Should I block it?

90%
90% of PCs block this file from running.
Possible reason:
Multiple malware detections

Relationships


PE structurePE file structure

Show functions
Import table
advapi32.dll
RegQueryInfoKeyW, LookupPrivilegeValueW, RegCloseKey, RegDeleteValueW, RegOpenKeyExW, RegUnLoadKeyW, RegLoadKeyW, OpenProcessToken, GetTokenInformation, GetUserNameW, GetFileSecurityW, SetFileSecurityW, RegEnumValueW, RegQueryValueW, RegEnumKeyW, RegSetValueW, OpenSCManagerW, StartServiceW, EnumDependentServicesW, OpenServiceW, ControlService, QueryServiceStatusEx, CloseServiceHandle, AdjustTokenPrivileges, RegSetValueExW, RegCreateKeyExW, RegDeleteKeyW, RegEnumKeyExW, AllocateAndInitializeSid, GetLengthSid, InitializeAcl, AddAccessAllowedAce, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegSetKeySecurity, FreeSid, RegQueryValueExW, IsTextUnicode
comctl32.dll
InitCommonControlsEx, ImageList_GetIconSize, ImageList_Create, ImageList_GetImageCount, ImageList_Destroy, ImageList_AddMasked, ImageList_Remove, ImageList_DrawEx, ImageList_GetIcon, ImageList_ReplaceIcon
comdlg32.dll
GetFileTitleW
gdi32.dll
PtVisible, RectVisible, TextOutW, Escape, SelectObject, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowOrgEx, OffsetWindowOrgEx, SetWindowExtEx, ScaleWindowExtEx, GetCurrentPositionEx, ArcTo, PolyDraw, PolylineTo, PolyBezierTo, ExtSelectClipRgn, DeleteDC, CreateDIBPatternBrushPt, CreatePatternBrush, GetStockObject, SelectPalette, PlayMetaFileRecord, GetObjectType, EnumMetaFile, PlayMetaFile, CreatePen, ExtCreatePen, CreateSolidBrush, CreateHatchBrush, CreateDIBitmap, CreateCompatibleBitmap, CreateRectRgnIndirect, GetTextMetricsW, EnumFontFamiliesW, GetTextCharsetInfo, GetBkColor, GetTextColor, GetRgnBox, GetCharWidthW, CreateFontW, StretchDIBits, GetWindowExtEx, CombineRgn, GetMapMode, StartDocW, DPtoLP, GetCurrentObject, CreateDIBSection, CreateRoundRectRgn, CreatePolygonRgn, CreateEllipticRgn, Polyline, Ellipse, Polygon, CreatePalette, GetPaletteEntries, GetNearestPaletteIndex, RealizePalette, GetSystemPaletteEntries, OffsetRgn, SetDIBColorTable, GetDIBits, StretchBlt, SetPixel, RoundRect, Rectangle, EnumFontFamiliesExW, LPtoDP, GetWindowOrgEx, GetViewportOrgEx, PtInRegion, FillRgn, FrameRgn, GetBoundsRect, ExtFloodFill, SetPaletteEntries, StartPage, EndPage, SetAbortProc, AbortDoc, EndDoc, GetNearestColor, GetBkMode, GetPolyFillMode, GetROP2, GetStretchBltMode, GetTextAlign, GetTextFaceW, CreateMetaFileW, CloseMetaFile, DeleteMetaFile, SetPixelV, PatBlt, GetPixel, GetViewportExtEx, SelectClipPath, CreateRectRgn, GetClipRgn, SelectClipRgn, DeleteObject, SetColorAdjustment, SetArcDirection, SetLayout, GetLayout, SetMapperFlags, SetTextCharacterExtra, SetTextJustification, SetTextAlign, MoveToEx, LineTo, OffsetClipRgn, IntersectClipRect, ExcludeClipRect, GetClipBox, SetMapMode, ModifyWorldTransform, SetWorldTransform, SetGraphicsMode, SetStretchBltMode, SetROP2, SetPolyFillMode, SetBkMode, RestoreDC, SaveDC, GetTextExtentPoint32W, ExtTextOutW, BitBlt, CreateCompatibleDC, CreateFontIndirectW, GetObjectW, SetBkColor, SetTextColor, CreateBitmap, CreateDCW, CopyMetaFileW, SetRectRgn, GetDeviceCaps
gdiplus.dll
