uTorrent is angry with me (Crashes yet remains in Task Manager)

Dante4212 · March 8, 2008

I've been using uTorrent on Vista for nearly a year now, and it's always worked fine, but as of recently, I've been having a problem with it.

I open uTorrent, and it will display the main screen for about 5 seconds, then it freezes followed by an inevitable crash. I close the program and try re-opening it, but the program itself does not appear. In task manager, I found two utorrent.exe files (One is the one I just recently opened, the other the first). I end the process of the recently opened one and it disappears. I try ending the process of the first utorrent.exe, but to no avail. It remains in the task manager unaffected by any decision I make.

I tried uninstalling uTorrent, downloading the current version (1.7.7), and reinstalling, but I get the same problem. UTorrent opens, but when the configuration opens up, it stays open for about 5 seconds, then freezes.

I've looked around on the forums and couldn't find a similar problem, but I did see people here use HiJackThis, so I'm going to post a loglife of my running processes.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:53:55 PM, on 2/3/2008

Platform: Windows Vista (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16575)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files\Trend Micro\AntiVirus 2007\tavui.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe

C:\Program Files\Portrait Displays\HP My Display\dthtml.exe

C:\Program Files\mobile PhoneTools\WatchDog.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe

C:\Windows\ehome\ehmsas.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe

C:\Windows\system32\wermgr.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: 207.210.93.28 game01.us.segaonline.jp

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll

O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [Trend Micro AntiVirus 2007] "C:\Program Files\Trend Micro\AntiVirus 2007\tavui.exe" -1 --delay 200

O4 - HKLM\..\Run: [DT HPW] "C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe" -startup_folder

O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [WatchDog] "C:\Program Files\mobile PhoneTools\WatchDog.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"

O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"

O4 - HKLM\..\Run: [NvSvc] "RUNDLL32.EXE" C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [spySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray

O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe

O4 - HKCU\..\Run: [sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - Global Startup: MRI_DISABLED

O8 - Extra context menu item: &Winamp Toolbar Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm

O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm

O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll

O13 - Gopher Prefix:

O16 - DPF: {040F4385-8DAD-4306-94BF-B8291D841FAE} (USBAPTester Class) - http://www.nintendo.com/consumer/systems/wii/en_na/usbaptest.cab

O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Intel® Alert Service (AlertService) - Intel® Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\Windows\system32\bgsvcgen.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe

O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Intel® Software Services Manager (ISSM) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: Intel® Viiv Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe

O23 - Service: Intel® Application Tracker (MCLServiceATL) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: Intel® Remoting Service (Remote UI Service) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe

O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe

O23 - Service: Trend Micro AntiVirus Protection Service (tavsvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\AntiVirus 2007\tavsvc.exe

O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\AntiVirus 2007\Components\tmproxy.exe

O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--

End of file - 11267 bytes

Ultima · March 9, 2008

I see at least three programs known to cause problems...

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

At any rate, get Process Explorer from sysinternals.com, run it, Ctrl+D (to show the lower DLL pane), select the µTorrent process from the list, Ctrl+S (and save the list somewhere you'll find easily -- like the Desktop) , then post the contents of the saved process list in the .txt file here.

jewelisheaven · March 9, 2008

I'You want to use HJT or lspfix to eliminate the multiple entries for O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll

Dante4212 · March 10, 2008

Process PID CPU Description Company Name

System Idle Process 0 90.40

Interrupts n/a Hardware Interrupts

DPCs n/a 0.77 Deferred Procedure Calls

System 4

smss.exe 556

csrss.exe 628

wininit.exe 684

services.exe 728

svchost.exe 932

ehmsas.exe 3036 Media Center Media Status Aggregator Service Microsoft Corporation

NMIndexStoreSvr.exe 3728 Nero Home Nero AG

unsecapp.exe 4352 Sink to receive asynchronous callbacks for WMI client application Microsoft Corporation

WmiPrvSE.exe 4456

FlashUtil9d.exe 5104 Adobe Flash Player Helper 9.0 r47 Adobe Systems, Inc.

