FÜR NUTZER

Schließen

Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Suche
Suche

Support
Support 24/7 | Regeln zur Anfragenübermittlung

Schreiben Sie uns

Online-Formular

Telefon

+49 (0) 170 488 40 28

Forum

Ihre Anfragen

Neue Anfrage

Rufen Sie uns an

+7 (495) 789-45-86

Profil

DE

RU CN DE EN ES FR IT JP KZ UZ PL BY ID
Schließen
Services
Scanner
Dr.Web vxCube
Testversion
Analyse von virenabhängigen Vorfällen
Virenbibliothek
Wissensdatenbank

Technologies

Begriffe

Schulung und Training

Mythen

News

Trojan.Siggen32.5788

Added to the Dr.Web virus database: 2025-11-05

Virus description added:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [HKCU\Software\Classes\uTorrent\shell\open\command] '' = '"%APPDATA%\uTorrent\uTorrent.exe" "%1" /SHELLASSOC'
  • [HKCU\Software\Classes\Applications\uTorrent.exe\shell\open\command] '' = '"%APPDATA%\uTorrent\uTorrent.exe" "%1" /SHELLASSOC'
  • [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'ut' = '%APPDATA%\uTorrent\uTorrent.exe /MINIMIZED'
Malicious functions
Executes the following
  • '%WINDIR%\syswow64\taskkill.exe' /f /im "uTorrent.exe"
Modifies file system
Creates the following files
  • %TEMP%\rarsfx0\pro.exe
  • %TEMP%\rarsfx0\utorrent.exe
  • %TEMP%\nse7845.tmp\system.dll
  • %TEMP%\nse7845.tmp\nsislog.txt
  • %TEMP%\nse7845.tmp\bt_datachannel.dll
  • %TEMP%\nse7845.tmp\utorrent.exe
  • %APPDATA%\utorrent\bt_datachannel.dll
  • %TEMP%\nse7845.tmp\nsisfirewall.dll
  • %TEMP%\nse7845.tmp\inetc.dll
  • %TEMP%\nse7845.tmp\utwin_install.log
  • %TEMP%\utt8b7e.tmp
  • %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\1f91d2d17ea675d4c2c3192e241743f9_8cf7b530-613e-439b-a8c5-ccfc0e745400
  • %APPDATA%\utorrent\updates\3.6.0_47120.exe
  • %APPDATA%\utorrent\updates.dat
  • %APPDATA%\utorrent\settings.dat.new
  • %APPDATA%\utorrent\utorrent.exe
  • %APPDATA%\microsoft\windows\start menu\Вµtorrent.lnk
  • %HOMEPATH%\desktop\Вµtorrent.lnk
  • %APPDATA%\microsoft\internet explorer\quick launch\Вµtorrent.lnk
  • %APPDATA%\utorrent\maindoc.ico
  • %TEMP%\uttc28c.tmp
  • %TEMP%\uttce43.tmp
  • %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\e0139c75200f67a21c39fa637c0ef827_8cf7b530-613e-439b-a8c5-ccfc0e745400
  • %APPDATA%\utorrent\utorrent.lng
  • %LOCALAPPDATA%\microsoft\windows\inetcookies\deprecated.cookie
  • %APPDATA%\utorrent\updates\3.6.0_47120\utorrentie.exe
  • %LOCALAPPDATA%low\utorrent\utorrent_3956_03cb7bc0_1264523935
  • %APPDATA%\utorrent\utorrent.ini
  • %APPDATA%\utorrent\player\btinstall.txt
  • %APPDATA%\utorrent\player\libvlc.dll
  • %APPDATA%\utorrent\player\libvlccore.dll
  • %APPDATA%\utorrent\player\plugins\3dnow\libmemcpy3dn_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libaccess_attachment_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libaccess_bd_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libaccess_ftp_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libaccess_http_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libaccess_imem_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libaccess_mms_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libaccess_rar_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libaccess_realrtsp_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libaccess_smb_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libaccess_tcp_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libaccess_udp_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libaccess_vdr_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libcdda_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libdshow_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libdtv_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libdvdnav_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libdvdread_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libfilesystem_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libidummy_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\liblibbluray_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\librtp_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libscreen_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libsdp_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libstream_filter_rar_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libvcd_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access\libzip_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access_output\libaccess_output_dummy_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access_output\libaccess_output_file_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access_output\libaccess_output_http_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access_output\libaccess_output_livehttp_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access_output\libaccess_output_shout_plugin.dll
