utorrent.exe active after closing uTorrent

[Opensource]

version of uTorrent 1.8.5.17414

S.O. Windows Xp Professional Sp3

After using uTorrent and closing it remains active in the task manager utorrent.exe

[moogly]

What's your firewall? Some firewalls lock µT when it's closing.

Post Hijackthis log please.

Guide: http://forum.utorrent.com/viewtopic.php?id=29748

[Firon]

Are you using Zone Alarm?

[Opensource]

I use Online Armor 4.0.0.15

[Firon]

Try removing the firewall and see if it closes after that.

[Grompy]

I have the same problem. I am currently running

uTorrent 2.0 (build 17920) - it happened on the previous beta RC4 build also.

OS windows 7 64-bit ultimate

I have noticed that it is very intermittent and that it only seems to happen sometimes when utorrent is ran for a very long period of time. When I find it in task manager and try to end it.. it won't stop the process.

I only use peerblock and windows defualt firewalls. no 3rd party firewalls whatsoever.

HiJackThis Log:

Running processes:

C:\Program Files (x86)\Steam\Steam.exe

C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVH.EXE

C:\Program Files (x86)\Razer\Copperhead\razerhid.exe

C:\Program Files (x86)\Razer\Tarantula\razerhid.exe

C:\Program Files (x86)\Java\jre6\bin\jusched.exe

C:\Program Files (x86)\Razer\Copperhead\razertra.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\Razer\Copperhead\razerofa.exe

C:\Program Files (x86)\Razer\Tarantula\razertra.exe

C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\uTorrent Beta\uTorrent.exe

C:\Users\Grompy\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=userinit.exe

O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll

O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll

O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll

O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [Copperhead] C:\Program Files (x86)\Razer\Copperhead\razerhid.exe

O4 - HKLM\..\Run: [Tarantula] C:\Program Files (x86)\Razer\Tarantula\razerhid.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [steam] "c:\program files (x86)\steam\steam.exe" -silent

O4 - HKCU\..\Run: [Google Update] "C:\Users\Grompy\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O4 - Startup: LimeWire On Startup.lnk = C:\Program Files (x86)\LimeWire\LimeWire.exe

O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Startup: OneNote 2010 Screen Clipper and Launcher.lnk = C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVH.EXE

O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/201

O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/204

O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/203

O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/202

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

O13 - Gopher Prefix:

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

[moogly]

PeerBlock can be the culprit. PG2 or PB are pretty useless and interfer with p2p connections.

Just uninstall it and use ipfilter.dat in µT to block some peers. Check if your issue is still here.

[thandermax]

My observation on this is when main window is closed , it tries to flush and write all memory buffers to file.

It closes itself after few second after buffer flushing is complete.

This problem(if it is) will be more imminent if u set a larger buffer or have huge RAM installed.

[Firon]

We've noticed this happens sometimes on windows 7 64-bit, but we've been unable to reproduce the issue ourselves. How long have you waited after closing it?

[Grompy]

Sometimes I don't notice it till like 20-30 mins later when I get a huge lag spike playing a game. I believe it's still using bandwidth for whatever reason whenever it doesn't close completely. I'll try and set up the ipfilter.dat thing.. never heard of it nor used it obviously so I'll check into it.

Edit:

I set up the ipfilter.dat it shows that it is loaded when Utorrent starts. However IPs are still being blocked on PeerBlock. Is there a difference between PeerBlock and ipfilter? I would much rather be safe then sorry and have peerblock open when anti-P2P IPs are still being accessed.

What do you guys recommend? - I'm not real keen about the entire block lists anyway.

Grompy

Edit 2: Another peculiar thing about it staying open is that when I click on the executable to open it again it opens up as a new process. Whereas it would just show the already open utorrent if it was clicked normally. I tried using pskill to end the process and it says access is denied. Same as when I try to end it in task manager. The only way that I know how to close it is to restart. Also when utorrent doesn't shut down and another instance is opened dl speeds in the new instance are only around 20kb/s when they normally reach up to 100-200kb/s.

