uTorrent is filling memory

Pim46 · July 3, 2011

I am using uTorrent 2.2.1 under Windows XP Pro. Since a few weeks uTorrents acts very strange: when I am downloading, after a while uTorrent gives a message concerning installed software "that prefents uTorrent to work properly. This may be caused by the following DLL's: ' ' " (blank). In the mean time uTorrent is filling the memory and stops when the memory is full. Then the memory is free and I can start uTorrent again, and it begins filling the memory. But the strangest thing is that when the download is completed, the torrent disappears from the screen, I don't see anything from the torrent anymore (no seeders, no trackers), but uploading continues. Even when I shut down uTorrent and start up again, the upload starts again. The only thing I can do is find the torrent-file in the map Applicationdata en delete it.

moogly · July 3, 2011

Post Hijackthis and Process Explorer logs when µT is running.

Guide: http://forum.utorrent.com/viewtopic.php?id=29748

For PE, select utorrent.exe and enable DLL mode (ctrl+D).

Something is injected into µT.

Pim46 · July 3, 2011

Thanks for your help!

Hijack this:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 23:46:25, on 3-7-2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe

C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE

C:\WINDOWS\system32\RunDLL32.exe

C:\Program Files\McAfee\Common Framework\udaterui.exe

C:\Program Files\Silvercrest MTS2218 driver\StartAutorun.exe

C:\WINDOWS\System32\DLA\DLACTRLW.EXE

C:\Program Files\D-Tools\daemon.exe

C:\Program Files\Silvercrest MTS2218 driver\KMConfig.exe

C:\Program Files\PeerBlock\peerblock.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Silvercrest MTS2218 driver\KMProcess.exe

C:\WINDOWS\system32\sndvol32.exe

C:\Program Files\McAfee\Common Framework\McTray.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Silvercrest MTS2218 driver\KMWDSrv.exe

C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe

C:\Program Files\McAfee\Common Framework\FrameworkService.exe

C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe

C:\WINDOWS\system32\mfevtps.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Pim\Mijn documenten\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

F3 - REG:win.ini: run=""

O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptsn.dll

O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O4 - HKLM\..\Run: [uSBToolTip] C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe

O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [KMCONFIG] C:\Program Files\Silvercrest MTS2218 driver\StartAutorun.exe KMConfig.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKCU\..\Run: [PeerBlock] C:\Program Files\PeerBlock\peerblock.exe

O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\WINDOWS\TEMP\E_S9E.tmp" /EF "HKCU"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Volumeregeling.lnk = C:\WINDOWS\system32\sndvol32.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} (JordanUploader Class) - http://foto.hema.nl/ips-opdata/layout/hema/objects/jordan.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1231970835971

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/3,0,0,6107/mcfscan.cab

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Silvercrest MTS2218 driver\KMWDSrv.exe

O23 - Service: McAfee Engine Service (McAfeeEngineService) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe

O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe

O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe

O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe

O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

--

End of file - 8177 bytes

PE:

Process PID CPU Private Bytes Working Set Description Company Name

System Idle Process 0 99.23 0 K 28 K

System 4 0 K 256 K

Interrupts n/a < 0.01 0 K 0 K Hardware Interrupts and DPCs

smss.exe 620 212 K 448 K Windows NT Session Manager Microsoft Corporation

csrss.exe 696 1.716 K 4.080 K Client Server Runtime Process Microsoft Corporation

winlogon.exe 724 7.896 K 1.424 K Toepassing Windows NT-aanmelding Microsoft Corporation

services.exe 772 12.976 K 54.604 K Services en controllertoepassingen Microsoft Corporation

svchost.exe 984 3.524 K 37.872 K Generic Host Process for Win32 Services Microsoft Corporation

naPrdMgr.exe 1272 4.360 K 1.148 K NAI Product Manager McAfee, Inc.

wmiprvse.exe 1892 2.920 K 5.720 K WMI Microsoft Corporation

svchost.exe 1052 2.692 K 34.456 K Generic Host Process for Win32 Services Microsoft Corporation

svchost.exe 1152 14.656 K 77.356 K Generic Host Process for Win32 Services Microsoft Corporation

svchost.exe 1192 3.116 K 31.156 K Generic Host Process for Win32 Services Microsoft Corporation

svchost.exe 1304 5.504 K 32.452 K Generic Host Process for Win32 Services Microsoft Corporation

svchost.exe 1364 2.264 K 33.516 K Generic Host Process for Win32 Services Microsoft Corporation

spoolsv.exe 1496 3.320 K 32.736 K Spooler SubSystem App Microsoft Corporation

AppleMobileDeviceService.exe 1768 1.832 K 2.724 K Apple Mobile Device Service Apple Inc.

mDNSResponder.exe 1788 1.724 K 4.512 K Bonjour Service Apple Inc.

