What is upxp64.dll?

[ustahl]

Hi,
Found this strange upxp64.dll as an autostart item in my Win 7 64-bit Ultimate.

Making a search for that file throughout my system, it's location is C:\Users\Uffe\AppData\Local\upxp64\upxp64.dll. There are no other files in that folder upxp64. Looking at file details in Properties, File description, File version, Product name, Product version, Copyright and Language are empty. The only displayed file details are Size 84.0 KB and Date modified 27.2.2010 13:50.

The only occurance in the registry is:
[HKEY_USERS\S-1-5-21-791918989-287858860-1136523334-1001\Software\Microsoft\Windows\CurrentVersion\Run-]
"upxp64"="rundll32.exe \"C:\\Users\\Uffe\\AppData\\Local\\upxp64\\upxp64.dll\", DllInit"

I searched the web with Google + several other search engines - nothing came up, zilch, nada.
My security tool (NIS 2010) and Malwarebytes' Anti-Malware don't object to the file.

I'm wondering what that file might be related to. I find no reason, and it makes me uneasy not to understand & know the purpose of that startup item.

I now disabled this Autostart item, and I haven't noticed any change - system running smoothly.

Can anybody shed some light on this? I'm tempted to delete that folder.

Cheers Uffe

 

[Jacee]

Do you play any online games?

 

[not so gray matter]

Never heard of it, you can try this program, but I doubt it'll know either:

ProcessLibrary.com - The online resource for process information!

 

[baarod]

Hi,
Found this strange upxp64.dll as an autostart item in my Win 7 64-bit Ultimate.

Making a search for that file throughout my system, it's location is C:\Users\Uffe\AppData\Local\upxp64\upxp64.dll. There are no other files in that folder upxp64. Looking at file details in Properties, File description, File version, Product name, Product version, Copyright and Language are empty. The only displayed file details are Size 84.0 KB and Date modified 27.2.2010 13:50.

The only occurance in the registry is:
[HKEY_USERS\S-1-5-21-791918989-287858860-1136523334-1001\Software\Microsoft\Windows\CurrentVersion\Run-]
"upxp64"="rundll32.exe \"C:\\Users\\Uffe\\AppData\\Local\\upxp64\\upxp64.dll\", DllInit"

I searched the web with Google + several other search engines - nothing came up, zilch, nada.
My security tool (NIS 2010) and Malwarebytes' Anti-Malware don't object to the file.

I'm wondering what that file might be related to. I find no reason, and it makes me uneasy not to understand & know the purpose of that startup item.

I now disabled this Autostart item, and I haven't noticed any change - system running smoothly.

Can anybody shed some light on this? I'm tempted to delete that folder.

Cheers Uffe

Zip it and attach it and I'll extract the strings from it.

 

[ustahl]

Do you play any online games?

No, I only game offline, but some games check with a server for update, DRM etc.

Cheers Uffe

 

[ustahl]

Zip it and attach it and I'll extract the strings from it.

You mean I PM you with file attached? How do I do that?

Cheers Uffe

 

[not so gray matter]

Just place it in a zip file and attach it to a post using the "Manage Attachments" button in a full reply. (Hit Advanced)

 

[ustahl]

File attached

Hope I succeeded in my 1st attempt to upload a file to the forum.

Thanks for the advice.

Cheers Uffe

 

[ustahl]

Never heard of it, you can try this program, but I doubt it'll know either:
ProcessLibrary.com - The online resource for process information!

You were right, it said:
Oooops... Process Not Found

Thanks for trying, though.

Cheers Uffe

 

[baarod]

No discernible strings but from the imports list it looks like a graphics utility of some kind. Maybe a screen grabber? Here's the raw imports:

