MD5: 4428884ab0a8e2143cef0e7083c74a35
SHA1: 725de07446f51b7f8247aa6f01bba4e223f8306b
SHA256: e1addeca57938ea40a6444310826bef2260b9eb1d29c793a9244892b5efa18b0
SSDeep: 3072:yPXX7Nld9S3BJ245b5kRuXkC60Ibtpakdowvmf:yPq3CQkov67WT3f
Size: 124316 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-01-05 14:09:37
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:604

The Trojan injects its code into the following process(es):

uTorrent 3.0.exe:572

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:604 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsn2.tmp\splash.bmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn2.tmp\NSISdl.dll (1175 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uTorrent 3.0.exe (30968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn2.tmp\AdvSplash.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn2.tmp\NSISArray.dll (19 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsh1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn2.tmp (0 bytes)

The process uTorrent 3.0.exe:572 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\c5b88721db08c824db69d0bbc702beb8_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (44 bytes)

Registry activity

The process %original file name%.exe:604 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BF 92 8A D0 97 F2 52 5A 27 2A A2 52 4D E1 17 5C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process uTorrent 3.0.exe:572 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D3 4F DF 6B 8D AA 2D B1 A3 3D 1D 47 56 5D A9 C0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://files.letoltes.com/mp3/utorrent181.exe	81.0.120.39

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile

Traffic

GET /mp3/utorrent181.exe HTTP/1.0

Host: files.letoltes.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Sun, 26 Apr 2015 05:35:11 GMT

Content-Type: application/octet-stream

Content-Length: 270128

Last-Modified: Sun, 09 Nov 2008 19:16:05 GMT

Connection: close

ETag: "491736f5-41f30"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......7..cs.@0s.@0
s.@0s.@[email protected]}[email protected][email protected][email protected][email protected]~.@[email protected]..@0T.
-0r.@0T.<[email protected].@[email protected].........
[email protected].......@... ....@..........................`.........
......................................P..$.... ...0..............0....
......................................................................
.................UPX0.....0..............................UPX1.........
@[email protected]....@... ...4..................@......
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..........3.00.UPX!........:...............I......(.`h......"..N..:ha.
.c.....o .=.$-[....z..U...e..../..J...~......W %E.\.Y#_lR.Ck.kH....#.K
.*..g..5._.:.t^.;<..z.....d...P.Q..s...Erlh.....-a.-,.@9.... b...n.
..)?_....vOS......N.1.`...t....'p..GX..2x...^.sL.A.F1&..%."...i..F..I4
..../~Q...`.0.Vw.4f.b...........K:.P\.6.G..*i..Y....R)..1^...p..|=.gr.
.i...Zu.}....4.m .....(...1.S......tV...#.9f..q.... y..(.......a..Y...
|R..D.".6.!.M>...L...>...`.........J$.S.D.x..f[..Aaj..cV....D>
;F%.,.n..M.KE..u......zp.*...'S.*s.H.{B<...L<...t.R. .w.#..'
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

0`.data

.rdata

[email protected]

.idata

.ndata

.rsrc

... %d%%

hXXp://nsis.sf.net/NSIS_Error

verifying installer: %d%%

~nsu.tmp

%u.%u%s%s

.DEFAULT\Control Panel\International

*?|<>/":

%s=%s

Software\Microsoft\Windows\CurrentVersion

RegDeleteKeyExA

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\uTorrent 3.0.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn2.tmp\NSISdl.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn2.tmp

s.com telep

y>.po!(

84X%S7v

7.SI!7

,*.Lc

t&t%x

libgcj_s.dll

invalid socket passed to connect

invalid URL

GET %s HTTP/1.0

Host: %s

Downloading %s

(%u seconds remaining)

(%u minutes remaining)

(%u hours remaining)

%skB (%d%%) of %skB at %u.
ukB/s

Unable to open %s

Software\Microsoft\Windows\CurrentVersion\Internet Settings

http=

User-Agent: NSISDL/1.2 (Mozilla)

operator

operator

pglobal destructors keyed to

global constructors keyed to

NSISdl.dll

RegCloseKey

RegOpenKeyExA

ADVAPI32.DLL

KERNEL32.dll

msvcrt.dll

USER32.dll

WS2_32.DLL

1$1,181@1

!G.Le

.TG8{

s: C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\uTorrent 3.0.exe

s.com Telep

nsn2.tmp

m\LOCALS~1\Temp\uTorrent 3.0.exe

0.exe

RegCreateKeyExA

RegDeleteKeyA

RegEnumKeyA

GetWindowsDirectoryA

SHFileOperationA

ShellExecuteA

ExitWindowsEx

COMCTL32.DLL

GDI32.dll

OLE32.dll

SHELL32.DLL

VERSION.dll

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn2.tmp

hXXp://files.letoltes.com/mp3/utorrent181.exe

c:\%original file name%.exe

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

2097807982

1114426

1114380

1179828

)-.Yln

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46-1</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency></assembly>

uTorrent 3.0.exe_572:

`.rsrc

t5Ht.Hu?S3

uMSSh

'SSht

F?SSh

UDP0u

PSSSSSSh

{9%uO9{

keyA

keyB

I[tFIt.It

SSSSSSSh8

<%uIF

FTPj<

hXXp://

.torrent

webseeds

feed_url

download_url

%.*S/scrape%S%cinfo_hash=%.20U

path.utf-8

name.utf-8

Windows-

url-list

port

%S%cinfo_hash=%.20U&peer_id=%.20U&port=%d&uploaded=%Ld&downloaded=%Ld&left=%Ld&corrupt=%Ld&key=%.8X%s&numwant=%d&compact=1&no_peer_id=1%s%s

%S%cinfo_hash=%.20U&peer_id=%.20U&port=%d&uploaded=%Ld&downloaded=%Ld&left=%Ld&key=%.8X%s&numwant=%d&compact=1&no_peer_id=1%s%s&t_checkin=%d&w_downloaded=%Ld&p_downloaded=%Ld&p_uploaded=%Ld&w_bad=%Ld&w_fail=%d&c_bytes=%Ld&h=%s

&ipv6=%U

&ip=%U

0.0.0.0

bt.external_addr

diskio.flush_files

choker.interval_optim

choker.interval

choker.interval_auto

peer.disconnect_inactive_interval

peer.disconnect_inactive

peer.resolve_country

peer.lazy_bitfield_nohave

peer.lazy_bitfield_factor

peer.lazy_bitfield_mode

peer.lazy_bitfield

bt.graceful_shutdown

bt.use_rangeblock

bt.ban_ratio

bt.use_ban_ratio

bt.ban_threshold

bt.no_connect_to_services_list

bt.no_connect_to_services

bt.allow_same_ip

bt.sequential_files

bt.sequential_download

bt.prio_first_last_piece

bt.connect_speed

bt.set_sockbuf

bt.send_have_to_seed

bt.multiscrape

bt.enable_tracker

bt.compact_allocation

bt.scrape_stopped

bt.ul_queue_factor

bt.dl_queue_factor

bt.http_pending_limit

bt.few_pieces_thres

bt.prio_piece_thres

bt.extra_ul_max

bt.extra_ul_rand

bt.transp_disposition

bt.auto_ul_factor

bt.auto_ul_min

bt.auto_ul_sample_average

bt.auto_ul_sample_window

bt.auto_ul_interval

bt.auto_ul_dryrun

queue.started_bonus

queue.switchtime_prio

queue.switchtime

queue.prio_no_seeds

queue.use_seed_peer_ratio

queue.slow_ul_threshold

queue.slow_dl_threshold

queue.dont_count_slow_ul

queue.dont_count_slow_dl

25,110,6666,6667

*?%I.%s

zz.countries.nerd.dk

[email protected]

HTTPBT

kernel32.dll

UT1_%s:%d

Outstanding add nodes: %d

Total peers: %d (in replacement cache %d)

%s %A fail:%d seen:%d age:%S ver:%s

Bucket %d: %.8X%.8X%.8X%.8X%.8X (replacement cache: %d)

Num buckets: %d. My DHT ID: %s

Total torrents: %d

Total peers: %d

%d: %s: %d peers

d1:ad2:id20:%.20m9:info_hash20:%.20m4:portiÞ5:token%d:%.*me1:q13:announce_peer1:t4:%.4m1:v4:%.4m1:y1:qe