svchost.exe 1020

svchost.exe 1076

svchost.exe 1120

audiodg.exe 1336

svchost.exe 1176

dwm.exe 1876 0.77 Desktop Window Manager Microsoft Corporation

WUDFHost.exe 3000

svchost.exe 1212

taskeng.exe 2024 Task Scheduler Engine Microsoft Corporation

taskeng.exe 3520

MpCmdRun.exe 5736

SLsvc.exe 1368

svchost.exe 1424

svchost.exe 1624

spoolsv.exe 1992

svchost.exe 2016

AppleMobileDeviceService.exe 1920

bgsvcgen.exe 488

mDNSResponder.exe 1572

DQLWinService.exe 1760

DTSRVC.exe 1480

GoogleUpdaterService.exe 724

svchost.exe 1052

IAANTmon.exe 1380

LSSrvc.exe 584

svchost.exe 2052

svchost.exe 2084

svchost.exe 2104

svchost.exe 2128

tavsvc.exe 2156

tavui.exe 3280 Trend Micro AntiVirus Configuration Manager Trend Micro Inc.

TmProxy.exe 2240

SpySweeper.exe 2344

ssu.exe 4944

svchost.exe 2684

SearchIndexer.exe 2708

SearchProtocolHost.exe 1352

SearchFilterHost.exe 1432

XAudio.exe 2748

alg.exe 3400

NMIndexingService.exe 3084

ehsched.exe 3696

iPodService.exe 4172

TrustedInstaller.exe 5988

lsass.exe 740

lsm.exe 748

csrss.exe 696

winlogon.exe 848

explorer.exe 1932 0.77 Windows Explorer Microsoft Corporation

RtHDVCpl.exe 3780 HD Audio Control Panel Realtek Semiconductor

hpwuSchd2.exe 3824 Hewlett-Packard Product Assistant Hewlett-Packard Co.

dthtml.exe 3876 HP My Display Portrait Displays, Inc

HookManager.exe 3048 Context Menu Utility Portrait Displays Inc.

jusched.exe 3960 Java Platform SE binary Sun Microsystems, Inc.

IAAnotif.exe 3984 Event Monitor User Notification Tool Intel Corporation

GrooveMonitor.exe 4048 GrooveMonitor Utility Microsoft Corporation

iTunesHelper.exe 4084 iTunesHelper Module Apple Inc.

SpySweeperUI.exe 4092 Spy Sweeper Client Executable Webroot Software, Inc.

sidebar.exe 2076 Windows Sidebar Microsoft Corporation

sidebar.exe 4264 Windows Sidebar Microsoft Corporation

ehtray.exe 2168 Media Center Tray Applet Microsoft Corporation

GoogleToolbarNotifier.exe 2556 GoogleToolbarNotifier Google Inc.

NMBgMonitor.exe 2588 Nero Home Nero AG

procexp.exe 4912 6.90 Sysinternals Process Explorer Sysinternals - www.sysinternals.com

rundll32.exe 2696 Windows host process (Rundll32) Microsoft Corporation

ieuser.exe 5820 Internet Explorer Microsoft Corporation

iexplore.exe 3712 Internet Explorer Microsoft Corporation

utorrent.exe 3856

Process: utorrent.exe Pid: 3856

Name Description Company Name Version

ADVAPI32.dll Advanced Windows 32 Base API Microsoft Corporation 6.00.6000.16386

apphelp.dll Application Compatibility Client Library Microsoft Corporation 6.00.6000.16386

CLBCatQ.DLL COM+ Configuration Catalog Microsoft Corporation 2001.12.6930.16386

COMCTL32.dll User Experience Controls Library Microsoft Corporation 6.10.6000.16386

comdlg32.dll Common Dialogs DLL Microsoft Corporation 6.00.6000.16386

dhcpcsvc.DLL DHCP Client Service Microsoft Corporation 6.00.6000.16512

dhcpcsvc6.DLL DHCPv6 Client Microsoft Corporation 6.00.6000.16512

DNSAPI.dll DNS Client API DLL Microsoft Corporation 6.00.6000.16386

FirewallAPI.dll Windows Firewall API Microsoft Corporation 6.00.6000.16501

GDI32.dll GDI Client DLL Microsoft Corporation 6.00.6000.16386

iertutil.dll Run time utility for Internet Explorer Microsoft Corporation 7.00.6000.16386