GdipGetImageGraphicsContext, GdipBitmapUnlockBits, GdipBitmapLockBits, GdipCreateBitmapFromScan0, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromStream, GdipCreateBitmapFromFileICM, GdipCreateBitmapFromFile, GdipGetImagePalette, GdipGetImagePaletteSize, GdipGetImagePixelFormat, GdipGetImageHeight, GdipGetImageWidth, GdipCloneImage, GdipDrawImageRectI, GdipSetInterpolationMode, GdipCreateFromHDC, GdiplusShutdown, GdiplusStartup, GdipCreateBitmapFromHBITMAP, GdipDisposeImage, GdipDeleteGraphics, GdipAlloc, GdipFree, GdipDrawImageI
imm32.dll
ImmGetOpenStatus, ImmGetContext, ImmReleaseContext
iphlpapi.dll
GetAdaptersInfo, GetIfEntry, GetNumberOfInterfaces, GetIfTable
kernel32.dll
DllMain
msimg32.dll
TransparentBlt, AlphaBlend
ole32.dll
CoTaskMemFree, OleDestroyMenuDescriptor, OleTranslateAccelerator, CoInitializeEx, CoUninitialize, CoCreateGuid, StgCreateDocfile, IsAccelerator, OleLockRunning, OleSetMenuDescriptor, CreateStreamOnHGlobal, OleSetClipboard, OleIsCurrentClipboard, OleFlushClipboard, DoDragDrop, CoRegisterClassObject, CreateDataAdviseHolder, CreateOleAdviseHolder, CoGetMalloc, GetRunningObjectTable, OleIsRunning, CreateFileMoniker, SetConvertStg, RevokeDragDrop, CoLockObjectExternal, RegisterDragDrop, OleGetClipboard, OleRegGetMiscStatus, OleRegEnumVerbs, CreateGenericComposite, CreateItemMoniker, OleGetIconOfClass, OleCreateLinkToFile, OleCreateFromFile, OleSetContainedObject, GetHGlobalFromILockBytes, OleLoad, OleCreate, OleCreateStaticFromData, OleCreateLinkFromData, OleCreateFromData, OleSaveToStream, WriteClassStm, OleSave, PropVariantCopy, CoRegisterMessageFilter, WriteFmtUserTypeStg, WriteClassStg, OleRegGetUserType, ReadFmtUserTypeStg, ReadClassStg, CreateBindCtx, ReleaseStgMedium, CoTaskMemAlloc, StringFromCLSID, CoTreatAsClass, OleDuplicateData, CLSIDFromProgID, CLSIDFromString, CoDisconnectObject, StringFromGUID2, CoCreateInstance, CoInitialize, CoGetClassObject, StgOpenStorageOnILockBytes, StgCreateDocfileOnILockBytes, CreateILockBytesOnHGlobal, OleRun, OleUninitialize, CoFreeUnusedLibraries, OleQueryCreateFromData, OleInitialize, StgOpenStorage, StgIsStorageFile, OleQueryLinkFromData, OleCreateMenuDescriptor, CoRevokeClassObject
oleacc.dll
LresultFromObject, AccessibleObjectFromWindow, CreateStdAccessibleObject
oledlg.dll
OleUIBusyW
psapi.dll
EnumProcesses, GetModuleBaseNameW
shell32.dll
SHGetPathFromIDListW, SHGetDesktopFolder, ExtractIconW, SHAddToRecentDocs, SHGetSpecialFolderLocation, ShellExecuteExW, SHGetSpecialFolderPathW, CommandLineToArgvW, SHGetMalloc, DragFinish, DragQueryFileW, SHGetFileInfoW, SHBrowseForFolderW, SHAppBarMessage, ShellExecuteW
shlwapi.dll
UrlUnescapeW, PathIsUNCW, PathStripToRootW, PathFindFileNameW, PathRemoveExtensionW, PathFindExtensionW, PathRemoveFileSpecW
user32.dll
DllMain
wininet.dll
InternetOpenUrlW, GopherOpenFileW, FtpFindFirstFileW, GopherCreateLocatorW, FtpCommandW, FtpOpenFileW, GopherGetAttributeW, HttpSendRequestExW, HttpEndRequestW, InternetWriteFile, InternetSetFilePointer, InternetSetStatusCallbackW, InternetGetLastResponseInfoW, GopherFindFirstFileW, InternetFindNextFileW, HttpAddRequestHeadersW, InternetErrorDlg, FtpGetFileW, FtpPutFileW, FtpGetCurrentDirectoryW, FtpSetCurrentDirectoryW, FtpRemoveDirectoryW, FtpCreateDirectoryW, FtpRenameFileW, FtpDeleteFileW, InternetQueryDataAvailable, InternetGetCookieW, InternetSetCookieW, InternetSetOptionExW, InternetQueryOptionW, InternetCanonicalizeUrlW, InternetCrackUrlW, InternetOpenW, InternetConnectW, HttpOpenRequestW, InternetCloseHandle, HttpSendRequestW, HttpQueryInfoW, InternetReadFile
winmm.dll
PlaySoundW
winspool.drv
ClosePrinter, OpenPrinterW, GetJobW, DocumentPropertiesW