5:nodes%d:

router.bittorrent.com

router.utorrent.com

e1:t%d:%.*m1:v4:%.4m1:y1:re

cache.disable_win_write

cache.disable_win_read

cache.read_thrash

cache.read_prune

cache.read_turnoff

cache.read

cache.writeimm

cache.writeout

cache.write

cache.reduce

cache.override_size

cache.override

diskio.rsize_factor

diskio.coalesce_write_size

diskio.coalesce_writes

diskio.smart_sparse_hash

diskio.smart_hash

diskio.use_partfile

diskio.no_zero

diskio.sparse_files

Error: COMPACT_NOT_FOUND. P=%d,T=%d

utorrent.com

_bittorrent-tracker._tcp.%s

DnsApi.dll

Authorization: Basic %s

HTTP/1.1

Host: %s%s

User-Agent: %s

Accept-Encoding:%s

BTWebClient/1810

hXXp://%s%s%s

HTTP/1.

https:

webui.cookie

webui.port

webui.restrict

webui.guest

webui.salt

webui.hashword

webui.password

webui.username

webui.token_auth

webui.enable_listen

webui.enable_guest

webui.enable

HTTP/1.1 301 Moved Permanently

Location: %s

HTTP/1.1 %d %s

Content-Length: %d

Content-Type: %s

%s%s%s%s

User-Agent: BTWebClient/1810

GET %s HTTP/1.1

%s%S/%s

wininet.dll

InternetOpenUrlA

HttpQueryInfoA

GetExtendedTcpTable

Iphlpapi.dll

4.2.2.1

127.0.0.0

172.16.0.0

169.254.0.0

192.168.0.0

10.0.0.0

239.192.152.143

port:

BT-SEARCH * HTTP/1.1

Host: 239.192.152.143:6771

Port: %u

Infohash: %s

Unsupported Version

Not Authorized/Refused (e.g. box supports mapping, but user has turned feature off)

Unsupported opcode

NAT-PMP: %s %s port %d -> %I:%d

NAT-PMP: error: %s

NAT-PMP: Unable to map port with NAT-PMP.

Invalid Username/Password

Error code: HTTP %d

?QoS: running low (%u @ %u kB/s), stepping up to %u

QoS: running high (%u @ %u kB/s), throttling down to %u

Proxy-Authorization: Basic %s

%s:%s

HTTP/1

CONNECT %A HTTP/1.0

CONNECT %s:%d HTTP/1.0

WSAEnumNetworkEvents error (%d)

oleaut32.dll

ole32.dll

10:total_sizei%ue

5:piecei%ue

8:msg_typei%ue

8:dropped6%d:

7:dropped%d:

8:added6.f%d:

6:added6%d:

7:added.f%d:

5:added%d:

1:piÞ4:reqqiÞ1:v%d:%s

13:metadata_sizeiÞ

d1:eiÞ1:md

msg_type

psapi.dll

ac3.5.1

webrip

hr.pdtv

hr.hdtv

dddd.dd.dd

dd.dd.dd

advapi32.dll

hXXp://utorrent.com/webui/webui-%s-%s.zip

1.8.1

hXXp://utorrent.com/webui/version-%s

HTTP/1.1 200 OK

Unable to listen for HTTP traffic on port %d

,[%S,%J,%J,%I]

,"files": [%s, [

ETag: %s

HTTP/1.1 404 Not Found

token.html

<meta http-equiv="refresh" content="1" />Please wait while the µTorrent WebUI is installed... You will be automatically redirected.

/gui/index.html?error=1

/gui/index.html

downloading_webui

download_webui

<b>There was a problem installing µTorrent WebUI, please see the µTorrent log for more details.</b></br></br>

index.html?error=1

The µTorrent WebUI does not seem to be installed. Click <a href="download_webui">here</a> to try to install it, or see the <a href="hXXp://utorrent.com/webui-guide.php">guide</a> for more details.

index.html

HTTP/1.1 304 Not Modified

Unable to read webui.zip

,"trackers": %S

,"props": [{"hash": %s

[%s,%I,%S,%J,%I,%J,%J,%I,%I,%I,%I,%S,%I,%I,%I,%I,%I,%I,%J]

,[%S,%I]

,[%s,%I,%S]

,"error": %S

getmsg

add-url

/gui/guest.html

HTTP: IP %a: Blocked: GET %.100s

HTTP/1.1 401 Unauthorized

HTTP: IP %a: GET %.200s

UPnP(XP): %s port %d -> %I:%d mapped successfully.

UPnP(XP): %s port %d -> %I:%d is already mapped. Not re-mapping.

UPnP(XP): Removed UDP port %d

UPnP(XP): Removed TCP port %d

Internal and External port values must be the same

The NAT implementation only supports permanent lease times on port mappings

ExternalPort must be a wildcard and cannot be a specific port

The port mapping entry specified conflicts with a mapping assigned previously to another client

The external port cannot be wild-carded

239.255.255.250

M-SEARCH * HTTP/1.1

HOST: 239.255.255.250:1900

scpdurl

eventsuburl

controlurl

urlbase

NewInternalPort

NewExternalPort

%s port %d -> %I:%d

%s port %d

</u:%s>

<NewRemoteHost></NewRemoteHost><NewExternalPort>%d</NewExternalPort><NewProtocol>%s</NewProtocol><NewInternalPort>%d</NewInternalPort><NewInternalClient>%I</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>uTorrent (%s)</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration>

<NewRemoteHost></NewRemoteHost><NewExternalPort>%d</NewExternalPort><NewProtocol>%s</NewProtocol>

<NewPortMappingIndex>%d</NewPortMappingIndex>

<s:Envelope xmlns:s="hXXp://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="hXXp://schemas.xmlsoap.org/soap/encoding/">

<u:%s xmlns:u="%s">

AddPortMapping

DeletePortMapping

GetGenericPortMappingEntry

UPnP: %s is already mapped. Not re-mapping.

UPnP: ERROR removing %s: (%d) %s

UPnP: Removed %s

UPnP: ERROR mapping %s: (%d) %s

UPnP: ERROR mapping %s. Deleting mapping and trying again: (%d) %s

UPnP: %s mapped successfully.

UPnP: Mapped %s

http:

hXXp://%s:%d/%s

POST %s HTTP/1.1

HOST: %s:%d

CONTENT-LENGTH: %d

SOAPACTION: "%s#%s"

Host: %s:%d

?456789:;<=

!"#$%&'()* ,-./0123

hXXps://

rpcrt4.dll

d10:.fileguard40:%s

d10:.fileguard40:

%d/%d blocks. %d/%d bytes.

]: %s: %d

shell32.dll

255.255.255.255

UDP setsockopt(SO_SNDBUF, %d) failed: %d

UDP setsockopt(SO_RCVBUF, %d) failed: %d

uxtheme.dll

MsgBoxData

comctl32.dll

TaskDialogIndirect

HttpOpenRequestA

HttpSendRequestA

Windows version %d.%d %d %s

Torrent Crash Report ***

Build: %X (%d) built on Fri Oct 3 04:24:32 2008

\%d-utorrent.%.4x.dmp

DBGHELP.DLL

\DBGHELP.DLL

Error %d :