IMM32.DLL Multi-User Windows IMM32 API Client DLL Microsoft Corporation 6.00.6000.16386

Iphlpapi.dll IP Helper API Microsoft Corporation 6.00.6000.16386

kernel32.dll Windows NT BASE API Client DLL Microsoft Corporation 6.00.6000.16386

locale.nls

LPK.DLL Language Pack Microsoft Corporation 6.00.6000.16386

mdnsNSP.dll Bonjour Namespace Provider Apple Inc. 1.00.0004.0012

MSCTF.dll MSCTF Server DLL Microsoft Corporation 6.00.6000.16386

msctf.dll.mui MSCTF Server DLL Microsoft Corporation 6.00.6000.16386

msvcrt.dll Windows NT CRT DLL Microsoft Corporation 7.00.6000.16386

mswsock.dll Microsoft Windows Sockets 2.0 Service Provider Microsoft Corporation 6.00.6000.16386

napinsp.dll E-mail Naming Shim Provider Microsoft Corporation 6.00.6000.16386

NLAapi.dll Network Location Awareness 2 Microsoft Corporation 6.00.6000.16386

NSI.dll NSI User-mode interface DLL Microsoft Corporation 6.00.6000.16386

ntdll.dll NT Layer DLL Microsoft Corporation 6.00.6000.16386

ole32.dll Microsoft OLE for Windows Microsoft Corporation 6.00.6000.16386

OLEAUT32.dll Microsoft Corporation 6.00.6000.16609

pnrpnsp.dll PNRP Name Space Provider Microsoft Corporation 6.00.6000.16386

PROPSYS.dll Microsoft Property System Microsoft Corporation 6.00.6000.16386

PSAPI.DLL Process Status Helper Microsoft Corporation 6.00.6000.16386

R000000000009.clb

rasadhlp.dll Remote Access AutoDial Helper Microsoft Corporation 6.00.6000.16386

RPCRT4.dll Remote Procedure Call Runtime Microsoft Corporation 6.00.6000.16525

Secur32.dll Security Support Provider Interface Microsoft Corporation 6.00.6000.16386

SETUPAPI.dll Windows Setup API Microsoft Corporation 6.00.6000.16609

setupapi.dll.mui Windows Setup API Microsoft Corporation 6.00.6000.16609

SHELL32.dll Windows Shell Common Dll Microsoft Corporation 6.00.6000.16513

SHLWAPI.dll Shell Light-weight Utility Library Microsoft Corporation 6.00.6000.16386

tmlsp.dll TmLsp Trend Micro Inc. 3.01.0000.1013

urlmon.dll OLE32 Extensions for Win32 Microsoft Corporation 7.00.6000.16609

USER32.dll Multi-User Windows USER API Client DLL Microsoft Corporation 6.00.6000.16438

USERENV.dll Userenv Microsoft Corporation 6.00.6000.16386

USP10.dll Uniscribe Unicode script processor Microsoft Corporation 1.626.6000.16386

uTorrent.exe

uxtheme.dll Microsoft UxTheme Library Microsoft Corporation 6.00.6000.16386

VERSION.dll Version Checking and File Installation Libraries Microsoft Corporation 6.00.6000.16386

WINNSI.DLL Network Store Information RPC interface Microsoft Corporation 6.00.6000.16386

winrnr.dll LDAP RnR Provider DLL Microsoft Corporation 6.00.6000.16386

WLDAP32.dll Win32 LDAP API DLL Microsoft Corporation 6.00.6000.16386

WS2_32.dll Windows Socket 2.0 32-Bit DLL Microsoft Corporation 6.00.6000.16386

wshtcpip.dll Winsock2 Helper DLL (TL/IPv4) Microsoft Corporation 6.00.6000.16386

jewelisheaven · March 10, 2008

So after getting rid of Nero Scout and Spy Sweeper it still has trouble? (Log shows Spy Sweeper is still running)

There's still the added DLL for your AV tmlsp.dll TmLsp Trend Micro Inc. 3.01.0000.1013 which is fine I guess as long as that hook is not causing things to go wonky. Could you try adding uTorrent.exe to the exceptions list so it doesn't monitor? Or if not possible turn it off temporarily and then re-run the DLL list to be sure it's not injected, and THEN see if uT still crashes?