GetProcessHeap  ˆVirtualQuery  RLoadLibraryA  ¾lstrcatW  #InitializeCriticalSection }
GetModuleFileNameA  QLeaveCriticalSection  T CreateFileMappingA  ˜ EnterCriticalSection  f CreateProcessA  *
GetProcAddress  q
GetLastError  †VirtualProtect  HeapFree  Ê
GetSystemTimeAsFileTime  HeapValidate  C CopyFileA qUnmapViewOfFile ÌlstrlenA  
GetModuleHandleA  Á
GetSystemDirectoryA Û
GetThreadPriority Ð FindFirstChangeNotificationA  *ReadConsoleInputW ? ConvertDefaultLocale  ê
GetVersionExW é
GetVersionExA Ž
GetNumberFormatA  ö
GlobalAddAtomA  
SetDefaultCommConfigW [SystemTimeToFileTime  Õ
GetTempPathA  ' CallNamedPipeA  Ñ FindFirstChangeNotificationW  ú
GlobalDeleteAtom  v
GetLogicalDriveStringsA ×RtlUnwind ÄlstrcmpiW ?IsValidCodePage Ú
GetThreadLocale “ DuplicateHandle HeapUnlock  ¯ EnumSystemLocalesA  þ
GlobalFlags ~
GetModuleFileNameW  ¦ EnumResourceNamesW  ¯
GetProfileIntW  
 AssignProcessToJobObject  ÿ GetAtomNameW  SetEnvironmentVariableA ÃReleaseSemaphore  NSetVolumeLabelW eLockResource  |VerLanguageNameW  [LocalFlags  Æ
GetSystemPowerStatus  \LocalFree ‰VirtualQueryEx  &InterlockedCompareExchange  ¾RegisterWaitForSingleObjectEx Ô
GetTempFileNameW  ‘PeekNamedPipe HeapCreate  k CreateSemaphoreA  @IsValidLanguageGroup  «
GetProcessVersion 7
GetConsoleScreenBufferInfo  ½ ExpandEnvironmentStringsW F CopyFileW GlobalReAlloc õ FreeConsole SetEndOfFile  SetEnvironmentVariableW ÆlstrcpyA  4SetProcessShutdownParameters  HeapDestroy aLocalSize , CancelWaitableTimer DLCMapStringA  ‰OpenSemaphoreW  5IsBadStringPtrW ^
GetFileAttributesA  XSuspendThread USizeofResource  ó
GetWindowsDirectoryA  ™WriteConsoleA ´ EnumUILanguagesW  Ù FindFirstVolumeMountPointW  E CopyFileExW 5
GetConsoleOutputCP  ½
GetStringTypeW  $SetHandleCount  œPurgeComm È FillConsoleOutputCharacterW G
GetDateFormatA  
GetCommandLineW Î FindClose GlobalMemoryStatus  îSetConsoleCtrlHandler Ï
GetSystemWow64DirectoryW  ß
GetTickCount  3
GetConsoleMode  

GetBinaryTypeA  ®
GetProfileIntA  ÊlstrcpynW ¸ EscapeCommFunction  Ã FileTimeToDosDateTime ZSwitchToThread  ð FlushViewOfFile ÅRemoveDirectoryW  †OpenProcess SetFilePointerEx  WLoadResource  {
GetLongPathNameW  €VerifyVersionInfoW  `
GetFileAttributesExW  6IsBadWritePtr XLocalAlloc  VirtualAlloc  ÏResetEvent  ¦QueueUserWorkItem CIsWow64Process  þ GetAtomNameA  PeekConsoleInputA â FindNextVolumeW ªReadConsoleInputA _TerminateThread 2 ClearCommError  ]LocalHandle ‘WaitForSingleObjectEx pUnlockFileEx  * CancelIo  …OpenMutexW  ¡
GetProcessAffinityMask  c CreateNamedPipeW  4IsBadStringPtrA KERNEL32.dll  d CoTaskMemAlloc  i CoUninitialize  e CoTaskMemFree /
StgOpenStorageEx  Æ IIDFromString l CoUnmarshalInterface  
OleSetContainedObject  CreatePointerMoniker  " CoGetClassObject  y CreateDataCache ~ CreateItemMoniker D CoLockObjectExternal  á OleCreateLinkToFile +
StgIsStorageILockBytes  € CreateOleAdviseHolder } CreateILockBytesOnHGlobal 6
StringFromIID < CoInitializeEx  ’ GetHGlobalFromStream  W CoReleaseMarshalData  ` CoSetProxyBlanket Ý OleCreateLink [ CoRevertToSelf  
OleUninitialize  CoDisconnectObject  ú OleRegEnumVerbs ÿ OleSaveToStream - CoGetInterfaceAndReleaseStream  ß OleCreateLinkFromData 