HttpQueryInfo failed

HttpSendRequest failed

HttpOpenRequest failed

/crash.php?ver=%dU

can't load wininet.dll

l.url

l.siz

l.sha

l.sig

l.ver

u.url

u.siz

u.sha

u.sig

u.ver

u.msg

&t_down=%u

&t_up=%u

&c_down=%u

&c_up=%u

&k=%U

&h=%s

&t=%d

&e=%d

&w=%X

&c=%U

&l=%U

&i=%d

&lv=%d_%d_%U

&qv=%d

?v=%d

hXXp://update.utorrent.com/checkupdate.php

&dl=%u

&con=%u

&dns=%u

&ip=%S

hXXp://update.utorrent.com/updatestats.php

user32.dll

ShellExecuteExW

hXXp://VVV.utorrent.com

shfolder.dll

SHFileOperationW

proxy.password

proxy.username

proxy.resolve

proxy.auth

proxy.port

proxy.type

proxy.proxy

gui.last_overview_tab-1.8

gui.last_preference_tab-1.8

gui.bypass_search_redirect

gui.tall_category_list

gui.piecebar_progress

gui.graphic_progress

gui.limits_in_statusbar

gui.speed_in_title

gui.default_del_action

gui.delete_to_trash

gui.sg_mode

gui.update_rate

gui.dblclick_dl

gui.dblclick_seed

rss.smart_repack_filter

rss.update_interval

boss_key

gui.log_date

dht.rate

ipfilter.enable

isp.bep22

net.upnp_tcp_only

net.diffserv_codepoint

net.wsaevents

net.max_halfopen

net.calc_overhead

net.low_cpu

net.outgoing_max_port

net.outgoing_port

net.outgoing_ip

net.bind_ip

rand_port_on_start

sys.enable_wine_hacks

sys.prevent_standby

gui.alternate_color

gui.compat_diropen

gui.persistent_labels

gui.manual_ratemenu

gui.dlrate_menu

gui.ulrate_menu

bind_port

tray.single_click

tray.show

Google|hXXp://google.com/search?q=

BitTorrent|hXXp://VVV.bittorrent.com/search?client=%v&search=

.fileguard

winmm.dll

D@hXXp://VVV.utorrent.com?client=utorrent1810

ftp34.dll

t1.dll

Trojan-Downloader.Agent.Pto

t0.dll

laf5.dll

laf4.dll

laf3.dll

laf2.dll

Win32/Hoax.Renos.NAV

laf1.dll

MIPro.dll

MImp.dll

imon.dll

SARAH.dll

Niphk.dll

iFW_Xfilter.dll

MxAVlsp.dll

nvappfilter.dll

SetThreadExecutionState

'%s' (%s) (known malware!)

'%s' (%s)

hXXp://forum.utorrent.com?client=utorrent1810

hXXp://VVV.utorrent.com/faq.php?client=utorrent1810

hXXp://download.utorrent.com/utorrent-help.zip

onWmClose: msg %d

hXXp://search.utorrent.com/search.php?q=%U&e=%U&u=1

%s%%s

%sutorrent1810

%s=%s

%sclient=%%v

hXXp://utorrent.com/rsstutorial.php

hXXp://VVV.utorrent.com/download.php

hXXp://VVV.dslreports.com/speedtest

hXXp://VVV.utorrent.com/testport.php?port=%d

english.txt

999999999999999999

077777777777777770

*;;<=>>>

j:\utorrent\utorrent\1.8.1\Release_I18N_vc8\utorrent.pdb

All files (*.*)

Would you like to add "%s" to your search list?

Unable to find '%s'.

Error '%s' while downloading URL.

Can't open .torrent file: %s

Failure: %s

Executing: %s

Warning: %s

Unable to save to '%s'.

The directory you have selected contains more than 1000 files. The resulting .torrent will get very large. A better idea is to put the files into a compressed file and then share that file.

Please enter a valid tracker URL. Do you want to continue without having any trackers?

There was an error computing the hash: %d

*.torrent

You have selected to share your entire My Documents folder and all its files. It is not advisable to do so unless you are certain you want to share all the contents, including possibly private documents.

The file or directory '%s' cannot be found. Please enter a different filename. Note that you can't share the root of a drive.

Select where to save the .torrent

Webpage

Feed URL:

Web Seeds:

Add Torrent from URL

Please enter the location of the .torrent you want to open:

Associate with .torrent files

Associate with .btsearch files

&Boss-Key:

Windows Integration

Location of .torrents

Store .torrents in:

Move .torrents for finished jobs to:

&Automatically load .torrents from:

&Delete loaded .torrents

Listening Port

Port used for incoming connections:

Random port

&Randomize port each start

Enable &UPnP port mapping

Enable &NAT-PMP port mapping

Password:

Add Windows &Firewall exception

IP/Hostname to report to tracker:

Enable &Web UI

&Password:

Alternative &listening port (default is the connection port):

Search Engines [Format: name|URL]

&Run speed test at: VVV.dslreports.com

Current Port: [0: auto]

&Test if port is forwarded properly

Web Seeds

%F - Name of downloaded file (for single file torrents)

%D - Directory where files are saved

Do you really want to open %s?

There was an error opening %s.

Could not find application to open %s.

%#Z (%d hashfails)

%d x %#z (have %u)

scrape not supported

%d of %d connected (%d in swarm)

Time (%s step)

Could not download help file. Error: %s

Invalid redirect (%S)

invalid http reply

invalid URL

HTTP Error %d

HTTP Error 404

Proxy connect error %d

Too many redirects (%S)

Loaded ipfilter.dat (%d entries)

There were errors loading the language file. Please see the file uTorrent.exe.log in the application directory.

Log WebUI requests

Torrent. Please try later or visit hXXp://VVV.utorrent.com. Sorry about the inconvenience.

Unable to load "%s": %s!

Unable to save .torrent to '%s'.

Unable to copy .torrent from '%s' to '%s': (%d) %s

Unable to start updater process! Please download the newest version manually on hXXp://VVV.utorrent.com.

Unable to rename/delete '%s'.

Choose where to download '%s' to:

Choose where to save %s

(Login)

DHT: %d nodes%s

Torrents (*.torrent)

%s-files:*.%s:All files (*.*):*.*:

Torrent detected '%S' (%S) appears to be installed on your computer. That is known malware, and might cause

D: %s%z/s L: %z/s T: %Z

D: %s%z/s T: %Z

U: %s%z/s L: %z/s T: %Z

U: %s%z/s T: %Z

Select a .torrent to open

Total Running Time: %d:%.2d:%.2d

Number of torrents added: %d

Program launched: %d times

Last launched: %s

# incoming conns since start: %d

# outgoing conns since start: %d

# handshake: %d

# connections: %d

# half-open: %d (%d connecting)

Disk overloaded %d %%

You should change the listen port.

A firewall/router is limiting your network traffic. You need to open up a port so others can connect to you.

%d(%d) downloading, %d(%d) seeding

D:%s U:%s - %s

Add Torrent from &URL...

Torrent &Webpage

&Delete .torrent

D&elete .torrent   Data

Remove and d&elete .torrent   Data

Float denormal operand

Float invalid operation

Bw.Alloc

Source URL

Are you sure you want to remove the %d selected torrents and all associated data?

Are you sure you want to remove the %d selected torrents?

Error: %s

Port

RSS: Feed already exists "%s"

Really delete RSS Feed "%s"?

Date of last match: %s

Last episodes matched: %s

Open URL in &Browser

Really delete RSS Filter "%s"?

Really delete %d history entries?

RSS: Smart filter has rejected "%S"

RSS: Unable to load "%S": %s

Unable to load "%S": %s

RSS: Unable to download "%s": %s

The file '%s' is in use by another process and can't be opened.

The file '%s' was damaged/missing. It has been recovered.

Automatic Shutdown will initiate in %d seconds.

Hibernating computer... %s

Restarting computer... %s

Shutting down computer... %s

Stand-by computer... %s

Cannot load skin file: "%s" incorrect number of images, %u instead of %u (or %u)

Web UI

HTTPS

Please enter a valid IP on the form xxx.xxx.xxx.xxx. Specify an empty string to use the default IP.

Please enter a valid port number from 0-65535.

A port must be forwarded from your router to

Torrent to get good speeds. This port is used to let other peers connect to you.

Ý %dh

%dh %dm

%dm %ds

%dw Ý

%dy %dw

Enter the IP:port / [IPv6]:port of the peer to add:

Executable files (*.exe)

*.exe

Download Complete|%s has finished downloading.

New Download from RSS|%s has started downloading.

!Error|There is not enough disk space to move %s to its final location

!Torrent Error|File: %s

Are you sure you want to remove the %d selected trackers?