KMWDSrv.exe 1860 1.708 K 2.348 K Keyboard And Mouse Communication Service UASSOFT.COM

EngineServer.exe 1072 1.120 K 3.528 K Common Shell3 - Scanners' interface to the 5000 series engine McAfee, Inc.

FrameworkService.exe 556 5.580 K 8.452 K Framework Service McAfee, Inc.

VsTskMgr.exe 1112 8.520 K 756 K Task Manager McAfee, Inc.

mfevtps.exe 1296 5.596 K 11.360 K McAfee Process Validation Service McAfee, Inc.

nvsvc32.exe 1376 2.660 K 4.160 K NVIDIA Driver Helper Service, Version 175.16 NVIDIA Corporation

svchost.exe 1672 3.208 K 36.160 K Generic Host Process for Win32 Services Microsoft Corporation

Mcshield.exe 1796 66.456 K 70.228 K On-Access Scanner service McAfee, Inc.

mfeann.exe 2168 2.060 K 5.232 K VSCore Announcer McAfee, Inc.

alg.exe 3044 1.696 K 4.384 K Application Layer Gateway Service Microsoft Corporation

lsass.exe 784 3.908 K 724 K LSA Shell (Export Version) Microsoft Corporation

explorer.exe 1880 23.096 K 89.092 K Windows Verkenner Microsoft Corporation

USBTip.exe 276 1.912 K 3.528 K Pinnacle USB Tip - for Multi Media eXtensions Pinnacle Systems GmbH

shstat.exe 280 2.128 K 932 K VirusScan tray icon McAfee, Inc.

rundll32.exe 324 2.440 K 26.072 K Een DLL-bestand als toepassing starten Microsoft Corporation

UdaterUI.exe 340 4.476 K 4.328 K Common User Interface McAfee, Inc.

McTray.exe 1636 656 K 2.484 K McAfee Security Agent Taskbar Extension McAfee, Inc.

StartAutorun.exe 352 496 K 1.808 K DRIVER AUTORUN UASSOFT.COM

KMCONFIG.exe 472 13.268 K 17.232 K USB Keyboard And PS/2 Keyboard Driver UASSOFT.COM

KMProcess.exe 676 2.280 K 3.848 K Keyboard And Mouse Processing UASSOFT.COM

DLACTRLW.EXE 368 1.556 K 4.500 K Drive Letter Access Component Sonic Solutions

daemon.exe 460 1.228 K 3.216 K Virtual DAEMON Manager DAEMON'S HOME

peerblock.exe 588 22.260 K 21.288 K PeerBlock PeerBlock, LLC

ctfmon.exe 184 924 K 3.180 K CTF Loader Microsoft Corporation

sndvol32.exe 788 2.096 K 3.640 K Volumeregeling Microsoft Corporation

uTorrent.exe 3948 132.444 K 116.772 K µTorrent BitTorrent, Inc.

firefox.exe 3376 57.128 K 70.900 K Firefox Mozilla Corporation

HijackThis.exe 2684 8.868 K 2.048 K HijackThis Trend Micro Inc.

notepad.exe 4056 1.040 K 480 K Kladblok Microsoft Corporation

procexp.exe 2180 0.77 9.768 K 14.556 K Sysinternals Process Explorer Sysinternals - www.sysinternals.com

Process: uTorrent.exe Pid: 3948

Name Description Company Name Version

activeds.dll DLL-bestand voor routerlaag van Active Directory Microsoft Corporation 5.1.2600.5512

adsldpc.dll ADs LDAP Provider C DLL-bestand Microsoft Corporation 5.1.2600.5512

advapi32.dll Geavanceerde Windows 32 basis-API Microsoft Corporation 5.1.2600.5755

apphelp.dll Application Compatibility Client Library Microsoft Corporation 5.1.2600.5512

atl.dll ATL Module for Windows XP (Unicode) Microsoft Corporation 3.5.2284.2

audiodev.dll Portable Media Devices Shell Extension Microsoft Corporation 5.2.5721.5145

browseui.dll Shell Browser-bibliotheek voor gebruikersinterface Microsoft Corporation 6.0.2900.5512

cfgmgr32.dll Configuration Manager Forwarder DLL Microsoft Corporation 5.1.2600.5512

clbcatq.dll Microsoft Corporation 2001.12.4414.700

comctl32.dll User Experience Controls Library Microsoft Corporation 6.0.2900.6028

comdlg32.dll DLL voor gedeelde dialoogvensters Microsoft Corporation 6.0.2900.5512

comres.dll Microsoft Corporation 2001.12.4414.700

credui.dll Gebruikersinterface van referentiebeheer Microsoft Corporation 5.1.2600.5512

