uTorrent crashes (no malware, no firewall and etc.)

[misfit]

Some days ago my uTorrent started to crash, everytime i start it (it works for about 20 seconds and crashes), no firewall at the system, no malware (scanned with the Spybot Search&Remove, AdAware), checked LSPfix program - everything is ok, but the uTorrent crashes. Tried to update, removed settings.dat file. As small red icon the bottom says - "listen error", but as i said - no firewall, no security/blocking software at all uploaded my crash dump to http://www.sendspace.com/file/2mt23q

Really like uTorrent and do not want to lose it, please help

[GTHK]

What did you install/change lately?

Post logs:

a) get HijackThis from trendsecure.com, run it, view the log, and post the contents here

get Process Explorer from sysinternals.com, run it, Ctrl+D (to show the lower DLL pane), select the µTorrent process from the list, Ctrl+S (and save the list somewhere you'll find easily -- like the Desktop), then post the contents of the saved process list in the .txt file here

If you don't have any programs that touch Internet communications you can try this before posting the logs: Start > Run > CMD /k netsh winsock reset

[misfit]

CMD /k netsh winsock reset

The following command was not found: winsock reset.

Now will post the logs:

HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:21:03, on 19.06.2008

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\D-Tools\daemon.exe

C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe

C:\WINDOWS\System32\RUNDLL32.EXE

C:\Program Files\Punto Switcher\ps.exe

C:\Program Files\Orbitdownloader\ORBITDM.EXE

C:\Program Files\NetLimiter 2 Monitor\nlsvc.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\wdfmgr.exe

C:\backup\-programs\Opera9.10\Opera.exe

C:\Program Files\VMware\VMware Workstation\vmware-authd.exe

C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe

C:\WINDOWS\System32\vmnat.exe

C:\Program Files\RealVNC\VNC4\WinVNC4.exe

C:\WINDOWS\System32\vmnetdhcp.exe

C:\Program Files\NetLimiter 2 Monitor\NLClient.exe

C:\backup\-programs\scoop2004\mirc.exe

C:\Program Files\MyPhoneExplorer\MyPhoneExplorer.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=374

O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll

O3 - Toolbar: NuSphere ToolBar - {0F62D223-9206-4EA3-9EA8-D0F3C7C82ACA} - C:\Program Files\nusphere\phped\nubar\NuSphereIEBar.dll

O4 - HKLM\..\Run: [NVMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [Punto Switcher] C:\Program Files\Punto Switcher\ps.exe

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - Startup: WinMySQLadmin.lnk = C:\xampp\mysql\bin\winmysqladmin.exe

O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\ORBITDM.EXE

O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201

O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204

O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203

O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202

O8 - Extra context menu item: NuSphere PhpED :: Debug this page - res://C:\Program Files\nusphere\phped\nubar\NuSphereIEBar.dll/1000

O8 - Extra context menu item: Translate with ABBYY &Lingvo - res://C:\Program Files\ABBYY Lingvo 11 Six Languages\Lingvo.exe/3000

O16 - DPF: {463ED66E-431B-11D2-ADB0-0080C83DA4EB} (AcceptWM Class) - https://w3s.webmoney.ru/WMAcceptor.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{58347185-ED9F-45E6-AD22-64F1B7022D8B}: NameServer = 212.59.2.2,212.59.1.1

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: prio.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Monitor\nlsvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe

O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\System32\vmnetdhcp.exe

O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe

O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\System32\vmnat.exe

O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--

End of file - 4918 bytes

ProcessExplorer Log:

Process PID CPU Description Company Name

System Idle Process 0 92.54

Interrupts n/a 1.54 Hardware Interrupts

DPCs n/a Deferred Procedure Calls

System 4

SMSS.EXE 804 Windows NT Session Manager Microsoft Corporation

CSRSS.EXE 876 Client Server Runtime Process Microsoft Corporation

WINLOGON.EXE 904 Windows NT Logon Application Microsoft Corporation

SERVICES.EXE 948 Services and Controller app Microsoft Corporation

SVCHOST.EXE 1136 Generic Host Process for Win32 Services Microsoft Corporation

SVCHOST.EXE 232 Generic Host Process for Win32 Services Microsoft Corporation

SVCHOST.EXE 1544 Generic Host Process for Win32 Services Microsoft Corporation

SVCHOST.EXE 1832 Generic Host Process for Win32 Services Microsoft Corporation

SVCHOST.EXE 1888 Generic Host Process for Win32 Services Microsoft Corporation

aawservice.exe 220 Ad-Aware 2007 Service Lavasoft

SPOOLSV.EXE 780 Spooler SubSystem App Microsoft Corporation

NLSVC.EXE 1500 NetLimiter 2 service Locktime Software

NLClient.exe 196 NetLimiter 2 Client Locktime Software

NVSVC32.EXE 1536 NVIDIA Driver Helper Service, Version 169.21 NVIDIA Corporation

WDFMGR.EXE 1672 Windows User Mode Driver Manager Microsoft Corporation

vmware-authd.exe 1996 VMware Authorization Service VMware, Inc.

VMOUNT2.EXE 508 virtual disk mount service VMware, Inc.

VMNAT.EXE 532 VMware NAT Service VMware, Inc.

WINVNC4.EXE 552 VNC Server Free Edition for Win32 RealVNC Ltd.

vmnetdhcp.exe 1036 VMware VMnet DHCP service VMware, Inc.

