Re: Unknown Startup Program Requires Approval BPS Video Converter& Decompiler

["Jason Coombs" <jasonc () science org>]

More important is the question: from where did you download the BPS Video Converter & Decompiler program?

Give us the steps to reproduce what you've done, and we can see if you've been owned by an attacker, or if you ended up 
getting a true and correct copy of the program you were trying to download and install.

Regards,

Jason Coombs
jasonc () science org


-----Original Message-----
From: H Carvey <keydet89 () yahoo com>
Date: 23 Mar 2005 02:23:19 
To:security-basics () securityfocus com
Subject: Re: Unknown Startup Program Requires Approval  BPS Video
    Converter& Decompiler

In-Reply-To: 
<!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAAGt8LPetpPEyKfA/Y3A9m7MKAAAAQAAAAAkEuGALbJEGmIUMEkftwIAEAAAAA () cytanet 
com cy>

Wow, deja vu...

> I have installed the program BPS Video Converter& Decompiler  for converting
> avi to wmv files and at the end of the installation Microsoft Antispyware
> notifies me that an Unknown Startup Program Requires Approval is-ijpua.exe,
> does anyone know what kind of program is this one? I google for it but I
> couldn't work. Is it a spyware?

Can you provide any information other than the name of the file?  For example, which startup location is it being 
installed in?  Where is the file itself located in the file system (ie, path)?  Have you attempted to retrieve headers 
or version information from the file?  

H. Carvey
"Windows Forensics and Incident Recovery"
http://www.windows-ir.com
http://windowsir.blogspot.com