Are there any other thought that might be the cause of the problem? Any hints on getting it to close without a restart?

[stoner420]

This is happening to me too!

[gbmolina]

same thing here, windows 7 ultimate, 32 bits, utorrent 2.0 build 17920, utorrent.exe stays active after been shut down, I'm using only the windows firewall and I am behind a router.

any solution?

[Domkrai]

I have exactly the same symptoms with utorrent 2.0 build 17920 on win7 x64. The utorrent.exe shows up taskman / process explorer and cannot be terminated. When I try to debug it with Visual Studio it produces this dialog:

---------------------------

Microsoft Visual Studio

---------------------------

Unable to attach to the crashing process. The requested operation is not supported.

---------------------------

OK

---------------------------

It sounds like utorrent.exe actually crashed while exiting and got stuck like that?

Anyway, this happens after having utorrent up for few days straight and constant upload/download of lots of different files. I don't think I saw this happen with with 1.x versions.

[DreadWingKnight]

I'm noticing a lack of REQUIRED troubleshooting information from everyone in this thread except Grompy.

http://forum.utorrent.com/viewtopic.php?id=29748

[gbmolina]

I have to rectify my post: after a while utorrent.exe shuts down and disappears from the task manager, it takes usually about 20 seconds after exiting the program itself.

[DreadWingKnight]

20 seconds is a normal timeframe to handle the application closing cleanup.

[Domkrai]

It's hanging for days for me, not for 20 seconds. I was unable to delete a previously torrented file at one point, because it was allegedly being used by some other process. I did not find any process having that file open using sysinternal's handle. But I noticed a zombie utorrent process instead. I remember that I did close utorrent at one point while that specific file was still downloading, so it's a high probability utorrent was the one holding it up while being a zombie.

This happened 3 times to me in a span of a week, so it's somewhat reproduceable. It definitely did not happen with previous versions and my usage patterns did not change.

I'm not comfortable posting a memory dump. Here is stack trace out of it though:

STACK_TEXT:

00000000`0008b168 00000000`72e5601a : 00000000`00000000 00000000`717738cf 00000000`0008b150 00000000`72e501cc : ntdll!NtTerminateProcess+0xa

00000000`0008b170 00000000`72e4cf87 : 00000000`0036f44c 00000000`0036ebc0 00000000`7efdb000 00000000`7efdb000 : wow64!whNtTerminateProcess+0x46

00000000`0008b1a0 00000000`72dd276d : 00000000`75f579cd 00000000`72dd0023 00000000`00000000 00000000`0036f150 : wow64!Wow64SystemServiceEx+0xd7

00000000`0008ba60 00000000`72e4d07e : 00000000`71773f1f 00000000`72dd1904 00000000`000010a0 00000000`47041e71 : wow64cpu!TurboDispatchJumpAddressEnd+0x24

00000000`0008bb20 00000000`72e48a40 : 00000000`00000000 00000000`72dd276d 00000000`0028051e 00000000`72dfadda : wow64!RunCpuSimulation+0xa

00000000`0008bb70 00000000`72e129ee : 00000000`0008bef0 00000000`00000002 00000000`0008c850 00000000`00000020 : wow64!Wow64KiUserCallbackDispatcher+0x204

00000000`0008bec0 00000000`770efdf5 : 00000000`00000000 00000000`00000000 00000000`00000000 0be30642`0008c8cc : wow64win!whcbfnDWORD+0xe2

00000000`0008c8b0 00000000`72e1fc3a : 00000000`72dfac9e 00000000`0008d398 00000000`72e12b86 00000000`00000000 : ntdll!KiUserCallbackDispatcherContinue

00000000`0008c938 00000000`72dfac9e : 00000000`0008d398 00000000`72e12b86 00000000`00000000 00000000`00080000 : wow64win!ZwUserMessageCall+0xa