SVCHOST.EXE 2924 Generic Host Process for Win32 Services Microsoft Corporation

LSASS.EXE 960 1.54 LSA Shell (Export Version) Microsoft Corporation

EXPLORER.EXE 860 1.54 Windows Explorer Microsoft Corporation

DAEMON.EXE 1284 Virtual DAEMON Manager DAEMON'S HOME

CLEDX.EXE 1292 Team H2O CLEDX Team H2O

RUNDLL32.EXE 1300 Run a DLL as an App Microsoft Corporation

PS.EXE 1308 Punto Switcher 2.2 Punto.Ru

ORBITDM.EXE 1348 Orbit Downloader Orbitdownloader.com

Opera.exe 1932 Opera Internet Browser Opera Software

MyPhoneExplorer.exe 868 MyPhoneExplorer F.J. Wechselberger

NOTEPAD.EXE 2428 Notepad Microsoft Corporation

uTorrent.exe 1960

MIRC.EXE 3556 mIRC mIRC Co. Ltd.

NOTEPAD.EXE 3756 Notepad Microsoft Corporation

procexp.exe 3828 3.08 Sysinternals Process Explorer Sysinternals

Process: uTorrent.exe Pid: 1960

Name Description Company Name Version

activeds.dll ADs Router Layer DLL Microsoft Corporation 5.01.2600.0000

adsldpc.dll ADs LDAP Provider C DLL Microsoft Corporation 5.01.2600.1106

advapi32.dll Advanced Windows 32 Base API Microsoft Corporation 5.01.2600.1106

atl.dll ATL Module for Windows NT (Unicode) Microsoft Corporation 3.00.9435.0000

clbcatq.dll Microsoft Corporation 2001.12.4414.0042

comctl32.dll User Experience Controls Library Microsoft Corporation 6.00.2800.1106

comdlg32.dll Common Dialogs DLL Microsoft Corporation 6.00.2800.1106

comres.dll Microsoft Corporation 2001.12.4414.0042

correct.dll Correct MFC Application 1.00.0000.0001

ctype.nls

dnsapi.dll DNS Client API DLL Microsoft Corporation 5.01.2600.1106

gdi32.dll GDI Client DLL Microsoft Corporation 5.01.2600.1106

iphlpapi.dll IP Helper API Microsoft Corporation 5.01.2600.0002

kernel32.dll Windows NT BASE API Client DLL Microsoft Corporation 5.01.2600.1106

locale.nls

mprapi.dll Windows NT MP Router Administration DLL Microsoft Corporation 5.01.2600.0000

msvcrt.dll Windows NT CRT DLL Microsoft Corporation 7.00.2600.1106

mswsock.dll Microsoft Windows Sockets 2.0 Service Provider Microsoft Corporation 5.01.2600.0000

netapi32.dll Net Win32 API DLL Microsoft Corporation 5.01.2600.1106

ntdll.dll NT Layer DLL Microsoft Corporation 5.01.2600.1106

ole32.dll Microsoft OLE for Windows Microsoft Corporation 5.01.2600.1106

oleaut32.dll Microsoft OLE 3.50 for Windows NT and Windows 95 Operating Systems Microsoft Corporation 3.50.5016.0000

prio.dll Prio Process Control O&K Software 1.09.0006.0000

R000000000021.clb

rasadhlp.dll Remote Access AutoDial Helper Microsoft Corporation 5.01.2600.0000

rpcrt4.dll Remote Procedure Call Runtime Microsoft Corporation 5.01.2600.1106

rtutils.dll Routing Utilities Microsoft Corporation 5.01.2600.0000

samlib.dll SAM Library DLL Microsoft Corporation 5.01.2600.1106

secur32.dll Security Support Provider Interface Microsoft Corporation 5.01.2600.1106

setupapi.dll Windows Setup API Microsoft Corporation 5.01.2600.1106

shell32.dll Windows Shell Common Dll Microsoft Corporation 6.00.2800.1106

shlwapi.dll Shell Light-weight Utility Library Microsoft Corporation 6.00.2800.1106

sortkey.nls

sorttbls.nls

unicode.nls

user32.dll Windows XP USER API Client DLL Microsoft Corporation 5.01.2600.1106

utorrent.exe

uxtheme.dll Microsoft UxTheme Library Microsoft Corporation 6.00.2800.1106

version.dll Version Checking and File Installation Libraries Microsoft Corporation 5.01.2600.0000

winrnr.dll LDAP RnR Provider DLL Microsoft Corporation 5.01.2600.0000

wldap32.dll Win32 LDAP API DLL Microsoft Corporation 5.01.2600.1106

ws2_32.dll Windows Socket 2.0 32-Bit DLL Microsoft Corporation 5.01.2600.0000

ws2help.dll Windows Socket 2.0 Helper for Windows NT Microsoft Corporation 5.01.2600.0000

wshtcpip.dll Windows Sockets Helper DLL Microsoft Corporation 5.01.2600.0000

[Firon]

NetLimiter has a firewall built into it.

[misfit]

uTorrent worked ok, when NetLimiter was installed. Net limiter only monitors connections

[Firon]

Uninstall that Prio process control software before you try removing NetLimiter. It seems to hook itself into every process on the system, so it's the most likely cause.