1224 2.99 Services and Controller app Microsoft Corporation

ati2evxx.exe 1380 ATI External Event Utility EXE Module ATI Technologies Inc.

svchost.exe 1396 Generic Host Process for Win32 Services Microsoft Corporation

wmiprvse.exe 3584 WMI Microsoft Corporation

HPQTOA~1.EXE 1780 HpqToaster Module

FWService.exe 1504 PC Tools Firewall Plus service PC Tools

svchost.exe 1540 Generic Host Process for Win32 Services Microsoft Corporation

svchost.exe 1628 Generic Host Process for Win32 Services Microsoft Corporation

svchost.exe 1724 Generic Host Process for Win32 Services Microsoft Corporation

svchost.exe 1980 Generic Host Process for Win32 Services Microsoft Corporation

spoolsv.exe 620 Spooler SubSystem App Microsoft Corporation

avgamsvr.exe 728 AVG Alert Manager GRISOFT, s.r.o.

avgupsvc.exe 764 AVG Update Service GRISOFT, s.r.o.

avgemc.exe 796 AVG E-Mail Scanner GRISOFT, s.r.o.

btwdins.exe 808 Bluetooth Support Server Broadcom Corporation.

pctsAuxs.exe 908 PC Tools Auxiliary Service PC Tools

pctsSvc.exe 992 4.48 PC Tools Security Service PC Tools

pctsTray.exe 1108 PC Tools Tray Application PC Tools

TFService.exe 1136 PC Tools ThreatFire Service PC Tools

alg.exe 3656 Application Layer Gateway Service Microsoft Corporation

lsass.exe 1236 LSA Shell (Export Version) Microsoft Corporation

ati2evxx.exe 2000 ATI External Event Utility EXE Module ATI Technologies Inc.

explorer.exe 156 5.97 Windows Explorer Microsoft Corporation

avgcc.exe 3964 AVG Control Center GRISOFT, s.r.o.

eabservr.exe 1444 Quick Launch Buttons Hewlett-Packard

SynTPLpr.exe 1420 TouchPad Driver Helper Application Synaptics, Inc.

SynTPEnh.exe 1736 1.49 Synaptics TouchPad Enhancements Synaptics, Inc.

atiptaxx.exe 2056 ATI Desktop Control Panel ATI Technologies, Inc.

GooglePinyinDaemon.exe 2156 Google Pinyin Network Daemon Google Inc.

HP Wireless Assistant.exe 2796 hp Wireless Assistant Module Hewlett-Packard Development Company, L.P.

jusched.exe 3060 Java Platform SE binary Sun Microsystems, Inc.

TFTray.exe 3388 PC Tools ThreatFire Tray App PC Tools

FirewallGUI.exe 3452 PC Tools Firewall GUI PC Tools

ctfmon.exe 3776 CTF Loader Microsoft Corporation

msmsgs.exe 3928 Windows Messenger Microsoft Corporation

BTTray.exe 4036 Bluetooth Tray Application Broadcom Corporation.

Launchy.exe 1068

privoxy.exe 1796 Privoxy The Privoxy team - www.privoxy.org

VirtuaWin.exe 2100 1.49

VWAssigner.exe 2404

WinList.exe 2348

firefox.exe 2540 17.91 Firefox Mozilla Corporation

vidalia.exe 3384

tor.exe 3744

bittorrent.exe 3708 2.99

procexp.exe 3988 Sysinternals Process Explorer Sysinternals

RMClock.exe 1824 RightMark CPU Clock Utility NGO Science Center "RightMark"

Process: bittorrent.exe Pid: 3708

Name Description Company Name Version

ACTIVEDS.dll ADs Router Layer DLL Microsoft Corporation 5.01.2600.2180

adsldpc.dll ADs LDAP Provider C DLL Microsoft Corporation 5.01.2600.2180

ADVAPI32.dll Advanced Windows 32 Base API Microsoft Corporation 5.01.2600.2180

ATL.DLL ATL Module for Windows XP (Unicode) Microsoft Corporation 3.05.2284.0000

bittorrent.exe

CLBCATQ.DLL Microsoft Corporation 2001.12.4414.0308

COMCTL32.dll User Experience Controls Library Microsoft Corporation 6.00.2900.2982

comdlg32.dll Common Dialogs DLL Microsoft Corporation 6.00.2900.2180

COMRes.dll Microsoft Corporation 2001.12.4414.0258

ctype.nls

DNSAPI.dll DNS Client API DLL Microsoft Corporation 5.01.2600.2938

GDI32.dll GDI Client DLL Microsoft Corporation 5.01.2600.3159

hnetcfg.dll Home Networking Configuration Manager Microsoft Corporation 5.01.2600.2180