00000000`0008c940 00000000`72e125bb : 00000000`0008c600 00000000`72df54b0 00000000`72df48e8 00000000`00000112 : wow64win!whNT32NtUserMessageCallCB+0x32

00000000`0008c990 00000000`72dfadda : 00000000`0000029e 00000000`0036f6bc 00000000`00000112 00000000`00000000 : wow64win!Wow64DoMessageThunk+0x8b

00000000`0008c9d0 00000000`72e4cf87 : 00000000`0036f638 00000000`7efdb000 00000000`7efdd000 00000000`72dfacac : wow64win!whNtUserMessageCall+0x12e

00000000`0008ca70 00000000`72dd276d : 00000000`772900b8 00000000`770e0023 00000000`00000007 00000000`0036f9d4 : wow64!Wow64SystemServiceEx+0xd7

00000000`0008d330 00000000`72e4d07e : 00000000`00000000 00000000`72dd1904 00000000`0008e1b8 00000000`72dd198b : wow64cpu!TurboDispatchJumpAddressEnd+0x24

00000000`0008d3f0 00000000`72e48a40 : 00000000`7efdd000 00000000`0008e120 00000000`00010003 00000000`00000000 : wow64!RunCpuSimulation+0xa

00000000`0008d440 00000000`72e129ee : 00000000`0008d7c0 00000000`00000002 00000000`0008e120 00000000`00000020 : wow64!Wow64KiUserCallbackDispatcher+0x204

00000000`0008d790 00000000`770efdf5 : 00000000`72e1fc3a 00000000`00000000 00000000`00000000 00000000`0008e208 : wow64win!whcbfnDWORD+0xe2

00000000`0008e180 00000000`72e1fc3a : 00000000`72dfac9e 00000000`00000000 00000000`770efdf5 00000000`7172218f : ntdll!KiUserCallbackDispatcherContinue

00000000`0008e208 00000000`72dfac9e : 00000000`00000000 00000000`770efdf5 00000000`7172218f 00000000`00000000 : wow64win!ZwUserMessageCall+0xa

00000000`0008e210 00000000`72e125bb : 00000000`00000000 00000000`72df54b0 00000000`72df4df8 00000000`000000a1 : wow64win!whNT32NtUserMessageCallCB+0x32

00000000`0008e260 00000000`72dfadda : 00000000`0000029e 00000000`0036fa98 00000000`000000a1 00000000`00000000 : wow64win!Wow64DoMessageThunk+0x8b

00000000`0008e2a0 00000000`72e4cf87 : 00000000`0036fa14 00000000`7efdb000 00000000`7efdd000 00000000`72dfacac : wow64win!whNtUserMessageCall+0x12e

00000000`0008e340 00000000`72dd276d : 00000000`75f57e47 00000000`72e40023 00000000`00000007 00000000`0036fd6c : wow64!Wow64SystemServiceEx+0xd7

00000000`0008ec00 00000000`72e4d07e : 00000000`00000000 00000000`72dd1920 00000000`0008ee90 00000000`770d3ae1 : wow64cpu!TurboDispatchJumpAddressEnd+0x24

00000000`0008ecc0 00000000`72e4c549 : 00000000`00000000 00000000`00000000 00000000`72e44ac8 00000000`7ffe0030 : wow64!RunCpuSimulation+0xa

00000000`0008ed10 00000000`770e84c8 : 00000000`00533020 00000000`00000000 00000000`771d3670 00000000`771a57a0 : wow64!Wow64LdrpInitialize+0x429

00000000`0008f260 00000000`770e7623 : 00000000`00000000 00000000`770e9181 00000000`770a0000 00000000`00000000 : ntdll!LdrpInitializeProcess+0x17e2

00000000`0008f760 00000000`770d308e : 00000000`0008f820 00000000`00000000 00000000`7efdf000 00000000`00000000 : ntdll! ?? ::FNODOBFM::`string'+0x2bea0

00000000`0008f7d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!LdrInitializeThunk+0xe

And the opcode at that location is just a ret:

ntdll!NtTerminateProcess+0xa:

00000000`770f017a c3 ret

As you can see it's just sitting at NtTerminateProcess doing nothing. There are no more threads, this is the only thread.