crypt32.dll Crypto-API32 Microsoft Corporation 5.131.2600.5512

cryptui.dll Microsoft-provider voor vertrouwensgebruikersinterface Microsoft Corporation 5.131.2600.5512

cscdll.dll Off line netwerk-agent Microsoft Corporation 5.1.2600.5512

cscui.dll Gebruikersinterface voor caching aan clientzijde Microsoft Corporation 5.1.2600.5512

ctype.nls

davclnt.dll Web DAV Client-dll Microsoft Corporation 5.1.2600.5512

dnsapi.dll DNS Client API DLL Microsoft Corporation 5.1.2600.6089

dot3api.dll API voor automatische configuratie van 802.3 Microsoft Corporation 5.1.2600.5512

dot3dlg.dll Helper voor 802.3-gebruikersinterface Microsoft Corporation 5.1.2600.5512

drprov.dll Microsoft Terminal Server Network Provider Microsoft Corporation 5.1.2600.5512

eappcfg.dll Configuratie van Eap-peer Microsoft Corporation 5.1.2600.5512

eappprxy.dll Microsoft EAPHost Peer Client DLL Microsoft Corporation 5.1.2600.5512

gdi32.dll GDI Client DLL Microsoft Corporation 5.1.2600.5698

GdiPlus.dll Microsoft GDI+ Microsoft Corporation 5.2.6002.22509

hnetcfg.dll Configuratiebeheer van thuisnetwerk Microsoft Corporation 5.1.2600.5512

iertutil.dll Run time utility for Internet Explorer Microsoft Corporation 8.0.6001.19072

imagehlp.dll Windows NT Image Helper Microsoft Corporation 5.1.2600.5512

imm32.dll Windows XP IMM32 API Client DLL Microsoft Corporation 5.1.2600.5512

iphlpapi.dll IP-helper-API Microsoft Corporation 5.1.2600.5512

kernel32.dll DLL-bestand voor Windows NT BASE API-client Microsoft Corporation 5.1.2600.5781

locale.nls

mdnsNSP.dll Bonjour Namespace Provider Apple Inc. 1.0.6.2

mkunicode.dll

mmfinfo.dll

mpr.dll DLL-bestand voor multiple-providerrouter Microsoft Corporation 5.1.2600.5512

mprapi.dll Windows NT MP Router Administration DLL Microsoft Corporation 5.1.2600.5512

msasn1.dll ASN.1 Runtime APIs Microsoft Corporation 5.1.2600.5875

msctf.dll DLL-bestand voor MSCTF-server Microsoft Corporation 5.1.2600.5512

msctfime.ime Microsoft Text Frame Work Service IME Microsoft Corporation 5.1.2600.5512

msgina.dll Dll-bestand GINA voor Windows NT-aanmelding Microsoft Corporation 5.1.2600.5512

msi.dll Windows Installer Microsoft Corporation 4.5.6001.22159

msimg32.dll GDIEXT Client DLL Microsoft Corporation 5.1.2600.5512

msvcp60.dll Microsoft ® C++ Runtime Library Microsoft Corporation 6.2.3104.0

msvcr80.dll Microsoft® C Runtime Library Microsoft Corporation 8.0.50727.6195

msvcrt.dll Windows NT CRT DLL Microsoft Corporation 7.0.2600.5512

mswsock.dll Microsoft Windows Sockets 2.0 Service-aanbieder Microsoft Corporation 5.1.2600.5625

netapi32.dll Net Win32 API DLL Microsoft Corporation 5.1.2600.5694

netrap.dll Net Remote Admin Protocol DLL Microsoft Corporation 5.1.2600.5512

netshell.dll Shell voor Netwerkverbindingen Microsoft Corporation 5.1.2600.5512

netui0.dll NT LM UI Common Code - GUI-klassen Microsoft Corporation 5.1.2600.5512

netui1.dll NT LM UI Common Code - Networking classes Microsoft Corporation 5.1.2600.5512

normaliz.dll Unicode Normalization DLL Microsoft Corporation 6.0.5441.0

ntdll.dll DLL-bestand voor NT-laag Microsoft Corporation 5.1.2600.6055

ntlanman.dll Microsoft® Lan Manager Microsoft Corporation 5.1.2600.5512

ntshrui.dll Shell-uitbreidingen voor delen Microsoft Corporation 5.1.2600.5512

odbc32.dll Microsoft Data Access - ODBC Driver Manager Microsoft Corporation 3.525.3012.0

odbcint.dll Microsoft Data Access - ODBC-bronnen Microsoft Corporation 3.525.1117.0