Torrent updater failed. The error is: %s

Could not download WebUI file. Error: %s

Could not download WebUI information. Error: %s

WebUI file not found in settings directory, attempting to download

.Xq*<

666666666

*55543111/*

((''&&%%#

455543220/--*

((''&"%%##"

4//--  ))****

4--  ))***4

@7<<88899;@

444444444

99999999

66666662

62222222

9999999555

[[[73322223

____[[[_

66666666

222222222

PeekNamedPipe

CreatePipe

GetCPInfo

GetProcessHeap

RegDeleteKeyA

RegCreateKeyExA

RegOpenKeyExA

RegCreateKeyExW

RegOpenKeyExW

RegDeleteKeyW

RegCloseKey

_acmdln

ShellExecuteW

ShellExecuteA

SHFileOperationA

GetKeyNameTextW

MapVirtualKeyA

GetKeyNameTextA

SetWindowsHookExA

CreateDialogIndirectParamA

RegisterHotKey

UnregisterHotKey

ExitWindowsEx

SetWindowsHookExW

EnumWindows

EnumChildWindows

UnhookWindowsHookEx

CreateDialogIndirectParamW

GetAsyncKeyState

.text

`.rdata

@.data

.rsrc

@.reloc

 &.$$"$$"$

 222222222

 422222222

version="1.0.0.0"

<!-- Enable Windows XP and higher themes with common controls -->

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<!-- Disable Windows Vista UAC compatability heuristics -->

<requestedExecutionLevel level="asInvoker"/>

<!-- Enable Windows Vista-style font scaling on Vista -->

<asmv3:windowsSettings xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">

</asmv3:windowsSettings>

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

comdlg32.dll

GDI32.dll

MSVCRT.dll

SHELL32.dll

USER32.dll

WS2_32.dll

Fatal Error: %d

%s.%d.torrent

%s.torrent

Got metadata size %u when I already thought it was %u

Got metadata size %u, pieces %u

%s: Unable to move: %s

Could not move data to completed download folder. Error: [0x%X]

DNS resolution failed for %s %S

hXXp://%S/announce

HTTP invalid URL: %S

%s: No longer have piece: %u

ERROR: Metadata for '%s' could not be loaded!

Finished receiving metadata for '%s'

%s: Piece %d complete

*** %s: PIECE %d FAILED HASH CHECK

resume.dat

TCP port bind failed %A: (%d) %s

Opera %c%c%c%c

MLdonkey %c.%c.%c

FlashGet %u.%u

Burst! %c.%c.%c

Blizzard %d.%d

BitSpirit v2 HTTPBT

BitSpirit v2 UDP0

%s %i.%i

DNA %u.%u.%u

Mainline %c.%c%c.%c

Mainline %c.%c.%c

%s/%s

Unknown %c

%s/%d.%d.%d.%d

Unknown %c%c

Torrent .NET

%s/%d.%d%d%d

Bits on Wheels/%c%c%c

Bits on Wheels/1.0.%d

flags.conf

mdht.dat

IO Error:%d line:%d align:%d pos:%Ld count:%d actual:%d

Incorrect alignment on mode set! [%s] mode:%d alignment:%u force_buffered:%d file_bufferless:%d unbuffered_read:%d unbuffered_write:%d

Error opening "%s": %E

ReadFile error: %s:%Ld:%d:%d:%d

~uTorrentPartFile_%LX.dat

thumbs.db

Moving files from '%s' to '%s'

Elevation:Administrator!new:%s

(UDP-In)

(TCP-In)

HNetCfg.FwRule

HNetCfg.FwPolicy2

dProxy error: %S

Proxy connect error: %s

:HTTP: IP %a: Bad username/password

AHTTP server

HTTP Disconnect: Peer error: %s

HTTP Reconnecting to: %S

Timed out. num_tries=%d

Invalid range in HTTP response (%d)

Disconnect: a range of type %S is not supported

The data received from the HTTP server was not the part that was requested

The size of the data received from the HTTP server did not match the requested size

HTTP server sent more responses than it was requested to

content-length (%d) does not correspond to the requested length (%d)

HTTP response did not include content-length nor content-range

redirecting (%d)

Redirection limit (%d) reached (recursive redirections?)

Invalid redirection url: %S

Got redirection response (%d) but no location header

invalid http response code (%d): %S (%S)

invalid http reply (%S)

Content length (%d) did not match range length (%d)

HTTP Connecting to: %S

Could not send request to HTTP peer!

Requesting %d:%d->%d

HTTP Reply %d

IpFilter invalid line: [%S]

ipfilter.dat

Error 73: %d/%d/%d/%d

Torrent 1.8.1

[%s (%:.1d)]:

%A%s:

Rejecting %d:%d->%d

Cancelling %d:%d->%d

Send Have %d

Got Reject: %d:%d->%d

Got Reject Unrequested!: %d:%d->%d

Got Expected Reject: %d:%d->%d

Sending Piece %d:%d->%d

Got Cancel In Queue: %d:%d->%d

Got Cancel Unrequested: %d:%d->%d

Got Cancel: %d:%d->%d

Got Piece Unrequested: %d:%d->%d

Got OLD Piece: %d:%d->%d

Got Piece: %d:%d->%d

Got PEX: %d added/%d dropped

fGot request for metadata which I can not read %d %d/%d

Send PEX: %d added/%d dropped

Requesting Metadata %d/%d

Got Request: %d:%d->%d

Got Request while choked: %d:%d->%d

Got Bad Request in SS mode: %d:%d->%d

Got PieceRequest I don't have: %d:%d->%d

Got request for metadata which I do not have %d %d/%d

Got request for metadata which I have %d/%d

Metadata requests exceeded maximum request limit %d

Got metadata %d/%d

Got unrequested or cancelled metadata! %d %d %d/%d

Got reject for metadata %d %d/%d

Got reject for unrequested metadata %d %d %d/%d

Reading msg %d piece %d

Sending %d bytes of aggregated data

Disconnect: %s

No supported crypto methods

Got Allowed Fast %d

Got Bad Have %d

Got Have %d

No such torrent: %S

Peer error: %s

Disconnect: Proxy connect error: %s

Connecting: source: %S

RangeBlock detected range %S

WebRip

HR.PDTV

HR.HDTV

%dx%.2d

%dx%.2d-%dx%.2d

rss.dat

%s|%S

ICMP.DLL

webui.zip

%s%s\%s

webui

Unable to load torrent: %s

URL: %S: OK

!URL: %S: %s

!Proxy: %s

WebUI Proxy Error: %s

%s (%s)

dUPnP: Could not join multicast group: %d

UPnP: Unable to bind to UPnP port: %d

UPnP: Could not set multicast TTL: %d

UPnP: Could not set unicast TTL: %d

UPnP: Could not setup socket to send multicast packets: %d

AUPnP: Discovered host: %S

UPnP: Device error "%S": (%d) %s

UPnP: Discovered new device: "%S" %S

UPnP: Unable to map port %I:%d with UPnP.

UPnP: Could not detect external IP on this pass, retrying.

UPnP: Could not map UPnP Port on this pass, retrying.

UPnP: The device "%S" is not a UPnP router (%S)

udp://

%s.%u.%s

Ignore this warning if you switched to 1.6.1 or older and back

Warning: file integrity check failed (%s): %s

Windows ran out of memory. Unable to allocate %d bytes.

[%.2d:%.2d:%.2d] %s

[%s] %s

%s.old

%s.new

UDP port bind failed %A: (%d) %s

ICMP port bind failed %A: (%d) %s

Window Error: %d/%d

uTorrent.exe /RECOVER

uTorrent.exe /RECOVER "%s"

/AUTOUPDATE "%s"

/AUTOUPDATE "%s" -1

uTorrent.exe

uTorrent.exe /BRINGTOFRONT

uTorrent.exe /NOINSTALL /BRINGTOFRONT

/AUTOUPDATE "%s" /NORUN %d

utorrent.lng

\uTorrent.exe

settings.dat

Could not setup teredo, result was: [%s]

netsh.exe interface ipv6 set teredo client

netsh.exe

Could not install teredo, result was: [%s]

netsh.exe interface ipv6 install

Torrent.lnk

TerminateClientInstances failed; hp:0x%X result:%d

RegKey: Could not write string valuename %s value %s; Error %d

RegKey: Could not write DWORD valuename %s value %d; Error %d

RegKey: Could not delete value %s

RegKey: Could not delete subkey %s

INSTALLDEBUG: Could not create installation directory [%s]

INSTALLDEBUG: ConformInstallation [%d]?=[%d] confirm [%d]

INSTALLDEBUG: Initial GetFileSecurity call failed; Error:%d

INSTALLDEBUG: AccessCheck failed; Error:%d

INSTALLDEBUG: OpenThreadToken failed; Error:%d

INSTALLDEBUG: ImpersonateSelf failed; Error:%d

INSTALLDEBUG: GetFileSecurity call failed; Error:%d

INSTALLDEBUG: GetVolumeInformation failed; Path: %s Error: %d

INSTALLDEBUG: Initial GetVolumeInformation failed and detected possible UNC path [%s] without appended [\]; calling again

Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent

INSTALLDEBUG: Chose Hardcoded program files directory [%s]

%Program Files%

INSTALLDEBUG: Chose User Profile directory [%s]

INSTALLDEBUG: Chose Program Files [%s]

INSTALLDEBUG: Chose Uninstall Key Path [%s]

URLInfoAbout

%d.%d.%d

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\%s

MIME\Database\Content Type\%s

Software\Classes\%s

maindoc.ico

%s\%s

.btsearch

URL Protocol

Software\Microsoft\Windows\CurrentVersion\Run

Software\Classes\Applications\uTorrent.exe

Software\Classes\.btsearch\OpenWithProgids

Software\Classes\.btsearch

Software\Classes\.torrent\OpenWithProgids

Software\Classes\.torrent

INSTALLDEBUG: Should not install - IsAssociatedToMe? %s

Software\Classes\Applications\uTorrent.exe\shell\open\command

Software\Classes\Applications\uTorrent.exe\shell

INSTALLDEBUG: Firewall flag [%X] not present; flags [%X]

INSTALLDEBUG: Unable to create firewall rules for path [%s]

/PERFORMINSTALL %d "%s"

INSTALLDEBUG: InstallEverything() with flags [%d]

INSTALLDEBUG: InstallEverything succeeded; flags [%d]

path:[%s]

lError %d

NOTE: Could not find APPDATA path, putting Settings file in directory of executable.