PropVariantCopy / CoGetMarshalSizeMax ole32.dll ŠSetWindowsHookExA :
GetMessageA ®UnhookWindowsHookEx µ
KillTimer ¡ DispatchMessageA  zSetTimer  )ReleaseCapture  V CreateDialogParamW  pSetScrollRange  ÙwvsprintfA  SetWindowLongW  œTabbedTextOutW  H
GetProcessWindowStation 0
GetMenuDefaultItem  ’ShowWindow  ¿ DrawTextW ¢ DispatchMessageW   AdjustWindowRectEx   DeferWindowPos   EnableMenuItem  Ï EnumDesktopsW â
MessageBoxIndirectA fSetParent DSetCapture  mSetRectEmpty  ã
MessageBoxIndirectW Å EndDeferWindowPos Z CreateIconIndirect  bSetMenuItemInfoA  
GetInputState =
GetMessageTime  L CreateAcceleratorTableA ÒWinHelpW   CallWindowProcA Ž DefWindowProcA  ² DrawEdge  M CreateAcceleratorTableW d
GetUpdateRect < ChildWindowFromPoint  _SetMenuDefaultItem  ÓWindowFromDC  ñ
OemToCharA  ŽShowCursor  N CreateCaret Æ
LoadMenuA @ ClientToScreen  m
GetWindowInfo ´UnregisterClassW  ØwsprintfW 
GetDlgItem  Ã EnableScrollBar ê
MonitorFromRect ³ DrawFocusRect ô GetCaretBlinkTime ¼UpdateWindow  ŸToAscii *UnhookWindowsHook a CreateWindowExW aSetMenuItemBitmaps  L
GetQueueStatus  K
GetPropW  Õ
MapDialogRect ì
MoveWindow  u
GetWindowRgn  PtInRect  3ScrollDC  ½
LoadCursorW  BringWindowToTop  Ä EnableWindow  ž
IsChild / CharPrevW hSetProcessWindowStation T
GetScrollBarInfo  ú
OpenInputDesktop  2
GetMenuItemCount  : CheckMenuRadioItem  è
ModifyMenuW ‹ DefMDIChildProcA  G
GetProcessDefaultLayout ™SystemParametersInfoA 
 BeginPaint  ¾ DrawTextExW Ë
LoadStringA ü
OpenWindowStationW  º DrawStateA  î
MsgWaitForMultipleObjectsEx @SendMessageW  $ ChangeMenuA ë
MonitorFromWindow Y
GetSubMenu   DefWindowProcW  @
GetMonitorInfoW ¨TranslateAcceleratorW Ù
MapVirtualKeyW  ò GetAsyncKeyState  ˆ DefDlgProcW ;SendMessageA  n
GetWindowLongA  CSetActiveWindow   ChangeDisplaySettingsA  .ReplyMessage  kSetPropW  ¢
IsDialogMessageW  ‰ DefFrameProcA †SetWindowTextA  J CopyRect  U
GetScrollInfo nSetScrollInfo ] CreateMenu  ›TabbedTextOutA  0ReuseDDElParam  ?SendMessageTimeoutW +RemoveMenu  SetWindowContextHelpId  á
MessageBoxExW ShowCaret 
PeekMessageW  
 AdjustWindowRect   CallWindowProcW Ö EnumDisplaySettingsW  ·
LoadAcceleratorsW O CreateCursor  — DestroyMenu ( CharLowerBuffW  ³
IsZoomed  ^ CreatePopupMenu ç
ModifyMenuA ySetThreadDesktop  é
MonitorFromPoint  'RegisterWindowMessageA  USER32.dll   CommandLineToArgvW  # DragQueryFileW  Á SHGetSettings v SHAppBarMessage - ExtractIconExA  § SHGetDesktopFolder  s SHAddToRecentDocs ± SHGetFolderPathAndSubDirW 
ShellExecuteW * SHFormatDrive 