upt4pc_tr_9.exe

By TUTO4PC COM INTERNATIONAL SL (Signed)

Remove upt4pc_tr_9.exe
MD5:   3dc61f4e5566d42a30724b46c22b5fa8
SHA1:   e9d6a7aa58d9e9b7caa2a7cf565f9e60d4fdd715
SHA256:   3dfa6c8c145c62636ac7ccc244e0c3c29a3d87387fa512aa48bb9833e60c3860
Warning 4 antivirus scanners has detected malware.

Overview

upt4pc_tr_9.exe is malware that executes as a process with the local user's privileges. It is set to be start when the PC boots and any user logs into Windows (added to the Run registry key for the all users under the local machine). The file is digitally signed by TUTO4PC COM INTERNATIONAL SL which was issued by the GlobalSign nv-sa certificate authority (CA). This particular version is usually found on Microsoft Windows XP (5.1.2600.196608).

DetailsDetails

File name:upt4pc_tr_9.exe
Typical file path:C:\Documents and Settings\user\Application data\tuto4pc_tr_9\upt4pc_tr_9.exe
Size:3.01 MB (3,154,416 bytes)
Build date:8/26/2013 6:01 PM
Certificate
Issued to:TUTO4PC COM INTERNATIONAL SL
Authority (CA):GlobalSign nv-sa
Digital DNA
PE subsystem:Windows GUI
File packed:No
.NET CLR:No
More details

BehaviorsBehaviors

Startup files (all users) run
Runs under the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
  • 'upt4pc_tr_9.exe' → C:\Documents and Settings\user\Application Data\tuto4pc_tr_9\upt4pc_tr_9.exe -runhelper

MalwareMalware detections

Based on 40+ industry antivirus scanners, 4 of them detected the following malware.
Antivirus engineEngine versionDetection
Avira AntiVir 7.11.109.96 Adware/Eorezo.AD
Sophos 4.94.0 Generic PUA OJ
Symantec 20131.1.5.61 Adware.Eorezo
Trend Micro HouseCall 9.700.0.1001 TROJ_GEN.F47V0925

ResourcesResource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
 
CPU
Total CPU:0.00478321%
0.028634%
Kernel CPU:0.00171142%
0.013761%
User CPU:0.00307179%
0.014873%
Kernel CPU time:78,125 ms/min
100,923,805ms/min
Context switches:1/sec
284/sec
Memory
Private memory:1.53 MB
21.59 MB
Private (maximum):5.43 MB
Private (minimum):3.84 MB
Non-paged memory:1.53 MB
21.59 MB
Virtual memory:40.67 MB
140.96 MB
Virtual memory (peak):44.68 MB
169.69 MB
Working set:5.43 MB
18.61 MB
Working set (peak):5.43 MB
37.95 MB
Resource allocations
Threads:1
12
Handles:98
600
GUI GDI count:41
103
GUI USER count:12
49

BehaviorsProcess properties

Integrety level:Undefined
Platform:32-bit
Command line:"C:\Documents and Settings\user\Application data\tuto4pc_tr_9\upt4pc_tr_9.exe" -runhelper
Owner:User
Parent process:Explorer.EXE (by Microsoft)

Windows OS versionsDistribution by Windows OS

OS versiondistribution
Microsoft Windows XP 100.00%

OEM distributionDistribution by PC manufacturer

PC Manufacturerdistribution
GIGABYTE 100.00%
Should I remove It? Clean your PC of unwanted adware, toolbars and bloatware.

Download it for FREE