  • %APPDATA%\utorrent\player\plugins\access_output\libaccess_output_udp_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\liba52tofloat32_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\liba52tospdif_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libaudiobargraph_a_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libaudio_format_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libchorus_flanger_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libcompressor_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libconverter_fixed_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libdtstofloat32_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libdtstospdif_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libequalizer_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libkaraoke_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libmono_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libmpgatofixed32_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libnormvol_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libparam_eq_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libsamplerate_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libscaletempo_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libsimple_channel_mixer_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libspatializer_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libspeex_resampler_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_filter\libugly_resampler_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_mixer\libfixed32_mixer_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_mixer\libfloat32_mixer_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_output\libadummy_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_output\libamem_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_output\libaout_directx_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_output\libaout_file_plugin.dll
  • %APPDATA%\utorrent\player\plugins\audio_output\libwaveout_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\liba52_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\libaes3_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\libaraw_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\libavcodec_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\libddummy_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\libdmo_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\libedummy_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\libfaad_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\libflac_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\libkate_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\liblibass_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\liblibmpeg2_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\libmpeg_audio_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\libpng_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\libquicktime_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\librawvideo_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\libschroedinger_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\libspeex_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\libtheora_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\libvorbis_plugin.dll
  • %APPDATA%\utorrent\player\plugins\codec\libx264_plugin.dll
  • %APPDATA%\utorrent\player\plugins\control\libdummy_plugin.dll
  • %APPDATA%\utorrent\player\plugins\control\libgestures_plugin.dll
  • %APPDATA%\utorrent\player\plugins\control\libglobalhotkeys_plugin.dll
  • %APPDATA%\utorrent\player\plugins\control\libhotkeys_plugin.dll
  • %APPDATA%\utorrent\player\plugins\control\libnetsync_plugin.dll
  • %APPDATA%\utorrent\player\plugins\control\libntservice_plugin.dll
  • %APPDATA%\utorrent\player\plugins\control\liboldrc_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libaiff_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libasf_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libau_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libavi_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libdemuxdump_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libdemux_cdg_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libdemux_stl_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libdirac_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libes_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libflacsys_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libgme_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libh264_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libimage_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\liblive555_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libmjpeg_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libmkv_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libmod_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libmp4_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libmpc_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libmpgv_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libnsc_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libnsv_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libnuv_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libogg_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libplaylist_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libps_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libpva_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\librawaud_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\librawdv_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\librawvid_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libreal_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libsid_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libsmf_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libsubtitle_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libts_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libtta_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libty_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libvc1_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libvoc_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libwav_plugin.dll
  • %APPDATA%\utorrent\player\plugins\demux\libxa_plugin.dll
  • %APPDATA%\utorrent\player\plugins\gui\libqt4_plugin.dll
  • %APPDATA%\utorrent\player\plugins\gui\libskins2_plugin.dll
  • %APPDATA%\utorrent\player\plugins\lua\liblua_plugin.dll
  • %APPDATA%\utorrent\player\plugins\meta_engine\libfolder_plugin.dll
  • %APPDATA%\utorrent\player\plugins\meta_engine\libtaglib_plugin.dll
  • %APPDATA%\utorrent\player\plugins\misc\libaudioscrobbler_plugin.dll
  • %APPDATA%\utorrent\player\plugins\misc\libexport_plugin.dll
  • %APPDATA%\utorrent\player\plugins\misc\libgnutls_plugin.dll
  • %APPDATA%\utorrent\player\plugins\misc\liblogger_plugin.dll
  • %APPDATA%\utorrent\player\plugins\misc\libmemcpy_plugin.dll
  • %APPDATA%\utorrent\player\plugins\misc\libosd_parser_plugin.dll
  • %APPDATA%\utorrent\player\plugins\misc\libstats_plugin.dll
  • %APPDATA%\utorrent\player\plugins\misc\libxml_plugin.dll
  • %APPDATA%\utorrent\player\plugins\mmx\libi420_rgb_mmx_plugin.dll
  • %APPDATA%\utorrent\player\plugins\mmx\libi420_yuy2_mmx_plugin.dll
  • %APPDATA%\utorrent\player\plugins\mmx\libi422_yuy2_mmx_plugin.dll
  • %APPDATA%\utorrent\player\plugins\mmx\libmemcpymmx_plugin.dll
  • %APPDATA%\utorrent\player\plugins\mmxext\libmemcpymmxext_plugin.dll
  • %APPDATA%\utorrent\player\plugins\mux\libmux_avi_plugin.dll
  • %APPDATA%\utorrent\player\plugins\mux\libmux_dummy_plugin.dll
  • %APPDATA%\utorrent\player\plugins\mux\libmux_mp4_plugin.dll
  • %APPDATA%\utorrent\player\plugins\mux\libmux_mpjpeg_plugin.dll
  • %APPDATA%\utorrent\player\plugins\mux\libmux_ogg_plugin.dll
  • %APPDATA%\utorrent\player\plugins\mux\libmux_ps_plugin.dll
  • %APPDATA%\utorrent\player\plugins\notify\libmsn_plugin.dll
  • %APPDATA%\utorrent\player\plugins\packetizer\libpacketizer_copy_plugin.dll
  • %APPDATA%\utorrent\player\plugins\packetizer\libpacketizer_dirac_plugin.dll
  • %APPDATA%\utorrent\player\plugins\packetizer\libpacketizer_flac_plugin.dll
  • %APPDATA%\utorrent\player\plugins\packetizer\libpacketizer_h264_plugin.dll
  • %APPDATA%\utorrent\player\plugins\packetizer\libpacketizer_mlp_plugin.dll
  • %APPDATA%\utorrent\player\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll
  • %APPDATA%\utorrent\player\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll
  • %APPDATA%\utorrent\player\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll
  • %APPDATA%\utorrent\player\plugins\plugins.dat
  • %APPDATA%\utorrent\player\plugins\services_discovery\libmediadirs_plugin.dll
  • %APPDATA%\utorrent\player\plugins\services_discovery\libpodcast_plugin.dll
