Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

_gninnur_litubntsf8


  • Please log in to reply
4 replies to this topic

#1 oldy_but_goody

oldy_but_goody

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:30 AM

Posted 22 April 2006 - 01:43 PM

When I want to shutdown my computer sometimes a message pops up which reads that the Application _GniNnUr_liTubNTsF8 is not reacting any more, and then asks, whether I want to wait or terminate that application or go back to windows.

I have already been searching on Google about this topic, however no satisfying answers are available. Reading the message backwards, it reads 'tnbutil running'. At first I checked a program called WinTasks 5 Pro, which identifies the application TNBUtil.exe as belonging to F-Secure. I am using F-Secure Internet Security 2006.

Can anyone give me further information about this behaviour and whether it is harmful or not?

BC AdBot (Login to Remove)

 


m

#2 Scarlett

Scarlett

    Bleeping Diva


  • Members
  • 7,479 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:As always I'm beside myself ;)
  • Local time:05:30 PM

Posted 22 April 2006 - 01:58 PM

According to the Bleeping Computer Startup Program Database: http://www.bleepingcomputer.com/startups/

It is a valid program that is required to run at startup.

Info here: http://www.bleepingcomputer.com/startups/F...e_TNB-1668.html

Now as to why you are getting that certain pop up, I have no idea.
Hopefully someone else will be able to assist you further.
Posted Image

#3 Herk

Herk

  • Members
  • 1,609 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:S.E. Idaho, USA
  • Local time:06:30 PM

Posted 22 April 2006 - 03:49 PM

I think it's something to be concerned about since it involves your antivirus. Are you running only one antivirus? Have you noticed any other strange behavior? It's so hard to tell lately, but it often seems as if hackers like to use the letters-for-words; uppercase/lowercase; backwards formats. One wonders if your antivirus or spyare programs may have disabled something that's still trying to run.

Maybe it's F-Secure's encryption scheme? Perhaps it would be a good idea to contact F-Secure's support and ask them about it.

#4 oldy_but_goody

oldy_but_goody
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:30 AM

Posted 23 April 2006 - 03:33 AM

Thanks for the answers so far. The behaviour of the popup can't be reproduced, i.e. it does not occur on every shutdown. The one and only antivirus I am using is that by F-Secure. I already wondered - if this is an original F-Secure matter - why there is upper-/lower-case and backwards writing involved. This is kind of suspisious, because it is the way that hackers work...

I think I have to contact F-Secure about this.
Any other ideas?

Edited by oldy_but_goody, 23 April 2006 - 03:34 AM.


#5 Herk

Herk

  • Members
  • 1,609 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:S.E. Idaho, USA
  • Local time:06:30 PM

Posted 23 April 2006 - 09:01 AM

Go to Start -> Run and type in

msconfig

Click on the "startup" tab. See if that cryptic filename is listed anywhere.

Do you have Spybot Search and Destroy? (You should) If you find that entry, enable expert mode in "mode" and make sure Startup List is checked in the right pane. In the left pane, click on Startup list, and see if it's there. Then click the bar on the right bottom and see if there's any info about it. If you contact F-Secure and find out it's not theirs, you can remove it from here by selecting it and clicking the Delete above.

If you aren't using other spyware programs, like AdAware Personal and Javacool's Spyware Blaster (don't accept substitutes!) it would be a good idea to use them. And you could post a Hijack log in the HijackThis forum. Read this first. Be patient - they've got quite a workload and it may be days before they get to you. Don't reply to your own post because the helpers are looking for posts with no replies.

When a program that has been installed (like malware, for instance) is removed, there may still be an entry in the Startup list and when you boot up you'll get an error message that the necessary file can't be found. Yesterday, I removed a Soundblaster card from my PC and on bootup I got "error: p17.dll can't be found." Sure enough, there was an entry in the Startup list that hadn't been removed with the software, and it was from Soundblaster and Audigy cards.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users