Again, msvs calls the process "crashing" and windbg call the process "exiting".

---

Here is a DLL list out of process explorer for the zombie utorrent process:

Process: uTorrent.exe Pid: 4308

Name Description Company Name Version

ADVAPI32.dll Advanced Windows 32 Base API Microsoft Corporation 6.1.7600.16385

apphelp.dll Application Compatibility Client Library Microsoft Corporation 6.1.7600.16385

ATL.DLL ATL Module for Windows XP (Unicode) Microsoft Corporation 3.5.2284.0

AUTHZ.dll Authorization Framework Microsoft Corporation 6.1.7600.16385

C_950.NLS

CFGMGR32.dll Configuration Manager DLL Microsoft Corporation 6.1.7600.16385

CLBCatQ.DLL COM+ Configuration Catalog Microsoft Corporation 2001.12.8530.16385

COMCTL32.dll User Experience Controls Library Microsoft Corporation 6.10.7600.16385

comctl32.dll.mui User Experience Controls Library Microsoft Corporation 6.10.7600.16385

comdlg32.dll Common Dialogs DLL Microsoft Corporation 6.1.7600.16385

credssp.dll Credential Delegation Security Package Microsoft Corporation 6.1.7600.16385

CRYPT32.dll Crypto API32 Microsoft Corporation 6.1.7600.16385

CRYPTBASE.dll Base cryptographic API DLL Microsoft Corporation 6.1.7600.16385

CRYPTSP.dll Cryptographic Service Provider API Microsoft Corporation 6.1.7600.16385

cscapi.dll Offline Files Win32 API Microsoft Corporation 6.1.7600.16385

DEVOBJ.dll Device Information Set DLL Microsoft Corporation 6.1.7600.16385

dhcpcsvc.DLL DHCP Client Service Microsoft Corporation 6.1.7600.16385

dhcpcsvc6.DLL DHCPv6 Client Microsoft Corporation 6.1.7600.16385

DnsApi.dll DNS Client API DLL Microsoft Corporation 6.1.7600.16385

DUser.dll Windows DirectUser Engine Microsoft Corporation 6.1.7600.16385

duser.dll.mui Windows DirectUser Engine Microsoft Corporation 6.1.7600.16385

dwmapi.dll Microsoft Desktop Window Manager API Microsoft Corporation 6.1.7600.16385

EhStorShell.dll Windows Enhanced Storage Shell Extension DLL Microsoft Corporation 6.1.7600.16385

FirewallAPI.dll Windows Firewall API Microsoft Corporation 6.1.7600.16385

fwpuclnt.dll FWP/IPsec User-Mode API Microsoft Corporation 6.1.7600.16385

GDI32.dll GDI Client DLL Microsoft Corporation 6.1.7600.16385

GPAPI.dll Group Policy Client API Microsoft Corporation 6.1.7600.16385

hnetcfg.dll Home Networking Configuration Manager Microsoft Corporation 6.1.7600.16385

hnetcfg.dll.mui Home Networking Configuration Manager Microsoft Corporation 6.1.7600.16385

iertutil.dll Run time utility for Internet Explorer Microsoft Corporation 8.0.7600.16385

IMM32.DLL Multi-User Windows IMM32 API Client DLL Microsoft Corporation 6.1.7600.16385

Iphlpapi.dll IP Helper API Microsoft Corporation 6.1.7600.16385

kernel32.dll Windows NT BASE API Client DLL Microsoft Corporation 6.1.7600.16385

KERNELBASE.dll Windows NT BASE API Client DLL Microsoft Corporation 6.1.7600.16385