  • %APPDATA%\utorrent\player\plugins\services_discovery\libsap_plugin.dll
  • %APPDATA%\utorrent\player\plugins\services_discovery\libupnp_plugin.dll
  • %APPDATA%\utorrent\player\plugins\services_discovery\libwindrive_plugin.dll
  • %APPDATA%\utorrent\player\plugins\sse2\libi420_rgb_sse2_plugin.dll
  • %APPDATA%\utorrent\player\plugins\sse2\libi420_yuy2_sse2_plugin.dll
  • %APPDATA%\utorrent\player\plugins\sse2\libi422_yuy2_sse2_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_filter\libstream_filter_httplive_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_filter\libstream_filter_record_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_autodel_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_bridge_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_delay_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_description_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_display_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_dummy_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_duplicate_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_es_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_gather_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_langfromtelx_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_mosaic_bridge_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_raop_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_record_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_rtp_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_select_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_setid_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_smem_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_standard_plugin.dll
  • %APPDATA%\utorrent\player\plugins\stream_out\libstream_out_transcode_plugin.dll
  • %APPDATA%\utorrent\player\plugins\text_renderer\libfreetype_plugin.dll
  • %APPDATA%\utorrent\player\plugins\text_renderer\libtdummy_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_chroma\libgrey_yuv_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_chroma\libi420_rgb_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_chroma\libi420_yuy2_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_chroma\libi422_i420_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_chroma\libi422_yuy2_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_chroma\librv32_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_chroma\libyuy2_i420_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_chroma\libyuy2_i422_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libadjust_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libalphamask_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libantiflicker_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libatmo_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libaudiobargraph_v_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libball_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libblendbench_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libblend_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libbluescreen_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libcanvas_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libchain_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libclone_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libcolorthres_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libcroppadd_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libdeinterlace_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\liberase_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libextract_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libgaussianblur_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libgradfun_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libgradient_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libgrain_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libinvert_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\liblogo_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libmagnify_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libmarq_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libmirror_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libmosaic_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libmotionblur_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libmotiondetect_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libosdmenu_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libpanoramix_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libposterize_