ole32.dll Microsoft OLE voor Windows Microsoft Corporation 5.1.2600.6010

oleaut32.dll Microsoft Corporation 5.1.2600.6058

onex.dll IEEE 802.1X aanvraagbibliotheek Microsoft Corporation 5.1.2600.5512

pdfshell.dll PDF Shell Extension Adobe Systems, Inc. 9.4.0.195

pdfshell.NLD PDF Shell Extension Adobe Systems, Inc. 9.1.0.163

PortableDeviceApi.dll Windows Portable Device API Components Microsoft Corporation 5.2.5721.5145

psapi.dll Process Status Helper Microsoft Corporation 5.1.2600.5512

rasadhlp.dll Remote Access AutoDial Helper Microsoft Corporation 5.1.2600.5512

rpcrt4.dll Remote Procedure Call Runtime Microsoft Corporation 5.1.2600.6022

rsaenh.dll Microsoft Enhanced Cryptographic Provider Microsoft Corporation 5.1.2600.5507

rtutils.dll Routing Utilities Microsoft Corporation 5.1.2600.5512

samlib.dll SAM Library DLL Microsoft Corporation 5.1.2600.5512

secur32.dll Security Support Provider Interface Microsoft Corporation 5.1.2600.5834

setupapi.dll Windows Setup API Microsoft Corporation 5.1.2600.5512

shdocvw.dll Objecten- en besturingselementenbibliotheek Shell Doc Microsoft Corporation 6.0.2900.5628

shell32.dll Gemeenschappelijk DLL-bestand van Windows Shell Microsoft Corporation 6.0.2900.6072

shfolder.dll Shell Folder Service Microsoft Corporation 6.0.2900.5512

shgina.dll Windows Shell User Logon Microsoft Corporation 6.0.2900.5512

shlwapi.dll Shell lichtgewicht hulpprogrammabibliotheek Microsoft Corporation 6.0.2900.5912

sortkey.nls

sorttbls.nls

sti.dll Still Image Devices client DLL Microsoft Corporation 5.1.2600.5512

unicode.nls

urlmon.dll OLE32 Extensions for Win32 Microsoft Corporation 8.0.6001.19072

user32.dll DLL-bestand voor Windows XP USER API-client Microsoft Corporation 5.1.2600.5512

userenv.dll Userenv Microsoft Corporation 5.1.2600.5512

uTorrent.exe µTorrent BitTorrent, Inc. 2.2.1.25130

uxtheme.dll DLL-bestand Microsoft UxTheme Microsoft Corporation 6.0.2900.5512

version.dll Version Checking and File Installation Libraries Microsoft Corporation 5.1.2600.5512

wiashext.dll Gebruikersinterface van de shellmap van de replicatieapparaten Microsoft Corporation 5.1.2600.5512

wininet.dll Internet Extensions for Win32 Microsoft Corporation 8.0.6001.19072

winmm.dll MCI API DLL Microsoft Corporation 5.1.2600.5512

winsta.dll Winstation Library Microsoft Corporation 5.1.2600.5512

wintrust.dll API's voor Microsoft-vertrouwenslijstcontrole Microsoft Corporation 5.131.2600.5922

wldap32.dll Win32 LDAP API DLL Microsoft Corporation 5.1.2600.5512

wmasf.dll Windows Media ASF DLL Microsoft Corporation 11.0.5721.5238

WMVCore.dll Windows Media Playback/Authoring DLL Microsoft Corporation 11.0.5721.5275

WpdShext.dll Portable Devices Shell Extension Microsoft Corporation 5.2.5721.5145

ws2_32.dll Windows Socket 2.0 32-Bit DLL Microsoft Corporation 5.1.2600.5512

ws2help.dll Windows Socket 2.0-helper voor Windows NT Microsoft Corporation 5.1.2600.5512

wshtcpip.dll Windows Sockets Helper DLL Microsoft Corporation 5.1.2600.5512

wtsapi32.dll Windows Terminal Server SDK APIs Microsoft Corporation 5.1.2600.5512

xpsp2res.dll Service Pack 2-berichten Microsoft Corporation 5.1.2600.5512

moogly · July 3, 2011

pdfshell.dll    PDF Shell Extension    Adobe Systems, Inc.    9.4.0.195
pdfshell.NLD    PDF Shell Extension    Adobe Systems, Inc.    9.1.0.163

It's incted into µT, try to exclude uT from this Adobe DLLs.

In addition, did you exclude µT from McAfee scanning modules?

DreadWingKnight · July 3, 2011

mkunicode.dll
mmfinfo.dll

Also, what are these from?

Pim46 · July 4, 2011

Hi,

Well, it didn't work. I have a harddisk where I safed some old files and the dll's were found there, also the ones DreadWingKnight mentioned. I deleted them all, excluded uTorrent from McAfee and restarted the computer, but it still is the same. So I used Hijackthis and PE again and hope/pray you will find something else:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 20:16:34, on 4-7-2011