[noclu3]

I get this message when i start the computer: Invalid Backweb application id "227364"

Can i remove something in this logfile?:
Logfile of HijackThis v1.99.1
Scan saved at 14:45:41, on 27.8.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program\Tietoturvapalvelu\Common\FSM32.EXE
C:\Program\Logitech\iTouch\iTouch.exe
C:\Program\Google\Gmail Notifier\gnotify.exe
C:\Program\Java\jre1.5.0_04\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\MSN Messenger\MsnMsgr.Exe
C:\Program\Steam\Steam.exe
C:\Program\Logitech\MouseWare\system\em_exec.exe
C:\Program\Messenger\msmsgs.exe
C:\Program\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe
C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program\VIA\RAID\raid_tool.exe
C:\Program\Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
C:\Program\Tietoturvapalvelu\backweb\227364\program\fsbwsys.exe
C:\Program\Tietoturvapalvelu\Anti-Virus\FSGK32.EXE
C:\Program\Tietoturvapalvelu\Common\FSMA32.EXE
C:\Program\Tietoturvapalvelu\Anti-Virus\fssm32.exe
C:\Program\Tietoturvapalvelu\Common\FSMB32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program\Tietoturvapalvelu\Common\FCH32.EXE
C:\Program\Tietoturvapalvelu\Common\FAMEH32.EXE
C:\Program\Tietoturvapalvelu\FWES\Program\fsdfwd.exe
C:\Program\Tietoturvapalvelu\Anti-Virus\fsav32.exe
C:\Program\Tietoturvapalvelu\FSGUI\fsguiexe.exe
C:\WINDOWS\system32\wuauclt.exe
G:\installationsfiler\program\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program\Tietoturvapalvelu\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program\Tietoturvapalvelu\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program\Tietoturvapalvelu\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program\Tietoturvapalvelu\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [RefreshLock] C:\DOCUME~1\Victor\LOKALA~1\Temp\Rar$EX00.500\RefreshLock.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [FreeRAM XP] "C:\DOCUME~1\Victor\LOKALA~1\Temp\Rar$EX00.234\FreeRAM XP Pro 1.40.exe" -win
O4 - HKCU\..\Run: [Steam] C:\Program\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1123876089359
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-sec...m/ols/fscax.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...wn.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{34A918D9-4FD8-4B88-89C9-BEA4F7F554D7}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{34A918D9-4FD8-4B88-89C9-BEA4F7F554D7}: NameServer = 192.168.1.1
O23 - Service: Adobe LM Service - Unknown owner - C:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Tietoturvapalvelu (BackWeb Plug-in - 227364) - Unknown owner - C:\Program\TIETOT~1\backweb\227364\Program\SERVIC~1.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program\Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program\Tietoturvapalvelu\backweb\227364\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program\Tietoturvapalvelu\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program\Tietoturvapalvelu\Common\FSMA32.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program\Delade filer\Macromedia Shared\Service\Macromedia Licensing.exe

Thanks in advance!

Edit: I noticed that i can't update F-Secure anymore. When i push the button "Check for updates", nothing happens. It doesn't respond!

Edited by noclu3, 31 August 2005 - 07:41 AM.

[Advertisements]

Hi,


We are sorry to have missed your log due to heavy traffic.

I see a couple of obvious things to fix. However, I would appreciate it you can visit Panda and do an online scan. Save the scan report and post it back here.

[tampabelle]

Hi,


We are sorry to have missed your log due to heavy traffic.

I see a couple of obvious things to fix. However, I would appreciate it you can visit Panda and do an online scan. Save the scan report and post it back here.

[noclu3]

hi!

When I used Panda activescan, the "scanning-window" just disappeares after a while!
I tried it twice and the same thing happaned both times.
I've used it before, so I know it's not supposed to do that. Well I used it a few days ago and here are the results from that scan:

Incident...................................Status....................Location

Adware:adware/exactsearch...No disinfected.......Windows Registry

Edited by noclu3, 31 August 2005 - 10:52 AM.

[tampabelle]

Please download ewido security suite it is a free version of the program.

• Install ewido security suite
• When installing, under "Additional Options" uncheck..
  • Install background guard
  • Install scan via context menu
• Launch ewido, there should be an icon on your desktop, double-click it.
• The program will now open to the main screen.
• When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  
• You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
• The update will start and a progress bar will show the updates being installed.
  (the status bar at the bottom will display ("Update successful")
• Exit ewido. DO NOT scan yet.

If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates


Next, please reboot your computer in SafeMode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, start tapping press F8 key.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.

Now open ewido and do a scan of your system.

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• You will be prompted to clean the first infection.
• Select "Perform action on all infections", then proceed.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop or a location where you can find it easily.

Reboot the PC in Normal Mode and post the Ewido scan report here

[noclu3]

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 20:28:56, 31.8.2005
+ Report-Checksum: 1A8CAEB8

+ Scan result:

No infected objects found.


::Report End

[tampabelle]

Hi,

The scan logs have turned out clean !!!!

So it may just be an issue with your anti-virus program !! Can you uninstall it and then reinstall it ???

[noclu3]

hi again!

I have already tried that twice, without success .
I even formatted C: and reinstalled windows, but it didn't help.
Do you think it would help if I changed anti-virus program?

[tampabelle]

What is this program - Tietoturvapalvelu???

Is it related to your F-Secure ???

[noclu3]

Yes, it means something like "data safety service" in Finnish

[tampabelle]

This is where you are having issues -


23 - Service: Tietoturvapalvelu (BackWeb Plug-in - 227364) - Unknown owner - C:\Program\TIETOT~1\backweb\227364\Program\SERVIC~1.EXE

Uninstall and reinstall it ???

[tampabelle]

Lets try this first -

Click on Start ---> Run. Type Services.msc and hit enter. Locate the item - Tietoturvapalvelu. Right click on it and then click on properties. In the Startup Type choose the option Disable. Close the window.

Reboot the PC and let me know if you still have the problem.

Also check if this program is running fine on your PC

[noclu3]

Thanks! now the window at startup is gone. But I still can't update F-Secure

[tampabelle]

Did you install / uninstall any software in the receent past ???


Did you have any infections in the recent past which may have interferred with F-Secure ???

[noclu3]

Well I have reinstalled windows a few days ago, so I have installed quite a few programs. But I have used all of them before without any problems.
I haven't been infected by any virus, but I found a few things with Ad-aware and Spybot-Search and Destroy.

Edited by noclu3, 01 September 2005 - 07:03 AM.

[tampabelle]

Lets run through the check points -

1) You can connect to internet and access websites of your choice

2) You have firewall which belongs to F-Secure. So it should not be restricting access to its own site (BTW, can try updating the AV program and then immediately check the Firewall log to see if it stops / allows the update process)

3) Is your subscription to F-Secure current and valid ?? If it has expired then you wont be able to get the updates !!!

4) Did you try and contact F-Secure by email to see what the reason may be ???