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libpostproc_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libpsychedelic_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libpuzzle_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libremoteosd_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libripple_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\librotate_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\librss_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libscale_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libscene_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libsepia_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libsharpen_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libsubsdelay_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libswscale_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libtransform_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libwall_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libwave_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_filter\libyuvp_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_output\libcaca_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_output\libdirect2d_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_output\libdirect3d_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_output\libdirectx_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_output\libdrawable_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_output\libglwin32_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_output\libvdummy_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_output\libvmem_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_output\libwingdi_plugin.dll
  • %APPDATA%\utorrent\player\plugins\video_output\libyuv_plugin.dll
  • %APPDATA%\utorrent\player\plugins\visualization\libgoom_plugin.dll
  • %APPDATA%\utorrent\player\plugins\visualization\libprojectm_plugin.dll
  • %APPDATA%\utorrent\player\plugins\visualization\libvisual_plugin.dll
  • %APPDATA%\utorrent\virusguard\avxdisk.dll
  • %APPDATA%\utorrent\virusguard\bdcore.dll
  • %APPDATA%\utorrent\virusguard\bdupdateservicecom.dll
  • %APPDATA%\utorrent\virusguard\bittorrentantivirus.exe
  • %APPDATA%\utorrent\virusguard\btinstall.txt
  • %APPDATA%\utorrent\virusguard\plugins\7zip.xmd
  • %APPDATA%\utorrent\virusguard\plugins\access.xmd
  • %APPDATA%\utorrent\virusguard\plugins\ace.xmd
  • %APPDATA%\utorrent\virusguard\plugins\adsntfs.xmd
  • %APPDATA%\utorrent\virusguard\plugins\aitok.cvd
  • %APPDATA%\utorrent\virusguard\plugins\alz.xmd
  • %APPDATA%\utorrent\virusguard\plugins\ar.xmd
  • %APPDATA%\utorrent\virusguard\plugins\arc.xmd
  • %APPDATA%\utorrent\virusguard\plugins\arj.xmd
  • %APPDATA%\utorrent\virusguard\plugins\aspy_emu.cvd
  • %APPDATA%\utorrent\virusguard\plugins\auto.cvd
  • %APPDATA%\utorrent\virusguard\plugins\auto.xmd
  • %APPDATA%\utorrent\virusguard\plugins\autoit.xmd
  • %APPDATA%\utorrent\virusguard\plugins\avxdisk.xmd
  • %APPDATA%\utorrent\virusguard\plugins\bach.xmd
  • %APPDATA%\utorrent\virusguard\plugins\boot.xmd
  • %APPDATA%\utorrent\virusguard\plugins\bzip2.xmd
  • %APPDATA%\utorrent\virusguard\plugins\cab.xmd
  • %APPDATA%\utorrent\virusguard\plugins\cevakrnl.cvd
  • %APPDATA%\utorrent\virusguard\plugins\cevakrnl.ivd
  • %APPDATA%\utorrent\virusguard\plugins\cevakrnl.xmd
  • %APPDATA%\utorrent\virusguard\plugins\ceva_dll.cvd
  • %APPDATA%\utorrent\virusguard\plugins\ceva_emu.cvd
  • %APPDATA%\utorrent\virusguard\plugins\ceva_vfs.cvd
  • %APPDATA%\utorrent\virusguard\plugins\ceva_vfs.ivd
  • %APPDATA%\utorrent\virusguard\plugins\chm.xmd
  • %APPDATA%\utorrent\virusguard\plugins\cookie.cvd
  • %APPDATA%\utorrent\virusguard\plugins\cookie.xmd
  • %APPDATA%\utorrent\virusguard\plugins\cpio.xmd
  • %APPDATA%\utorrent\virusguard\plugins\cran.cvd
  • %APPDATA%\utorrent\virusguard\plugins\cran.ivd
  • %APPDATA%\utorrent\virusguard\plugins\dalvik.cvd
  • %APPDATA%\utorrent\virusguard\plugins\dalvik.ivd
  • %APPDATA%\utorrent\virusguard\plugins\dalvik.xmd
  • %APPDATA%\utorrent\virusguard\plugins\dbx.xmd
  • %APPDATA%\utorrent\virusguard\plugins\disp.xmd
  • %APPDATA%\utorrent\virusguard\plugins\docfile.xmd
  • %APPDATA%\utorrent\virusguard\plugins\dummyarch.xmd
  • %APPDATA%\utorrent\virusguard\plugins\dummyscan.xmd
  • %APPDATA%\utorrent\virusguard\plugins\epoc.xmd
  • %APPDATA%\utorrent\virusguard\plugins\e_spyw.cvd
  • %APPDATA%\utorrent\virusguard\plugins\e_spyw.ivd
  • %APPDATA%\utorrent\virusguard\plugins\gvmscripts.cvd
  • %APPDATA%\utorrent\virusguard\plugins\gzip.xmd
