Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.



Windows 7: beacucqitear.exe trying to run? Also Ptch_zaccess.six malware.

02 Aug 2012   #1

Windows 7 Professional x64
 
 
beacucqitear.exe trying to run? Also Ptch_zaccess.six malware.

Wow did I really stump Google search on this? Read on...

This afternoon my Windows 7 x64 machine at my office started having its Trend Micro pop up about once every 1-2 minutes saying that some threat had been taken care of. It mentioned "PTCH_ZACCESS.SIX" and said the problem was in the Services.exe file in the system32 folder.

So I clicked on the details link which took me to this Trend site: PTCH_ZACCESS.SIX | Low Risk | Trend Micro Threat Encyclopedia

I decided to use the SFC method mentioned at the bottom. I rebooted into safe mode, and ran SFC on the services.exe file only. It said it was corrupt and said it repaired the problem. So I rebooted normally.

After my system came back up, I started Outlook 2010. Within seconds after Outlook 2010 started, the UAC popped up saying some file was trying to run, from C:\users\patrick\ and the file was beacucqitear.exe. I kept clicking NO but the thing kept popping up with no end.

So I did a hard shut down, rebooted again into safe mode. I navigated to that folder, and did a Shift+Delete on the file. After that I ran a registry search and deleted anything with "beacucqitear.exe" in it. Also ran a complete SFC operation and no problems were found.

I rebooted again normally and everything seems to be good now. What's odd is that I did a Google search on "beacucqitear.exe" and it found NO RESULTS! Really? Am I the first person in the entire world to have this file pop up on their system? Is there really ZERO information on the internet about it?

I don't know if that file has anything to do with that PTCH_ZACCESS thing or what. Hopefully I got everything sorted.

My System SpecsSystem Spec
.

02 Aug 2012   #2

Windows 7 Home premium 32bit
 
 

Beacucqitear.exe appeared on my computer a few hours ago. Shortly after that McAfee kept saying that it had detected and removed ZeroAccess trojan from my computer. This happened every time I rebooted and was followed by beacucqiter.exe trying to change my hard drive.

I tried various other software such as hitman pro, but nothing seemed to work. So in the end I just deleted beacucqiter.exe from c:\Users\thomas before removing anything in the registry containing the words beacucqiter. Things seem to be okey for now.

Googling beacucqitear.exe lead me here, which is the only place I've found that mentions beacucqiter.exe. Very strange!

Anyone have any thoughts?
My System SpecsSystem Spec
02 Aug 2012   #3

Windows 7 Professional x64
 
 

Lol yeah NOW Google has something on that file. But before I made this post it had nothing on it which is absolutely shocking to me.
My System SpecsSystem Spec
.


03 Aug 2012   #4

Windows 7 Home Premium 32bit
 
 

I came across the same beacucquitear.exe trying to run as a "dial up" pop up box asking for password and user; not letting me cancel any task;
so I forced the shutdown and started in safe mode.
Then searched for anything with that name (only one file appeared) cleaned it all and rebooted, searched again for anything beacucquitear.exe and finally it all seems clear and running OK - i also run antivirus scan and no threat detected

Seems this bug is quite new and no new in Google except for this forum
My System SpecsSystem Spec
03 Aug 2012   #5

Microsoft Community Contributor Award Recipient

Windows 7 Ult. x64 Windows 8.1 x64 Ubuntu 12.04 LTS Tri-Boot
 
 

Hi,

Its a pity you guys deleted these files, if its something very new in the wild, it would be useful to upload it here:

https://www.virustotal.com/

Does anyone still have a sample?

Regards,
Golden
My System SpecsSystem Spec
03 Aug 2012   #6

Vista 32bit
 
 

Quote   Quote: Originally Posted by Golden View Post
Hi,

Its a pity you guys deleted these files, if its something very new in the wild, it would be useful to upload it here:

https://www.virustotal.com/

Does anyone still have a sample?

Regards,
Golden
Sure do mate, was in my User profile sitting by itself. "Left Qualifier Winbond"

Uploaded n' scanned it just like you said, it came up with 3 hits :1 - ESET-NOD32 a variant of Win32/Kryptik.AJIK 2 - Kaspersky Trojan.Win32.Jorik.Totem.vr 3 - TrendMicro-HouseCall TROJ_GEN.F47V0802.

And Security essentials seems to be off and unable to reboot.
My System SpecsSystem Spec
03 Aug 2012   #7

Microsoft Community Contributor Award Recipient

Windows 7 Ult. x64 Windows 8.1 x64 Ubuntu 12.04 LTS Tri-Boot
 
 

Hi,

Nice one. Can you try this tutorial, and let us know the results:

Windows Defender Offline

Regards,
Golden
My System SpecsSystem Spec
03 Aug 2012   #8

Vista 32bit
 
 

So basically the defender did find a crap load of HKEY trojans and the like, it also found the file 'beacucqitear.exe' but it was unsure of it's nature so it sent it to Microsoft to determine if it was malicious or not. When I rebooted it was still the same, security Essentials was still locked down and the beacucqitear was trying to access permission. So I just did a system restore to 5 days ago and that worked. I did a full scan with SE, Malbytes, and a few other scanners after the restore and nothing was found.
My System SpecsSystem Spec
03 Aug 2012   #9

Win 7 32 Home Premium, Win 7 64 Pro, Win 8.1 Pro
 
 

I would guess, based on what I've read about the new Sirefef variants, that these were either viruses imported by the main virus, or random generated names. The new Sirefef is capable of all these behaviors. It even has it's own storage space for viruses it imports.
My System SpecsSystem Spec
03 Aug 2012   #10

Windows 7
 
 

I'm so new to this kind of thing... But I got that same Beacucqitear.exe poping up on my computer, and saying the whole "Left Qualifier Winbond" stuff.
I restarted in Safe Mode and deleted it.. It hasn't shown up since. Am I good? Or would it still be somewhere on my computer? Evry scan I run on McAfee says there's nothing there...

I'm a complete newbie, it took me about 15 minutes to even figure out how safe mode works. So i'm really unsure about what I should be doing. :/
My System SpecsSystem Spec
Reply

 beacucqitear.exe trying to run? Also Ptch_zaccess.six malware.





Thread Tools



Similar help and support threads for2: beacucqitear.exe trying to run? Also Ptch_zaccess.six malware.
Thread Forum
malware System Security
Malware-splosion: 2013 Will be Malware's Biggest Year Ever Security News
need help getting rid of malware System Security
Malware Removal Guide 2011: How to Get Rid of All The Latest Malware Security Basics
think I have bad Malware System Security
is this malware? System Security
malware? System Security

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 09:34 AM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33