IMM32.DLL Windows XP IMM32 API Client DLL Microsoft Corporation 5.01.2600.2180

Iphlpapi.dll IP Helper API Microsoft Corporation 5.01.2600.2912

kernel32.dll Windows NT BASE API Client DLL Microsoft Corporation 5.01.2600.3119

klg.dat Spyware Doctor Component PC Tools 5.05.0000.0001

locale.nls

LPK.DLL Language Pack Microsoft Corporation 5.01.2600.2180

MPRAPI.dll Windows NT MP Router Administration DLL Microsoft Corporation 5.01.2600.2180

MSCTF.dll MSCTF Server DLL Microsoft Corporation 5.01.2600.2180

msctfime.ime Microsoft Text Frame Work Service IME Microsoft Corporation 5.01.2600.2180

msvcrt.dll Windows NT CRT DLL Microsoft Corporation 7.00.2600.2180

mswsock.dll Microsoft Windows Sockets 2.0 Service Provider Microsoft Corporation 5.01.2600.2180

NETAPI32.dll Net Win32 API DLL Microsoft Corporation 5.01.2600.2976

ntdll.dll NT Layer DLL Microsoft Corporation 5.01.2600.2180

ole32.dll Microsoft OLE for Windows Microsoft Corporation 5.01.2600.2726

oleaut32.dll Microsoft Corporation 5.01.2600.3266

PCTLsp.dll PC Tools Layered Service Provider PC Tools Research Pty Ltd. 1.00.0089.0000

rasadhlp.dll Remote Access AutoDial Helper Microsoft Corporation 5.01.2600.2938

RPCRT4.dll Remote Procedure Call Runtime Microsoft Corporation 5.01.2600.3173

rtutils.dll Routing Utilities Microsoft Corporation 5.01.2600.2180

SAMLIB.dll SAM Library DLL Microsoft Corporation 5.01.2600.2180

Secur32.dll Security Support Provider Interface Microsoft Corporation 5.01.2600.2180

SETUPAPI.dll Windows Setup API Microsoft Corporation 5.01.2600.2180

SHELL32.dll Windows Shell Common Dll Microsoft Corporation 6.00.2900.3241

SHLWAPI.dll Shell Light-weight Utility Library Microsoft Corporation 6.00.2900.3231

smumhook.dll PC Tools 5.05.0000.0050

sortkey.nls

sorttbls.nls

TFWAH.dll File Description PC Tools 3.08.0002.0015

unicode.nls

USER32.dll Windows XP USER API Client DLL Microsoft Corporation 5.01.2600.3099

USP10.dll Uniscribe Unicode script processor Microsoft Corporation 1.420.2600.2180

UxTheme.dll Microsoft UxTheme Library Microsoft Corporation 6.00.2900.2180

VERSION.dll Version Checking and File Installation Libraries Microsoft Corporation 5.01.2600.2180

winrnr.dll LDAP RnR Provider DLL Microsoft Corporation 5.01.2600.2180

WLDAP32.dll Win32 LDAP API DLL Microsoft Corporation 5.01.2600.2180

WS2_32.dll Windows Socket 2.0 32-Bit DLL Microsoft Corporation 5.01.2600.2180

WS2HELP.dll Windows Socket 2.0 Helper for Windows NT Microsoft Corporation 5.01.2600.2180

wshtcpip.dll Windows Sockets Helper DLL Microsoft Corporation 5.01.2600.2180

Thanks again

[DreadWingKnight]

Considering how much PC Tools is hooking into uTorrent, I would say that you need to uninstall it to troubleshoot.

Your process list appears to be for bittorrent and not uTorrent, but PC Tools firewall is the most likely culprit for problems because of how much it has hooked in.