  • %APPDATA%\utorrent\virusguard\plugins\ha.xmd
  • %APPDATA%\utorrent\virusguard\plugins\hlp.xmd
  • %APPDATA%\utorrent\virusguard\plugins\hpe.cvd
  • %APPDATA%\utorrent\virusguard\plugins\hqx.xmd
  • %APPDATA%\utorrent\virusguard\plugins\html.xmd
  • %APPDATA%\utorrent\virusguard\plugins\imp.xmd
  • %APPDATA%\utorrent\virusguard\plugins\inno.xmd
  • %APPDATA%\utorrent\virusguard\plugins\instyler.xmd
  • %APPDATA%\utorrent\virusguard\plugins\iso.xmd
  • %APPDATA%\utorrent\virusguard\plugins\java.cvd
  • %APPDATA%\utorrent\virusguard\plugins\java.xmd
  • %APPDATA%\utorrent\virusguard\plugins\jpeg.xmd
  • %APPDATA%\utorrent\virusguard\plugins\lha.xmd
  • %APPDATA%\utorrent\virusguard\plugins\lnk.xmd
  • %APPDATA%\utorrent\virusguard\plugins\mbox.xmd
  • %APPDATA%\utorrent\virusguard\plugins\mbx.xmd
  • %APPDATA%\utorrent\virusguard\plugins\mdx.xmd
  • %APPDATA%\utorrent\virusguard\plugins\mdx_97.cvd
  • %APPDATA%\utorrent\virusguard\plugins\mdx_97.ivd
  • %APPDATA%\utorrent\virusguard\plugins\mdx_w95.cvd
  • %APPDATA%\utorrent\virusguard\plugins\mdx_x95.cvd
  • %APPDATA%\utorrent\virusguard\plugins\mdx_xf.cvd
  • %APPDATA%\utorrent\virusguard\plugins\mime.xmd
  • %APPDATA%\utorrent\virusguard\plugins\mobmalware.cvd
  • %APPDATA%\utorrent\virusguard\plugins\mobmalware.xmd
  • %APPDATA%\utorrent\virusguard\plugins\mso.xmd
  • %APPDATA%\utorrent\virusguard\plugins\na.cvd
  • %APPDATA%\utorrent\virusguard\plugins\nelf.cvd
  • %APPDATA%\utorrent\virusguard\plugins\nelf.xmd
  • %APPDATA%\utorrent\virusguard\plugins\nsis.xmd
  • %APPDATA%\utorrent\virusguard\plugins\objd.xmd
  • %APPDATA%\utorrent\virusguard\plugins\orice.rvd
  • %APPDATA%\utorrent\virusguard\plugins\pdf.xmd
  • %APPDATA%\utorrent\virusguard\plugins\proc.xmd
  • %APPDATA%\utorrent\virusguard\plugins\pst.xmd
  • %APPDATA%\utorrent\virusguard\plugins\rar.xmd
  • %APPDATA%\utorrent\virusguard\plugins\regarch.cvd
  • %APPDATA%\utorrent\virusguard\plugins\regarch.xmd
  • %APPDATA%\utorrent\virusguard\plugins\regscan.cvd
  • %APPDATA%\utorrent\virusguard\plugins\regscan.xmd
  • %APPDATA%\utorrent\virusguard\plugins\rpm.xmd
  • %APPDATA%\utorrent\virusguard\plugins\rtf.xmd
  • %APPDATA%\utorrent\virusguard\plugins\rup.cvd
  • %APPDATA%\utorrent\virusguard\plugins\rup.xmd
  • %APPDATA%\utorrent\virusguard\plugins\sdx.cvd
  • %APPDATA%\utorrent\virusguard\plugins\sdx.ivd
  • %APPDATA%\utorrent\virusguard\plugins\sdx.xmd
  • %APPDATA%\utorrent\virusguard\plugins\sfx.xmd
  • %APPDATA%\utorrent\virusguard\plugins\swf.xmd
  • %APPDATA%\utorrent\virusguard\plugins\tar.xmd
  • %APPDATA%\utorrent\virusguard\plugins\td0.xmd
  • %APPDATA%\utorrent\virusguard\plugins\thebat.xmd
  • %APPDATA%\utorrent\virusguard\plugins\tnef.xmd
  • %APPDATA%\utorrent\virusguard\plugins\uif.xmd
  • %APPDATA%\utorrent\virusguard\plugins\unpack.cvd
  • %APPDATA%\utorrent\virusguard\plugins\unpack.ivd
  • %APPDATA%\utorrent\virusguard\plugins\unpack.xmd
  • %APPDATA%\utorrent\virusguard\plugins\update.txt
  • %APPDATA%\utorrent\virusguard\plugins\uudecode.xmd
  • %APPDATA%\utorrent\virusguard\plugins\ve.cvd
  • %APPDATA%\utorrent\virusguard\plugins\ve.ivd
  • %APPDATA%\utorrent\virusguard\plugins\ve.xmd
  • %APPDATA%\utorrent\virusguard\plugins\vedata.cvd
  • %APPDATA%\utorrent\virusguard\plugins\viza.xmd
  • %APPDATA%\utorrent\virusguard\plugins\wise.xmd
  • %APPDATA%\utorrent\virusguard\plugins\xar.xmd
  • %APPDATA%\utorrent\virusguard\plugins\xcookies.xmd
  • %APPDATA%\utorrent\virusguard\plugins\xishield.xmd
  • %APPDATA%\utorrent\virusguard\plugins\xlmrd.cvd
  • %APPDATA%\utorrent\virusguard\plugins\xlmrd.ivd
  • %APPDATA%\utorrent\virusguard\plugins\z.xmd
  • %APPDATA%\utorrent\virusguard\plugins\zip.xmd
  • %APPDATA%\utorrent\virusguard\plugins\zoo.xmd
  • %APPDATA%\utorrent\virusguard\plugins.htm
  • %APPDATA%\utorrent\virusguard\scan.dll
  • %APPDATA%\utorrent\secur32.dll
Deletes following files that it created itself
  • %TEMP%\utt8b7e.tmp
  • %TEMP%\uttc28c.tmp
  • %TEMP%\uttce43.tmp
  • %TEMP%\nse7845.tmp\bt_datachannel.dll
  • %TEMP%\nse7845.tmp\inetc.dll
  • %TEMP%\nse7845.tmp\nsisfirewall.dll
  • %TEMP%\nse7845.tmp\system.dll
  • %TEMP%\nse7845.tmp\utorrent.exe
  • %TEMP%\nse7845.tmp\utwin_install.log
  • %LOCALAPPDATA%low\utorrent\utorrent_3956_03cb7bc0_1264523935
Moves the following files
  • from %APPDATA%\utorrent\settings.dat.new to %APPDATA%\utorrent\settings.dat
  • from %APPDATA%\utorrent\settings.dat to %APPDATA%\utorrent\settings.dat.old
Substitutes the following files
  • %APPDATA%\utorrent\settings.dat.new
  • %APPDATA%\utorrent\settings.dat
Network activity
Connects to