KernelBase.dll.mui Windows NT BASE API Client DLL Microsoft Corporation 6.1.7600.16385

locale.nls

LPK.dll Language Pack Microsoft Corporation 6.1.7600.16385

MSASN1.dll ASN.1 Runtime APIs Microsoft Corporation 6.1.7600.16415

MSCTF.dll MSCTF Server DLL Microsoft Corporation 6.1.7600.16385

msctf.dll.mui MSCTF Server DLL Microsoft Corporation 6.1.7600.16385

msvcrt.dll Windows NT CRT DLL Microsoft Corporation 7.0.7600.16385

mswsock.dll Microsoft Windows Sockets 2.0 Service Provider Microsoft Corporation 6.1.7600.16385

msxml3.dll MSXML 3.0 SP11 Microsoft Corporation 8.110.7600.16385

msxml3r.dll XML Resources Microsoft Corporation 8.110.7600.16385

netshell.dll Network Connections Shell Microsoft Corporation 6.1.7600.16385

netutils.dll Net Win32 API Helpers DLL Microsoft Corporation 6.1.7600.16385

nlaapi.dll Network Location Awareness 2 Microsoft Corporation 6.1.7600.16385

npmproxy.dll Network List Manager Proxy Microsoft Corporation 6.1.7600.16385

NSI.dll NSI User-mode interface DLL Microsoft Corporation 6.1.7600.16385

ntdll.dll NT Layer DLL Microsoft Corporation 6.1.7600.16385

ntdll.dll NT Layer DLL Microsoft Corporation 6.1.7600.16385

ntmarta.dll Windows NT MARTA provider Microsoft Corporation 6.1.7600.16385

ntshrui.dll Shell extensions for sharing Microsoft Corporation 6.1.7600.16385

ole32.dll Microsoft OLE for Windows Microsoft Corporation 6.1.7600.16385

oleaut32.dll Microsoft Corporation 6.1.7600.16385

peerdist.dll BranchCache Client Library Microsoft Corporation 6.1.7600.16385

profapi.dll User Profile Basic API Microsoft Corporation 6.1.7600.16385

PROPSYS.dll Microsoft Property System Microsoft Corporation 7.0.7600.16385

psapi.dll Process Status Helper Microsoft Corporation 6.1.7600.16385

rasadhlp.dll Remote Access AutoDial Helper Microsoft Corporation 6.1.7600.16385

RPCRT4.dll Remote Procedure Call Runtime Microsoft Corporation 6.1.7600.16385

RpcRtRemote.dll Remote RPC Extension Microsoft Corporation 6.1.7600.16385

rsaenh.dll Microsoft Enhanced Cryptographic Provider Microsoft Corporation 6.1.7600.16385

sechost.dll Host for SCM/SDDL/LSA Lookup APIs Microsoft Corporation 6.1.7600.16385

SETUPAPI.dll Windows Setup API Microsoft Corporation 6.1.7600.16385

setupapi.dll.mui Windows Setup API Microsoft Corporation 6.1.7600.16385

SHELL32.dll Windows Shell Common Dll Microsoft Corporation 6.1.7600.16385

shfolder.dll Shell Folder Service Microsoft Corporation 6.1.7600.16385

SHLWAPI.dll Shell Light-weight Utility Library Microsoft Corporation 6.1.7600.16385

slc.dll Software Licensing Client Dll Microsoft Corporation 6.1.7600.16385

SortDefault.nls

srvcli.dll Server Service Client DLL Microsoft Corporation 6.1.7600.16385

SSDPAPI.dll SSDP Client API DLL Microsoft Corporation 6.1.7600.16385

SspiCli.dll Security Support Provider Interface Microsoft Corporation 6.1.7600.16385