Here's a tidbit if uT still is frozen then it is possible to crash uT and upload the DMP file to mediafire for someone to look at. We're running out of possible suspects and I feel useless because you're using Vista :/

Dante4212 · March 10, 2008

Well my Webroot SpySweeper is my primary Spyware remover, and it's paid for so I can't really delete it.

And plus, I've been using uTorrent with SpySweeper simultaneously for several several months now.

Ultima · March 11, 2008

Can you at least try uninstalling it for testing purposes to see if the problem persists with it uninstalled?

Dante4212 · March 11, 2008

Yeah, I'll try it. In the meantime, is there an alternate spyware protection program I can use?

Ultima · March 11, 2008

Windows Defender is supposed to be fine, but I don't think it's really necessary. Spyware doesn't show up spontaneously -- it's all about user action. Simply don't install any new software or visit any suspicious/unknown websites while you have SpySweeper uninstalled, and you'll be fine.

Dante4212 · March 11, 2008

Alright, I've uninstalled Webroot SpySweeper, and I'm trying to attempt to uninstall Roxio, but I have seven entries (or programs) for Roxio under my Control Panel. Was it one program, or do I need to remove all seven of Roxio's programs?

And I use Nero Burning Rom religiously, and I only have one entry in the Control Panel (which is Nero 7). How do I remove certain 'branches' of the program? Specifically, the ones that autostart with my computer?

I've attempted to run uTorrent, and I'm getting a little further than five seconds, but it still inevitably crashes and stays in my process list.

Ultima · March 11, 2008

I'm not sure, as I don't use Nero. Perhaps if you click the "uninstall" button, it might come up with some dialog that allows you to select which component you'd like to remove (like many InstallShield/MSI installers allow)?

I tend to doubt the Nero process would cause crashes -- I just thought I'd mention it, since both Nero and Roxio have caused plenty of grief to users in the form of "Access Denied" errors

Perhaps you can check the Nero preferences somewhere to see if there's a way to disable the indexing service? If not, you can always try disabling it via Start > Run > services.msc, or by killing it with Process Explorer and disabling it from running on startup with Start > Run > msconfig.

At any rate, after you do this, can you provide a new Process Explorer log? Thanks.

jewelisheaven · March 11, 2008

It is not the nero SUITE, but Nero SCOUT the indexing service which Ultima pointed out. In 7 and 8 you download that 400 MB behemoth with all features you'll ever want (and rarely need). There's a launcher you should be able to remove or turn it off manually... or go the control panel route. If it inevitably crashes, does that mean it no longer immediately crashes but you don't want to babysit it to find out how long it takes?It's quite understandable but could you try to see what action(s) cause a crash, like if you start it minimized and then try to bring it up that's the trigger? The log shows your trend micro injected which shouldn't be a problem, unless it's doing something that is causing it to crash.

I can appreciate it's a previously working setup... so then what changed? Windows updates? program updates? new software? If after nothing is injected into uT and it still crashes you'll have to start turning off additional services and stopping programs in a trial-and-error process to see what's causing it to crash. I don't expect you to do higher-level debugging, but the creator of Process Explorer regularly describes in his blog @ http://blogs.technet.com/markrussinovich/ how he ends up finding and in many cases fixing windows code (the benefits of being AT microsoft now he can check in changes to source)

Dante4212 · March 12, 2008

Ok, I've uninstalled everything Roxio, uninstalled Webroot SpySweeper, and have disabled Nero Scout (I think).

Jewelisheaven, I'm looking at my most recent Windows Updates, and found that on March 07, I installed "Definition Update for Windows Defender - KB915597 (Definition 1.29.7418.0)"

It's description says "Install this update to revise the definition files used to detect spywaree and other poentially unwanted software. Once you have installed this item, it cannot be removed."