NOTE: Settings file found in directory of executable; using that.

Settings integrity check failed (duplicate keys: %d count: %d), repaired: %s

Tris: %d points [high score: %d]

D%s|%s

D%s\%s\*.*

Your DNS server does not support AAAA lookups. Installing IPv6 is NOT recommended.

utorrent.chm

utorrent-help.zip

Memory Compacting, system memory is low (%u%% CPU usage)

%s.loaded

[%dK]

%s (build %d)

Torrent %d.%d

main.ico

tstatus.bmp

etray.ico

%d %s

BInstalling '%s' to '%s'.

Buggy DLL warning: %S (%S)

Error opening Windows firewall: 0x%X %s

Unable to send crash report to server:

INSTALLDEBUG: /PERFORMINSTALL with flags [%d] and path [%s]

Version %d.%d.%d (svn %u)

Settings path: [%s]

Log file set to path:[%s]

?hXXp://VVV.bittorrent.com

%d|%d|%d

%d.%.3d

%d (%d)

%s (%d)

RUNDLL32.EXE

shell32.dll,OpenAs_RunDLL %s

explorer.exe

/select,"%s"

toolbar.bmp

tabs.bmp

Erss_status.bmp

%s, %d:00 - %d:59

Unable to open log file: %s

&flags.bmp

%d| %d

%d | %d

%S:%d

|[%d Torrents]|

t.log

.lang.txt

%Documents and Settings%\%current user%\Application Data\uTorrent\

Torrent 1.8.1 (build 12639)

msctls_hotkey32

1.8.1.12639

uTorrent 3.0.exe_572_rwx_00401000_0009F000:

t5Ht.Hu?S3

uMSSh

'SSht

F?SSh

UDP0u

PSSSSSSh

{9%uO9{

keyA

keyB

I[tFIt.It

SSSSSSSh8

<%uIF

FTPj<

hXXp://

.torrent

webseeds

feed_url

download_url

%.*S/scrape%S%cinfo_hash=%.20U

path.utf-8

name.utf-8

Windows-

url-list

port

%S%cinfo_hash=%.20U&peer_id=%.20U&port=%d&uploaded=%Ld&downloaded=%Ld&left=%Ld&corrupt=%Ld&key=%.8X%s&numwant=%d&compact=1&no_peer_id=1%s%s

%S%cinfo_hash=%.20U&peer_id=%.20U&port=%d&uploaded=%Ld&downloaded=%Ld&left=%Ld&key=%.8X%s&numwant=%d&compact=1&no_peer_id=1%s%s&t_checkin=%d&w_downloaded=%Ld&p_downloaded=%Ld&p_uploaded=%Ld&w_bad=%Ld&w_fail=%d&c_bytes=%Ld&h=%s

&ipv6=%U

&ip=%U

0.0.0.0

bt.external_addr

diskio.flush_files

choker.interval_optim

choker.interval

choker.interval_auto

peer.disconnect_inactive_interval

peer.disconnect_inactive

peer.resolve_country

peer.lazy_bitfield_nohave

peer.lazy_bitfield_factor

peer.lazy_bitfield_mode

peer.lazy_bitfield

bt.graceful_shutdown

bt.use_rangeblock

bt.ban_ratio

bt.use_ban_ratio

bt.ban_threshold

bt.no_connect_to_services_list

bt.no_connect_to_services

bt.allow_same_ip

bt.sequential_files

bt.sequential_download

bt.prio_first_last_piece

bt.connect_speed

bt.set_sockbuf

bt.send_have_to_seed

bt.multiscrape

bt.enable_tracker

bt.compact_allocation

bt.scrape_stopped

bt.ul_queue_factor

bt.dl_queue_factor

bt.http_pending_limit

bt.few_pieces_thres

bt.prio_piece_thres

bt.extra_ul_max

bt.extra_ul_rand

bt.transp_disposition

bt.auto_ul_factor

bt.auto_ul_min

bt.auto_ul_sample_average

bt.auto_ul_sample_window

bt.auto_ul_interval

bt.auto_ul_dryrun

queue.started_bonus

queue.switchtime_prio

queue.switchtime

queue.prio_no_seeds

queue.use_seed_peer_ratio

queue.slow_ul_threshold

queue.slow_dl_threshold

queue.dont_count_slow_ul

queue.dont_count_slow_dl

25,110,6666,6667

*?%I.%s

zz.countries.nerd.dk

[email protected]

HTTPBT

kernel32.dll

UT1_%s:%d

Outstanding add nodes: %d

Total peers: %d (in replacement cache %d)

%s %A fail:%d seen:%d age:%S ver:%s

Bucket %d: %.8X%.8X%.8X%.8X%.8X (replacement cache: %d)

Num buckets: %d. My DHT ID: %s

Total torrents: %d

Total peers: %d

%d: %s: %d peers

d1:ad2:id20:%.20m9:info_hash20:%.20m4:portiÞ5:token%d:%.*me1:q13:announce_peer1:t4:%.4m1:v4:%.4m1:y1:qe

5:nodes%d:

router.bittorrent.com

router.utorrent.com

e1:t%d:%.*m1:v4:%.4m1:y1:re

cache.disable_win_write

cache.disable_win_read

cache.read_thrash

cache.read_prune

cache.read_turnoff

cache.read

cache.writeimm

cache.writeout

cache.write

cache.reduce

cache.override_size

cache.override

diskio.rsize_factor

diskio.coalesce_write_size

diskio.coalesce_writes

diskio.smart_sparse_hash

diskio.smart_hash

diskio.use_partfile

diskio.no_zero

diskio.sparse_files

Error: COMPACT_NOT_FOUND. P=%d,T=%d

utorrent.com

_bittorrent-tracker._tcp.%s

DnsApi.dll

Authorization: Basic %s

HTTP/1.1

Host: %s%s

User-Agent: %s

Accept-Encoding:%s

BTWebClient/1810

hXXp://%s%s%s

HTTP/1.

https:

webui.cookie

webui.port

webui.restrict

webui.guest

webui.salt

webui.hashword

webui.password

webui.username

webui.token_auth

webui.enable_listen

webui.enable_guest

webui.enable

HTTP/1.1 301 Moved Permanently

Location: %s

HTTP/1.1 %d %s

Content-Length: %d

Content-Type: %s

%s%s%s%s

User-Agent: BTWebClient/1810

GET %s HTTP/1.1

%s%S/%s

wininet.dll

InternetOpenUrlA

HttpQueryInfoA

GetExtendedTcpTable

Iphlpapi.dll

4.2.2.1

127.0.0.0

172.16.0.0

169.254.0.0

192.168.0.0

10.0.0.0

239.192.152.143

port:

BT-SEARCH * HTTP/1.1

Host: 239.192.152.143:6771

Port: %u

Infohash: %s

Unsupported Version

Not Authorized/Refused (e.g. box supports mapping, but user has turned feature off)

Unsupported opcode

NAT-PMP: %s %s port %d -> %I:%d

NAT-PMP: error: %s

NAT-PMP: Unable to map port with NAT-PMP.