StaticCache.dat

SXS.DLL Fusion 2.5 Microsoft Corporation 6.1.7600.16385

tiptsf.dll Tablet PC Input Panel Text Services Framework Microsoft Corporation 6.1.7600.16385

upnp.dll UPnP Control Point API Microsoft Corporation 6.1.7600.16385

urlmon.dll OLE32 Extensions for Win32 Microsoft Corporation 8.0.7600.16490

urlmon.dll.mui OLE32 Extensions for Win32 Microsoft Corporation 8.0.7600.16385

USER32.dll Multi-User Windows USER API Client DLL Microsoft Corporation 6.1.7600.16385

user32.dll.mui Multi-User Windows USER API Client DLL Microsoft Corporation 6.1.7600.16385

USERENV.dll Userenv Microsoft Corporation 6.1.7600.16385

USP10.dll Uniscribe Unicode script processor Microsoft Corporation 1.626.7600.16385

uTorrent.exe µTorrent BitTorrent, Inc. 2.0.0.17920

uxtheme.dll Microsoft UxTheme Library Microsoft Corporation 6.1.7600.16385

VERSION.dll Version Checking and File Installation Libraries Microsoft Corporation 6.1.7600.16385

webio.dll Web Transfer Protocols API Microsoft Corporation 6.1.7600.16385

WindowsCodecs.dll Microsoft Windows Codecs Library Microsoft Corporation 6.1.7600.16385

WINHTTP.dll Windows HTTP Services Microsoft Corporation 6.1.7600.16385

WINNSI.DLL Network Store Information RPC interface Microsoft Corporation 6.1.7600.16385

wkscli.dll Workstation Service Client DLL Microsoft Corporation 6.1.7600.16385

WLDAP32.dll Win32 LDAP API DLL Microsoft Corporation 6.1.7600.16385

wow64.dll Win32 Emulation on NT64 Microsoft Corporation 6.1.7600.16385

wow64cpu.dll AMD64 Wow64 CPU Microsoft Corporation 6.1.7600.16385

wow64win.dll Wow64 Console and Win32 API Logging Microsoft Corporation 6.1.7600.16385

WS2_32.dll Windows Socket 2.0 32-Bit DLL Microsoft Corporation 6.1.7600.16385

wship6.dll Winsock2 Helper DLL (TL/IPv6) Microsoft Corporation 6.1.7600.16385

wshtcpip.dll Winsock2 Helper DLL (TL/IPv4) Microsoft Corporation 6.1.7600.16385

---

Update: well, it just managed to wedge itself solid again. I turned off all the internal utorrent disk caching stuff too and that didn't help.

[Grompy]

I can confirm that the following files are open being used by utorrent after it doesn't shut down.

[Switeck]

I set up the ipfilter.dat it shows that it is loaded when Utorrent starts. However IPs are still being blocked on PeerBlock.

Incoming connections probably...uTorrent would've blocked them, PeerBlock just saw them first.

[Grompy]

Grompy wrote:

I set up the ipfilter.dat it shows that it is loaded when Utorrent starts. However IPs are still being blocked on PeerBlock.

Incoming connections probably...uTorrent would've blocked them, PeerBlock just saw them first.

ah that would make sense. Thanks for the explanation! I'll look more closely and see if they are incoming connections.

Grompy

[Ravenheart]

Hujackthis log I have the same problem, no matter how long I wait after closing down uTorrent the phantom process is still there and neither task manager nor Process Explorer or LockHunter can kill the bastard.

Win7 Ultimate x64

I don't have PeerGuardian or other such application installed, I use the default windows firewall and uTorrent has full privileges.

EDIT: I have a though, since I'm launching uTorrent from the sidebar(using App Launcher v3) could that have affected something? Perhaps uTorrent is waiting for the parent process to finish or something?

[DreadWingKnight]

ESET NOD32 - There's a thread about it in the troubleshooting section.

[Ravenheart]

I've added uTorrent to its exception list, don't give me robot replies please(and it worked fine for the past 5 years).

[DreadWingKnight]

I don't see your process explorer process list with the dll list for the utorrent.exe process either.

[Ravenheart]

That's it... If you can't do all 3 report no problem, any of them helps.

But anyway: link