ShellExecuteExW æ SHSetLocalizedName  Ž SHCreateShellItem 
ShellAboutA y SHBrowseForFolderA  Ã SHGetSpecialFolderLocation  SHELL32.dll 0SetPaletteEntries p
GetEnhMetaFileA ï
PolylineTo  E CreatePalette SetDCBrushColor 1 CreateDIBPatternBrushPt ê FlattenPath Ý ExtTextOutA FStartDocW j
GetDIBits 4 CreateDiscardableBitmap 
GetPixelFormat  –
GetObjectType ” Ellipse ScaleViewportExtEx  J
GetBitmapBits ˜
GetOutlineTextMetricsA  1SetPixel  3SetPixelV Í EnumFontsA  P
GetBrushOrgEx Ð
ModifyWorldTransform  a
GetClipRgn  ç
PolyDraw  & CopyMetaFileW 2 CreateDIBSection  4SetPolyFillMode PTranslateCharsetInfo   AddFontResourceW  y
GetFontData %SetICMMode  :SetTextAlign  =SetTextJustification  å
PolyBezier  è FillRgn F CreatePatternBrush  <SetTextColor  % CopyMetaFileA Ú ExtEscape ¤
GetRgnBox í
Polygon  DescribePixelFormat Q
GetCharABCWidthsA # CopyEnhMetaFileA  : CreateFontIndirectA æ
PolyBezierTo   CloseMetaFile 9 CreateFontA MSwapBuffers -SetMetaFileBitsEx Ž DeleteMetaFile  ”
GetNearestPaletteIndex  Ÿ
GetROP2 ™ EndPath Ê EnumFontFamiliesExA g
GetDCOrgEx  M
GetBkMode N CreateScalableFontResourceA Ñ
MoveToEx  /SetMiterLimit “
GetNearestColor *
GetRandomRgn  – EndDoc  Ñ EnumMetaFile  BSetWindowExtEx  - CreateCompatibleDC  €
GetGlyphOutlineA  ]
GetCharWidthW é
PolyPolygon î
Polyline  J CreatePolygonRgn  Ž
GetMetaFileA  »
GetTextFaceW  SetBitmapBits ê
PolyPolyline  K
GetBitmapDimensionEx  ? CreateHalftonePalette ´
GetTextExtentPoint32A Ö
OffsetWindowOrgEx SetBkMode / CreateDCW Ç
IntersectClipRect EStartDocA GDI32.dll         EùˆK    ì)
 
         Ø)
 à)
 è)
 h”  _H  ù)
 
*
   
 uyvwahyw.dll DllInit DllInstall

 

[Pusspa]

you sure u dont have a modified theme?

 

[ustahl]

you sure u dont have a modified theme?

On the contrary, I'm sure I do have a modified theme.
Long time ago I modified a readymade themepack by adding several desktop background wallpapers to change at random in a slide show. Have since been changing the contents of that theme once in a while.

Have deleted that upxp64 folder with that single file content several hours ago. Everything seems to run smoothly as ever. I'm just befuddled as to what it was in the first place. Main thing though no harm seems to have happened, especially since I removed it. Remains a mystery?
Oh well...

Cheers Uffe

 

[ustahl]

Mystery solved

I finally found the cause of "upxp64.dll" as an autostart item. It's during installation of a little shareware utility program called "Photo Stamp Remover", the purpose of which is to remove watermarks, date stamps and other unwanted details/items from your digital photos. It actually works quite well and is very handy, I must say. Google for it, and you'll also find their nicely done online demo.

I cannot find any reason for this "upxp64.dll", though, since the program works as before even after deleting that earlier mentioned folder\file and registry entry. Odd.

Anyway, I consider this subject hereby solved.

Cheers Uffe

 

[baarod]

I finally found the cause of "upxp64.dll" as an autostart item. It's during installation of a little shareware utility program called "Photo Stamp Remover", the purpose of which is to remove watermarks, date stamps and other unwanted details/items from your digital photos. It actually works quite well and is very handy, I must say. Google for it, and you'll also find their nicely done online demo.

I cannot find any reason for this "upxp64.dll", though, since the program works as before even after deleting that earlier mentioned folder\file and registry entry. Odd.

Anyway, I consider this subject hereby solved.

Cheers Uffe

I knew it was a graphics program from the imports. Good luck.