Invalid Username/Password

Error code: HTTP %d

?QoS: running low (%u @ %u kB/s), stepping up to %u

QoS: running high (%u @ %u kB/s), throttling down to %u

Proxy-Authorization: Basic %s

%s:%s

HTTP/1

CONNECT %A HTTP/1.0

CONNECT %s:%d HTTP/1.0

WSAEnumNetworkEvents error (%d)

oleaut32.dll

ole32.dll

10:total_sizei%ue

5:piecei%ue

8:msg_typei%ue

8:dropped6%d:

7:dropped%d:

8:added6.f%d:

6:added6%d:

7:added.f%d:

5:added%d:

1:piÞ4:reqqiÞ1:v%d:%s

13:metadata_sizeiÞ

d1:eiÞ1:md

msg_type

psapi.dll

ac3.5.1

webrip

hr.pdtv

hr.hdtv

dddd.dd.dd

dd.dd.dd

advapi32.dll

hXXp://utorrent.com/webui/webui-%s-%s.zip

1.8.1

hXXp://utorrent.com/webui/version-%s

HTTP/1.1 200 OK

Unable to listen for HTTP traffic on port %d

,[%S,%J,%J,%I]

,"files": [%s, [

ETag: %s

HTTP/1.1 404 Not Found

token.html

<meta http-equiv="refresh" content="1" />Please wait while the µTorrent WebUI is installed... You will be automatically redirected.

/gui/index.html?error=1

/gui/index.html

downloading_webui

download_webui

<b>There was a problem installing µTorrent WebUI, please see the µTorrent log for more details.</b></br></br>

index.html?error=1

The µTorrent WebUI does not seem to be installed. Click <a href="download_webui">here</a> to try to install it, or see the <a href="hXXp://utorrent.com/webui-guide.php">guide</a> for more details.

index.html

HTTP/1.1 304 Not Modified

Unable to read webui.zip

,"trackers": %S

,"props": [{"hash": %s

[%s,%I,%S,%J,%I,%J,%J,%I,%I,%I,%I,%S,%I,%I,%I,%I,%I,%I,%J]

,[%S,%I]

,[%s,%I,%S]

,"error": %S

getmsg

add-url

/gui/guest.html

HTTP: IP %a: Blocked: GET %.100s

HTTP/1.1 401 Unauthorized

HTTP: IP %a: GET %.200s

UPnP(XP): %s port %d -> %I:%d mapped successfully.

UPnP(XP): %s port %d -> %I:%d is already mapped. Not re-mapping.

UPnP(XP): Removed UDP port %d

UPnP(XP): Removed TCP port %d

Internal and External port values must be the same

The NAT implementation only supports permanent lease times on port mappings

ExternalPort must be a wildcard and cannot be a specific port

The port mapping entry specified conflicts with a mapping assigned previously to another client

The external port cannot be wild-carded

239.255.255.250

M-SEARCH * HTTP/1.1

HOST: 239.255.255.250:1900

scpdurl

eventsuburl

controlurl

urlbase

NewInternalPort

NewExternalPort

%s port %d -> %I:%d

%s port %d

</u:%s>

<NewRemoteHost></NewRemoteHost><NewExternalPort>%d</NewExternalPort><NewProtocol>%s</NewProtocol><NewInternalPort>%d</NewInternalPort><NewInternalClient>%I</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>uTorrent (%s)</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration>

<NewRemoteHost></NewRemoteHost><NewExternalPort>%d</NewExternalPort><NewProtocol>%s</NewProtocol>

<NewPortMappingIndex>%d</NewPortMappingIndex>

<s:Envelope xmlns:s="hXXp://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="hXXp://schemas.xmlsoap.org/soap/encoding/">

<u:%s xmlns:u="%s">

AddPortMapping

DeletePortMapping

GetGenericPortMappingEntry

UPnP: %s is already mapped. Not re-mapping.

UPnP: ERROR removing %s: (%d) %s

UPnP: Removed %s

UPnP: ERROR mapping %s: (%d) %s

UPnP: ERROR mapping %s. Deleting mapping and trying again: (%d) %s

UPnP: %s mapped successfully.

UPnP: Mapped %s

http:

hXXp://%s:%d/%s

POST %s HTTP/1.1

HOST: %s:%d

CONTENT-LENGTH: %d

SOAPACTION: "%s#%s"

Host: %s:%d

?456789:;<=

!"#$%&'()* ,-./0123

hXXps://

rpcrt4.dll

d10:.fileguard40:%s

d10:.fileguard40:

%d/%d blocks. %d/%d bytes.

]: %s: %d

shell32.dll

255.255.255.255

UDP setsockopt(SO_SNDBUF, %d) failed: %d

UDP setsockopt(SO_RCVBUF, %d) failed: %d

uxtheme.dll

MsgBoxData

comctl32.dll

TaskDialogIndirect

HttpOpenRequestA

HttpSendRequestA

Windows version %d.%d %d %s

Torrent Crash Report ***

Build: %X (%d) built on Fri Oct 3 04:24:32 2008

\%d-utorrent.%.4x.dmp

DBGHELP.DLL

\DBGHELP.DLL

Error %d :

HttpQueryInfo failed

HttpSendRequest failed

HttpOpenRequest failed

/crash.php?ver=%dU

can't load wininet.dll

l.url

l.siz

l.sha

l.sig

l.ver

u.url

u.siz

u.sha

u.sig

u.ver

u.msg

&t_down=%u

&t_up=%u

&c_down=%u

&c_up=%u

&k=%U

&h=%s

&t=%d

&e=%d

&w=%X

&c=%U

&l=%U

&i=%d

&lv=%d_%d_%U

&qv=%d

?v=%d

hXXp://update.utorrent.com/checkupdate.php

&dl=%u

&con=%u

&dns=%u

&ip=%S

hXXp://update.utorrent.com/updatestats.php

user32.dll

ShellExecuteExW

hXXp://VVV.utorrent.com

shfolder.dll

SHFileOperationW

proxy.password

proxy.username

proxy.resolve

proxy.auth

proxy.port

proxy.type

proxy.proxy

gui.last_overview_tab-1.8

gui.last_preference_tab-1.8

gui.bypass_search_redirect

gui.tall_category_list

gui.piecebar_progress

gui.graphic_progress

gui.limits_in_statusbar

gui.speed_in_title

gui.default_del_action

gui.delete_to_trash

gui.sg_mode

gui.update_rate

gui.dblclick_dl

gui.dblclick_seed

rss.smart_repack_filter

rss.update_interval

boss_key

gui.log_date

dht.rate

ipfilter.enable

isp.bep22

net.upnp_tcp_only

net.diffserv_codepoint

net.wsaevents

net.max_halfopen

net.calc_overhead

net.low_cpu

net.outgoing_max_port

net.outgoing_port

net.outgoing_ip

net.bind_ip

rand_port_on_start

sys.enable_wine_hacks

sys.prevent_standby

gui.alternate_color

gui.compat_diropen

gui.persistent_labels

gui.manual_ratemenu

gui.dlrate_menu

gui.ulrate_menu

bind_port

tray.single_click

tray.show

Google|hXXp://google.com/search?q=

BitTorrent|hXXp://VVV.bittorrent.com/search?client=%v&search=

.fileguard

winmm.dll

D@hXXp://VVV.utorrent.com?client=utorrent1810

ftp34.dll

t1.dll

Trojan-Downloader.Agent.Pto

t0.dll

laf5.dll

laf4.dll

laf3.dll

laf2.dll

Win32/Hoax.Renos.NAV

laf1.dll

MIPro.dll

MImp.dll

imon.dll

SARAH.dll

Niphk.dll

iFW_Xfilter.dll

MxAVlsp.dll

nvappfilter.dll

SetThreadExecutionState

'%s' (%s) (known malware!)

'%s' (%s)

hXXp://forum.utorrent.com?client=utorrent1810

hXXp://VVV.utorrent.com/faq.php?client=utorrent1810

hXXp://download.utorrent.com/utorrent-help.zip

onWmClose: msg %d

hXXp://search.utorrent.com/search.php?q=%U&e=%U&u=1

%s%%s

%sutorrent1810

%s=%s

%sclient=%%v

hXXp://utorrent.com/rsstutorial.php

hXXp://VVV.utorrent.com/download.php

hXXp://VVV.dslreports.com/speedtest

hXXp://VVV.utorrent.com/testport.php?port=%d

english.txt

999999999999999999

077777777777777770

*;;<=>>>

j:\utorrent\utorrent\1.8.1\Release_I18N_vc8\utorrent.pdb

All files (*.*)

Would you like to add "%s" to your search list?

Unable to find '%s'.

Error '%s' while downloading URL.

Can't open .torrent file: %s

Failure: %s

Executing: %s

Warning: %s

Unable to save to '%s'.