"Potentially Unwanted Software..." you don't think they added uTorrent to their lists, do you?

There was a Motorola USB Handset driver installed on March 08th, but I have no need for it, so that's now uninstalled.

Here is an updated Process Explorer log:

Process PID CPU Description Company Name

System Idle Process 0 68.53

Interrupts n/a 0.77 Hardware Interrupts

DPCs n/a Deferred Procedure Calls

System 4 4.62

smss.exe 488

csrss.exe 560

wininit.exe 616

services.exe 660 0.77

svchost.exe 868

unsecapp.exe 1364 Sink to receive asynchronous callbacks for WMI client application Microsoft Corporation

WmiPrvSE.exe 2508

ehmsas.exe 1280 Media Center Media Status Aggregator Service Microsoft Corporation

FlashUtil9d.exe 4952 Adobe Flash Player Helper 9.0 r47 Adobe Systems, Inc.

svchost.exe 956

svchost.exe 1004

svchost.exe 1092

audiodg.exe 1244

svchost.exe 1116 1.54

dwm.exe 1740 0.77 Desktop Window Manager Microsoft Corporation

WUDFHost.exe 2596

svchost.exe 1136

taskeng.exe 1824 Task Scheduler Engine Microsoft Corporation

taskeng.exe 3356

taskeng.exe 3704

SLsvc.exe 1272

svchost.exe 1376

svchost.exe 1476

svchost.exe 1924

AppleMobileDeviceService.exe 612

bgsvcgen.exe 940

mDNSResponder.exe 1232

DQLWinService.exe 1472

DTSRVC.exe 1676

GoogleUpdaterService.exe 1696

svchost.exe 1352

IAANTmon.exe 424

LSSrvc.exe 656

svchost.exe 2064

svchost.exe 2192

svchost.exe 2204

svchost.exe 2220

tavsvc.exe 2276

tavui.exe 3100 Trend Micro AntiVirus Configuration Manager Trend Micro Inc.

TmProxy.exe 2400

svchost.exe 2448

SearchIndexer.exe 2468

SearchProtocolHost.exe 2568

SearchFilterHost.exe 5076

XAudio.exe 2588

alg.exe 3196

ehsched.exe 2692

NMIndexingService.exe 2972

iPodService.exe 988

msiexec.exe 5632

VSSVC.exe 6124

svchost.exe 6116

spoolsv.exe 5364

TrustedInstaller.exe 5340

lsass.exe 672

lsm.exe 680

csrss.exe 628

winlogon.exe 720

explorer.exe 1784 Windows Explorer Microsoft Corporation

RtHDVCpl.exe 3732 HD Audio Control Panel Realtek Semiconductor

hpwuSchd2.exe 3772 Hewlett-Packard Product Assistant Hewlett-Packard Co.

dthtml.exe 3808 HP My Display Portrait Displays, Inc

HookManager.exe 2812 Context Menu Utility Portrait Displays Inc.

jusched.exe 3832 Java Platform SE binary Sun Microsystems, Inc.

IAAnotif.exe 3884 Event Monitor User Notification Tool Intel Corporation

GrooveMonitor.exe 4024 GrooveMonitor Utility Microsoft Corporation

iTunesHelper.exe 2140 iTunesHelper Module Apple Inc.

sidebar.exe 2188 Windows Sidebar Microsoft Corporation

sidebar.exe 3712 Windows Sidebar Microsoft Corporation

ehtray.exe 2324 Media Center Tray Applet Microsoft Corporation

GoogleToolbarNotifier.exe 1612 GoogleToolbarNotifier Google Inc.

procexp.exe 5444 2.31 Sysinternals Process Explorer Sysinternals - www.sysinternals.com

utorrent.exe 4256 20.79

rundll32.exe 3952 Windows host process (Rundll32) Microsoft Corporation

ieuser.exe 4956 Internet Explorer Microsoft Corporation

iexplore.exe 4976 Internet Explorer Microsoft Corporation

Process: utorrent.exe Pid: 4256