What is Usp10.dll?

usp10.dll usp10.dll (1.409.2600.1106)

Included in the software

Name: Windows XP Home Edition, Deutsch

Information link: /windowsxp/

File details

File path: C:\WINDOWS\system32\usp10.dll

File date: 2002-08-29 14:00:00

Version: 1.409.2600.1106

File size: 339.456 bytes

Checksum and file hashes

CRC32 : 9DA76CA6

MD5: 06E2 217D 2AF7 50D6 69C8 AACE DD28 090B

SHA1: 7B9A 2876 45A6 A25B 8867 0229 49FE D6E6 816F 6A32

Version resource information

Company name: Microsoft Corporation

File description: Uniscribe Unicode script processor

File operating system: Windows NT, Windows 2000, Windows XP, Windows 2003

File type: Dynamic Link Library (DLL)

File version: 1.409.2600.1106

Internal name: Uniscribe

Legal copyright: Microsoft Corporation. All rights reserved.

Original file name: Uniscribe

Product name: Microsoft(R) Uniscribe Unicode script processor

Product version: 1.409.2600.1106

Purpose: usp10.dll is a file related to the character display script application program interface. May also be a virus

Security level (0-5): 0 (N/A not dangerous 5 most dangerous)

Spyware: possible

Adware : No

Virus: Possible

Trojan: Possible

System process: Yes

Application: No

Background program: No

Usage access: No

Internet access: No

Workaround:

Try running "sfc /scannow ", check the system files

If usp10.dll is found outside the windows\system32 directory, it is likely to be a virus file:

usp10.dll is called by many applications when running , the calling priority is:

1. The installation directory of the application; 2: The current working directory; 3: The system directory; 4: The path pointed by the path variable set path=.

The purpose is that when you run an EXE program, usp10.dll will be called according to the above priority, so that the virus file will be executed before the system file, and it is likely to cause the relevant application to run incorrectly.

At this time, it is recommended to run anti-virus software to check for viruses, or post for help in technical forums.

Possible virus

Starting from February 4, 2009, a large number of netizens found that their computers suddenly became as slow as "old cows", and many inexplicable "usp10. dll" file, even reinstalling the system will not help. It turns out that this is the result of the sudden outbreak of a vicious Trojan horse named "Running Bull".

360 Security Center issued an emergency announcement to reporters, saying that the "Benniu" Trojan downloader has attacked hundreds of thousands of computers and can cause most security software to fail. Users must use conventional methods such as reinstalling the system. It can't be solved either.

According to the reports of a large number of victimized users, computer systems infected with the "Benniu" downloader will slow down significantly. After some users' computers are infected with "Benniu", a large number of advertising web pages and anti-virus software will pop up. There are various symptoms such as being forced to uninstall, "QQ Doctor" is displayed as a "cross" and cannot be used normally, and a large number of Trojan viruses are automatically downloaded. Unless the victim user completely formats all hard disk partitions, "Running Bull" can still start again even after reinstalling the system.

According to 360 security expert Dr. Shi Xiaohong, "Benniu" uses special technology to be able to "resurrection" after the system is reinstalled. It is completely different from the "resurrection" methods commonly used by other vicious Trojans, making ordinary It is difficult for users to "save themselves" by reinstalling the system in the past; in addition, "Benniu" also uses an accomplice named "Ansoft Killer" to uninstall and destroy mainstream anti-virus software and block the websites of security manufacturers, resulting in Victims cannot get help by logging into secure websites or downloading secure software.

Principle of the USP10.dll virus:

The normal USP10.dll is a file related to the character display script application program interface. It exists in C:\WINDOWS\system32\USP10.dll. It is also possible that Exists in C:\WINDOWS\system32\dllcache\USP10.dll.

The usp10.dll Trojan virus uses the window system directory priority to start.

First let’s talk about the directory priority. When the windows system executes a file, it will first search for the file to be executed in the "current directory". If the file does not exist in the current directory, it will go to windows\ Search in system32\. If it still does not exist, it will search in the windows\ directory. If it still does not exist, it will search in the directory in the environment variable PATH. This is the windows directory priority.

Let me tell you here that the execution of an exe file will call many DLLs in the system.

After understanding the directory priority and the system dll that will be called when the exe application is executed, many friends may have thought about why this USP10.dll copies itself to each executable file. Why is it named USP10.dll in the same directory? Yes, copying itself is to let the executable file seize the directory priority when executing. It is named USP10.dll because there is also USP10.dll in windows\system32\. Many applications will call this dll when they start. This is it. The startup principle of USP10.dll virus is explained. [1]

Virus self-rescue

The data in the computer after being infected is not completely hopeless. Don't take chances after being poisoned, and don't think that the computer can still be used. Because it is a downloader, the longer the mark is, the more viruses and Trojans it will download, so you need to seek medical treatment promptly after getting sick.

Reinstalling the system is the best way. After the reinstallation is completed, do not touch other partitions. First open my computer, display the hidden files and system files, download the anti-virus software and the latest virus database offline upgrade package from other people's computers, copy it to the local computer and install it in the C drive, upgrade the anti-virus software to the latest virus database, and Perform a full scan on other partitions. Generally viruses will be detected and killed. Do not use the computer to do anything else until the scan is complete. After cleaning the virus, you can use it normally.