The directory you have selected contains more than 1000 files. The resulting .torrent will get very large. A better idea is to put the files into a compressed file and then share that file.

Please enter a valid tracker URL. Do you want to continue without having any trackers?

There was an error computing the hash: %d

*.torrent

You have selected to share your entire My Documents folder and all its files. It is not advisable to do so unless you are certain you want to share all the contents, including possibly private documents.

The file or directory '%s' cannot be found. Please enter a different filename. Note that you can't share the root of a drive.

Select where to save the .torrent

Webpage

Feed URL:

Web Seeds:

Add Torrent from URL

Please enter the location of the .torrent you want to open:

Associate with .torrent files

Associate with .btsearch files

&Boss-Key:

Windows Integration

Location of .torrents

Store .torrents in:

Move .torrents for finished jobs to:

&Automatically load .torrents from:

&Delete loaded .torrents

Listening Port

Port used for incoming connections:

Random port

&Randomize port each start

Enable &UPnP port mapping

Enable &NAT-PMP port mapping

Password:

Add Windows &Firewall exception

IP/Hostname to report to tracker:

Enable &Web UI

&Password:

Alternative &listening port (default is the connection port):

Search Engines [Format: name|URL]

&Run speed test at: VVV.dslreports.com

Current Port: [0: auto]

&Test if port is forwarded properly

Web Seeds

%F - Name of downloaded file (for single file torrents)

%D - Directory where files are saved

Do you really want to open %s?

There was an error opening %s.

Could not find application to open %s.

%#Z (%d hashfails)

%d x %#z (have %u)

scrape not supported

%d of %d connected (%d in swarm)

Time (%s step)

Could not download help file. Error: %s

Invalid redirect (%S)

invalid http reply

invalid URL

HTTP Error %d

HTTP Error 404

Proxy connect error %d

Too many redirects (%S)

Loaded ipfilter.dat (%d entries)

There were errors loading the language file. Please see the file uTorrent.exe.log in the application directory.

Log WebUI requests

Torrent. Please try later or visit hXXp://VVV.utorrent.com. Sorry about the inconvenience.

Unable to load "%s": %s!

Unable to save .torrent to '%s'.

Unable to copy .torrent from '%s' to '%s': (%d) %s

Unable to start updater process! Please download the newest version manually on hXXp://VVV.utorrent.com.

Unable to rename/delete '%s'.

Choose where to download '%s' to:

Choose where to save %s

(Login)

DHT: %d nodes%s

Torrents (*.torrent)

%s-files:*.%s:All files (*.*):*.*:

Torrent detected '%S' (%S) appears to be installed on your computer. That is known malware, and might cause

D: %s%z/s L: %z/s T: %Z

D: %s%z/s T: %Z

U: %s%z/s L: %z/s T: %Z

U: %s%z/s T: %Z

Select a .torrent to open

Total Running Time: %d:%.2d:%.2d

Number of torrents added: %d

Program launched: %d times

Last launched: %s

# incoming conns since start: %d

# outgoing conns since start: %d

# handshake: %d

# connections: %d

# half-open: %d (%d connecting)

Disk overloaded %d %%

You should change the listen port.

A firewall/router is limiting your network traffic. You need to open up a port so others can connect to you.

%d(%d) downloading, %d(%d) seeding

D:%s U:%s - %s

Add Torrent from &URL...

Torrent &Webpage

&Delete .torrent

D&elete .torrent   Data

Remove and d&elete .torrent   Data

Float denormal operand

Float invalid operation

Bw.Alloc

Source URL

Are you sure you want to remove the %d selected torrents and all associated data?

Are you sure you want to remove the %d selected torrents?

Error: %s

Port

RSS: Feed already exists "%s"

Really delete RSS Feed "%s"?

Date of last match: %s

Last episodes matched: %s

Open URL in &Browser

Really delete RSS Filter "%s"?

Really delete %d history entries?

RSS: Smart filter has rejected "%S"

RSS: Unable to load "%S": %s

Unable to load "%S": %s

RSS: Unable to download "%s": %s

The file '%s' is in use by another process and can't be opened.

The file '%s' was damaged/missing. It has been recovered.

Automatic Shutdown will initiate in %d seconds.

Hibernating computer... %s

Restarting computer... %s

Shutting down computer... %s

Stand-by computer... %s

Cannot load skin file: "%s" incorrect number of images, %u instead of %u (or %u)

Web UI

HTTPS

Please enter a valid IP on the form xxx.xxx.xxx.xxx. Specify an empty string to use the default IP.

Please enter a valid port number from 0-65535.

A port must be forwarded from your router to

Torrent to get good speeds. This port is used to let other peers connect to you.

Ý %dh

%dh %dm

%dm %ds

%dw Ý

%dy %dw

Enter the IP:port / [IPv6]:port of the peer to add:

Executable files (*.exe)

*.exe

Download Complete|%s has finished downloading.

New Download from RSS|%s has started downloading.

!Error|There is not enough disk space to move %s to its final location

!Torrent Error|File: %s

Are you sure you want to remove the %d selected trackers?

Torrent updater failed. The error is: %s

Could not download WebUI file. Error: %s

Could not download WebUI information. Error: %s

WebUI file not found in settings directory, attempting to download

.Xq*<

666666666

*55543111/*

((''&&%%#

455543220/--*

((''&"%%##"

4//--  ))****

4--  ))***4

@7<<88899;@

444444444

99999999

66666662

62222222

9999999555

[[[73322223

____[[[_

66666666

222222222

PeekNamedPipe

CreatePipe

GetCPInfo

GetProcessHeap

RegDeleteKeyA

RegCreateKeyExA

RegOpenKeyExA

RegCreateKeyExW

RegOpenKeyExW

RegDeleteKeyW

RegCloseKey

_acmdln

ShellExecuteW

ShellExecuteA

SHFileOperationA

GetKeyNameTextW

MapVirtualKeyA

GetKeyNameTextA

SetWindowsHookExA

CreateDialogIndirectParamA

RegisterHotKey

UnregisterHotKey

ExitWindowsEx

SetWindowsHookExW

EnumWindows

EnumChildWindows

UnhookWindowsHookEx

CreateDialogIndirectParamW

GetAsyncKeyState

.text

`.rdata

@.data

.rsrc

@.reloc

Fatal Error: %d

%s.%d.torrent

%s.torrent

Got metadata size %u when I already thought it was %u

Got metadata size %u, pieces %u

%s: Unable to move: %s

Could not move data to completed download folder. Error: [0x%X]

DNS resolution failed for %s %S

hXXp://%S/announce

HTTP invalid URL: %S

%s: No longer have piece: %u

ERROR: Metadata for '%s' could not be loaded!

Finished receiving metadata for '%s'

%s: Piece %d complete

*** %s: PIECE %d FAILED HASH CHECK

resume.dat

TCP port bind failed %A: (%d) %s

Opera %c%c%c%c

MLdonkey %c.%c.%c

FlashGet %u.%u

Burst! %c.%c.%c

Blizzard %d.%d

BitSpirit v2 HTTPBT

BitSpirit v2 UDP0

%s %i.%i

DNA %u.%u.%u

Mainline %c.%c%c.%c

Mainline %c.%c.%c

%s/%s

Unknown %c

%s/%d.%d.%d.%d

Unknown %c%c

Torrent .NET

%s/%d.%d%d%d

Bits on Wheels/%c%c%c

Bits on Wheels/1.0.%d

flags.conf

mdht.dat

IO Error:%d line:%d align:%d pos:%Ld count:%d actual:%d

Incorrect alignment on mode set! [%s] mode:%d alignment:%u force_buffered:%d file_bufferless:%d unbuffered_read:%d unbuffered_write:%d

Error opening "%s": %E

ReadFile error: %s:%Ld:%d:%d:%d

~uTorrentPartFile_%LX.dat

thumbs.db

Moving files from '%s' to '%s'

Elevation:Administrator!new:%s

(UDP-In)

(TCP-In)

HNetCfg.FwRule

HNetCfg.FwPolicy2

dProxy error: %S

Proxy connect error: %s

:HTTP: IP %a: Bad username/password

AHTTP server

HTTP Disconnect: Peer error: %s

HTTP Reconnecting to: %S

Timed out. num_tries=%d

Invalid range in HTTP response (%d)

Disconnect: a range of type %S is not supported

The data received from the HTTP server was not the part that was requested

The size of the data received from the HTTP server did not match the requested size

HTTP server sent more responses than it was requested to

content-length (%d) does not correspond to the requested length (%d)

HTTP response did not include content-length nor content-range

redirecting (%d)

Redirection limit (%d) reached (recursive redirections?)

Invalid redirection url: %S

Got redirection response (%d) but no location header

invalid http response code (%d): %S (%S)

invalid http reply (%S)

Content length (%d) did not match range length (%d)

HTTP Connecting to: %S

Could not send request to HTTP peer!

Requesting %d:%d->%d

HTTP Reply %d

IpFilter invalid line: [%S]

ipfilter.dat

Error 73: %d/%d/%d/%d

Torrent 1.8.1

[%s (%:.1d)]:

%A%s:

Rejecting %d:%d->%d

Cancelling %d:%d->%d

Send Have %d

Got Reject: %d:%d->%d

Got Reject Unrequested!: %d:%d->%d

Got Expected Reject: %d:%d->%d

Sending Piece %d:%d->%d

Got Cancel In Queue: %d:%d->%d

Got Cancel Unrequested: %d:%d->%d

Got Cancel: %d:%d->%d

Got Piece Unrequested: %d:%d->%d

Got OLD Piece: %d:%d->%d

Got Piece: %d:%d->%d

Got PEX: %d added/%d dropped

fGot request for metadata which I can not read %d %d/%d

Send PEX: %d added/%d dropped

Requesting Metadata %d/%d

Got Request: %d:%d->%d

Got Request while choked: %d:%d->%d

Got Bad Request in SS mode: %d:%d->%d

Got PieceRequest I don't have: %d:%d->%d

Got request for metadata which I do not have %d %d/%d

Got request for metadata which I have %d/%d

Metadata requests exceeded maximum request limit %d

Got metadata %d/%d

Got unrequested or cancelled metadata! %d %d %d/%d

Got reject for metadata %d %d/%d

Got reject for unrequested metadata %d %d %d/%d

Reading msg %d piece %d

Sending %d bytes of aggregated data

Disconnect: %s

No supported crypto methods

Got Allowed Fast %d

Got Bad Have %d

Got Have %d

No such torrent: %S

Peer error: %s

Disconnect: Proxy connect error: %s

Connecting: source: %S

RangeBlock detected range %S

WebRip

HR.PDTV

HR.HDTV

%dx%.2d

%dx%.2d-%dx%.2d

rss.dat

%s|%S

ICMP.DLL

webui.zip

%s%s\%s

webui

Unable to load torrent: %s

URL: %S: OK

!URL: %S: %s

!Proxy: %s

WebUI Proxy Error: %s

%s (%s)

dUPnP: Could not join multicast group: %d

UPnP: Unable to bind to UPnP port: %d

UPnP: Could not set multicast TTL: %d

UPnP: Could not set unicast TTL: %d

UPnP: Could not setup socket to send multicast packets: %d

AUPnP: Discovered host: %S

UPnP: Device error "%S": (%d) %s

UPnP: Discovered new device: "%S" %S

UPnP: Unable to map port %I:%d with UPnP.

UPnP: Could not detect external IP on this pass, retrying.

UPnP: Could not map UPnP Port on this pass, retrying.

UPnP: The device "%S" is not a UPnP router (%S)

udp://

%s.%u.%s

Ignore this warning if you switched to 1.6.1 or older and back

Warning: file integrity check failed (%s): %s

Windows ran out of memory. Unable to allocate %d bytes.

[%.2d:%.2d:%.2d] %s

[%s] %s

%s.old

%s.new

UDP port bind failed %A: (%d) %s

ICMP port bind failed %A: (%d) %s

Window Error: %d/%d

uTorrent.exe /RECOVER

uTorrent.exe /RECOVER "%s"

/AUTOUPDATE "%s"

/AUTOUPDATE "%s" -1

uTorrent.exe

uTorrent.exe /BRINGTOFRONT

uTorrent.exe /NOINSTALL /BRINGTOFRONT

/AUTOUPDATE "%s" /NORUN %d

utorrent.lng

\uTorrent.exe

settings.dat

Could not setup teredo, result was: [%s]

netsh.exe interface ipv6 set teredo client

netsh.exe

Could not install teredo, result was: [%s]

netsh.exe interface ipv6 install

Torrent.lnk

TerminateClientInstances failed; hp:0x%X result:%d

RegKey: Could not write string valuename %s value %s; Error %d

RegKey: Could not write DWORD valuename %s value %d; Error %d

RegKey: Could not delete value %s

RegKey: Could not delete subkey %s

INSTALLDEBUG: Could not create installation directory [%s]

INSTALLDEBUG: ConformInstallation [%d]?=[%d] confirm [%d]

INSTALLDEBUG: Initial GetFileSecurity call failed; Error:%d

INSTALLDEBUG: AccessCheck failed; Error:%d

INSTALLDEBUG: OpenThreadToken failed; Error:%d

INSTALLDEBUG: ImpersonateSelf failed; Error:%d

INSTALLDEBUG: GetFileSecurity call failed; Error:%d

INSTALLDEBUG: GetVolumeInformation failed; Path: %s Error: %d

INSTALLDEBUG: Initial GetVolumeInformation failed and detected possible UNC path [%s] without appended [\]; calling again

Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent

INSTALLDEBUG: Chose Hardcoded program files directory [%s]

%Program Files%

INSTALLDEBUG: Chose User Profile directory [%s]

INSTALLDEBUG: Chose Program Files [%s]

INSTALLDEBUG: Chose Uninstall Key Path [%s]

URLInfoAbout

%d.%d.%d

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\%s

MIME\Database\Content Type\%s

Software\Classes\%s

maindoc.ico

%s\%s

.btsearch

URL Protocol

Software\Microsoft\Windows\CurrentVersion\Run

Software\Classes\Applications\uTorrent.exe

Software\Classes\.btsearch\OpenWithProgids

Software\Classes\.btsearch

Software\Classes\.torrent\OpenWithProgids

Software\Classes\.torrent

INSTALLDEBUG: Should not install - IsAssociatedToMe? %s

Software\Classes\Applications\uTorrent.exe\shell\open\command

Software\Classes\Applications\uTorrent.exe\shell

INSTALLDEBUG: Firewall flag [%X] not present; flags [%X]

INSTALLDEBUG: Unable to create firewall rules for path [%s]

/PERFORMINSTALL %d "%s"

INSTALLDEBUG: InstallEverything() with flags [%d]

INSTALLDEBUG: InstallEverything succeeded; flags [%d]

path:[%s]

lError %d

NOTE: Could not find APPDATA path, putting Settings file in directory of executable.

NOTE: Settings file found in directory of executable; using that.

Settings integrity check failed (duplicate keys: %d count: %d), repaired: %s

Tris: %d points [high score: %d]

D%s|%s

D%s\%s\*.*

Your DNS server does not support AAAA lookups. Installing IPv6 is NOT recommended.

utorrent.chm

utorrent-help.zip

Memory Compacting, system memory is low (%u%% CPU usage)

%s.loaded

[%dK]

%s (build %d)

Torrent %d.%d

main.ico

tstatus.bmp

etray.ico

%d %s

BInstalling '%s' to '%s'.

Buggy DLL warning: %S (%S)

Error opening Windows firewall: 0x%X %s

Unable to send crash report to server:

INSTALLDEBUG: /PERFORMINSTALL with flags [%d] and path [%s]

Version %d.%d.%d (svn %u)

Settings path: [%s]

Log file set to path:[%s]

?hXXp://VVV.bittorrent.com

%d|%d|%d

%d.%.3d

%d (%d)

%s (%d)

RUNDLL32.EXE

shell32.dll,OpenAs_RunDLL %s

explorer.exe

/select,"%s"

toolbar.bmp

tabs.bmp

Erss_status.bmp

%s, %d:00 - %d:59

Unable to open log file: %s

&flags.bmp

%d| %d

%d | %d

%S:%d

|[%d Torrents]|

t.log

.lang.txt

%Documents and Settings%\%current user%\Application Data\uTorrent\

Torrent 1.8.1 (build 12639)

msctls_hotkey32

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:604
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\nsn2.tmp\splash.bmp (2712 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn2.tmp\NSISdl.dll (1175 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\uTorrent 3.0.exe (30968 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn2.tmp\AdvSplash.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn2.tmp\NSISArray.dll (19 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\c5b88721db08c824db69d0bbc702beb8_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (44 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.