  • 'co##############e-chains.prod.autograph.services.mozaws.net':443
  • 'i-####.####120.ut.bench.utorrent.com':80
  • 'i-##.#####20.ut.bench.utorrent.com':80
  • 'up####.utorrent.li':80
  • 'go.microsoft.com':443
  • 'msedge.sf.dl.delivery.mp.microsoft.com':443
  • '<LOCALNET>..24.4':30172
TCP
HTTP GET requests
  • http://up####.utorrent.li/installstats.php?cl####################################################################################################################################################...
  • http://ut###ent.com/download/langpacks/dl.php?bu##################################################################
  • http://le####.utorrent.com/scripts/dl.php?bu##################################################################
  • http://10.#.24.4:30172/
HTTP POST requests
  • http://i-####.####120.ut.bench.utorrent.com/e?i=####
  • http://i-##.#####20.ut.bench.utorrent.com/e?i=##
Other
  • 'go.microsoft.com':443
  • 'msedge.sf.dl.delivery.mp.microsoft.com':443
  • '<LOCALNET>..24.4':49716
UDP
  • DNS ASK i-####.####120.ut.bench.utorrent.com
  • DNS ASK ro####.bittorrent.com
  • DNS ASK ro####.utorrent.com
  • DNS ASK i-##.#####20.ut.bench.utorrent.com
  • DNS ASK up####.utorrent.li
  • DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
  • DNS ASK ut###ent.com
  • DNS ASK le####.utorrent.com
  • DNS ASK ap##.#ittorrent.com
  • DNS ASK go.microsoft.com
  • DNS ASK msedge.sf.dl.delivery.mp.microsoft.com
  • '<LOCALNET>..24.1':5351
  • 'ro####.utorrent.com':6881
  • 'ro####.bittorrent.com':6881
  • '17#.#27.73.168':11304
  • '95.#5.251.5':3991
  • '17#.#74.217.137':9671
  • '20#.#59.86.252':1024
  • '23#.#55.255.250':1900
  • '12#.#49.199.140':32781
  • '18#.#82.88.157':39207
  • '46.##6.191.29':52886
  • '93.##0.44.59':20998
  • '61.#4.55.33':7955
  • '10#.#.134.176':9010
  • '27.##0.201.104':41054
  • '14#.#15.164.106':6882
  • '59.##.154.72':62868
  • '17#.#18.98.6':40960
  • '11#.#99.17.202':33102
  • '16#.#25.166.153':20864
  • '21#.#54.21.6':38391
  • '60.##8.79.35':7147
  • '20#.#2.31.203':19993
  • '16#.#50.223.219':58147
  • '21#.#5.77.156':50006
  • '21#.#52.161.211':50388
  • '20#.#71.171.4':28746
  • '51.##.177.190':51413
  • '18#.#03.56.65':19516
  • '62.##6.70.85':23319
  • '68.#.97.192':4173
  • '75.#.132.157':6889
  • '85.##.61.200':50413
  • '10#.#52.201.175':1066
  • '5.###.238.226':60198
  • '5.##.245.181':6146
  • '87.##5.110.142':49001
  • '89.##2.150.14':6881
  • '18#.#2.206.75':51413
  • '18#.#1.216.197':61791
  • '91.##5.11.234':2060
  • '91.##5.90.146':2496
  • '11#.#20.220.77':2768
  • '1.###.245.21':6881
  • '12#.#88.208.204':7977
  • '85.##8.104.228':13568
  • '15#.#3.52.107':10240
  • '13#.#8.232.16':6882
  • '75.##9.138.164':6881
  • '15#.#3.206.217':32681
  • '95.##.231.90':30419
  • '24.##2.246.227':51413
  • '19#.#54.172.179':22256
  • '14#.#6.175.153':42374
  • '17#.#.65.133':25807
  • '5.##.232.66':18757
  • '37.#9.40.66':30177
  • '11#.#8.157.145':3488
  • '18#.#4.239.7':51491
  • '51.##2.141.220':6881
  • '23.#0.81.47':32681
  • '37.##6.239.7':55138
  • '11#.#55.203.191':53636
  • '42.##8.190.118':7047
  • '52.#.197.152':6881
  • '19#.#70.172.38':10240
  • '14#.#0.203.157':47942
  • '20#.#09.248.153':55028
  • '81.#3.28.3':54124
  • '5.##.161.141':6881
  • '45.##.21.204':48831
  • '93.##4.62.40':6889
  • '19#.#2.127.220':8999
  • '87.#6.3.192':13406
  • '89.##.246.19':6881
  • '12#.#93.171.149':43592
  • '15#.#49.160.31':1795
  • '85.##.14.157':25059
  • '27.##5.251.78':1723
  • '18#.#18.186.220':17289
Miscellaneous
Searches for the following windows
  • ClassName: 'EDIT' WindowName: ''
  • ClassName: 'ВµTorrent4823DF041B09' WindowName: ''
  • ClassName: 'ВµTorrent4823DF041B0D' WindowName: ''
  • ClassName: '' WindowName: ''
  • ClassName: 'MS_AutodialMonitor' WindowName: ''
  • ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
  • '%TEMP%\rarsfx0\utorrent.exe' /S
  • '%TEMP%\nse7845.tmp\utorrent.exe' /S
  • '%APPDATA%\utorrent\utorrent.exe' /NOINSTALL /BRINGTOFRONT /S
  • '%APPDATA%\utorrent\updates\3.6.0_47120\utorrentie.exe' uTorrent_3956_03CB7BC0_1264523935 ВµTorrent4823DF041B09 uTorrent ie unp
  • '%APPDATA%\utorrent\updates\3.6.0_47120\utorrentie.exe' uTorrent_3956_04039AC8_913319018 ВµTorrent4823DF041B09 uTorrent ie unp
  • '%TEMP%\rarsfx0\pro.exe'

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

 

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

 

Download Dr.Web

Download by serial number

Download on App Store

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

 

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play