1

Yesterday I got a suspicious message when starting uTorrent, it said "The install of 'some temporary file.tmp' failed (signer certificate mismatch)". The file was an exe file with .tmp extension and signed with the "Bittorrent Inc" signature. After powering off the PC and booting again, I got this message: "Bitlocker needs your recovery key to unlock your drive because the boot configuration data setting 0x25000020 has changed for the following boot application \windows\system32\winload.efi"
It seems it means that the BCD nx option has changed, and when I checked it was set to "OptIn"
Question: can this be a result of virus activity on my PC? What should I do?

Improve this question
8
  • You don’t specify what you were downloading with BitTorrent, but I would imagine, that activity is to blame. hopefully you have your the BitLocker recovery key since there is no workaround to decrypting your files without it.
    – Ramhound
    Jun 27, 2020 at 2:14
  • @Ramhound nothing was downloading at that moment. I do have the key, but I'm concerned that my PC might be compromised.
    – user626528
    Jun 27, 2020 at 3:23
  • superuser.com/questions/100360/…
    – DavidPostill ♦
    Jun 27, 2020 at 7:25
  • @user626528 - You have not provided enough information to determine if malicious software exists on your system.
    – Ramhound
    Jun 27, 2020 at 11:19
  • @Ramhound I provided all the information that I have. The main question is: can uTorrent be a source of infection?
    – user626528
    Jun 27, 2020 at 17:08

1 Answer 1

Reset to default
0

Apparently, this was a potentially-unwanted-app named PUA:Win32/CandyOpen - see https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA%3aWin32%2fCandyOpen
And most likely, it was dropped by uTorrent as the payload files were signed by Bittorrent Inc.
Be warned.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .