Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: beacucqitear.exe trying to run? Also Ptch_zaccess.six malware.

02 Aug 2012   #1
PatrickGSR94

Windows 7 Professional x64
 
 
beacucqitear.exe trying to run? Also Ptch_zaccess.six malware.

Wow did I really stump Google search on this? Read on...

This afternoon my Win7 x64 machine at my office started having its Trend Micro pop up about once every 1-2 minutes saying that some threat had been taken care of. It mentioned "PTCH_ZACCESS.SIX" and said the problem was in the Services.exe file in the system32 folder.

So I clicked on the details link which took me to this Trend site: PTCH_ZACCESS.SIX | Low Risk | Trend Micro Threat Encyclopedia

I decided to use the SFC method mentioned at the bottom. I rebooted into safe mode, and ran SFC on the services.exe file only. It said it was corrupt and said it repaired the problem. So I rebooted normally.

After my system came back up, I started Outlook 2010. Within seconds after Outlook 2010 started, the UAC popped up saying some file was trying to run, from C:\users\patrick\ and the file was beacucqitear.exe. I kept clicking NO but the thing kept popping up with no end.

So I did a hard shut down, rebooted again into safe mode. I navigated to that folder, and did a Shift+Delete on the file. After that I ran a registry search and deleted anything with "beacucqitear.exe" in it. Also ran a complete SFC operation and no problems were found.

I rebooted again normally and everything seems to be good now. What's odd is that I did a Google search on "beacucqitear.exe" and it found NO RESULTS! Really? Am I the first person in the entire world to have this file pop up on their system? Is there really ZERO information on the internet about it?

I don't know if that file has anything to do with that PTCH_ZACCESS thing or what. Hopefully I got everything sorted.


My System SpecsSystem Spec
.
02 Aug 2012   #2
ThomB

Windows 7 Home premium 32bit
 
 

Beacucqitear.exe appeared on my computer a few hours ago. Shortly after that McAfee kept saying that it had detected and removed ZeroAccess trojan from my computer. This happened every time I rebooted and was followed by beacucqiter.exe trying to change my hard drive.

I tried various other software such as hitman pro, but nothing seemed to work. So in the end I just deleted beacucqiter.exe from c:\Users\thomas before removing anything in the registry containing the words beacucqiter. Things seem to be okey for now.

Googling beacucqitear.exe lead me here, which is the only place I've found that mentions beacucqiter.exe. Very strange!

Anyone have any thoughts?
My System SpecsSystem Spec
02 Aug 2012   #3
PatrickGSR94

Windows 7 Professional x64
 
 

Lol yeah NOW Google has something on that file. But before I made this post it had nothing on it which is absolutely shocking to me.
My System SpecsSystem Spec
.

03 Aug 2012   #4
RChagas

Windows 7 Home Premium 32bit
 
 

I came across the same beacucquitear.exe trying to run as a "dial up" pop up box asking for password and user; not letting me cancel any task;
so I forced the shutdown and started in safe mode.
Then searched for anything with that name (only one file appeared) cleaned it all and rebooted, searched again for anything beacucquitear.exe and finally it all seems clear and running OK - i also run antivirus scan and no threat detected

Seems this bug is quite new and no new in Google except for this forum
My System SpecsSystem Spec
03 Aug 2012   #5
Golden
Microsoft MVP

Windows 7 Ult. x64
 
 

Hi,

Its a pity you guys deleted these files, if its something very new in the wild, it would be useful to upload it here:

https://www.virustotal.com/

Does anyone still have a sample?

Regards,
Golden
My System SpecsSystem Spec
03 Aug 2012   #6
QH185

Vista 32bit
 
 

Quote   Quote: Originally Posted by Golden View Post
Hi,

Its a pity you guys deleted these files, if its something very new in the wild, it would be useful to upload it here:

https://www.virustotal.com/

Does anyone still have a sample?

Regards,
Golden
Sure do mate, was in my User profile sitting by itself. "Left Qualifier Winbond"

Uploaded n' scanned it just like you said, it came up with 3 hits :1 - ESET-NOD32 a variant of Win32/Kryptik.AJIK 2 - Kaspersky Trojan.Win32.Jorik.Totem.vr 3 - TrendMicro-HouseCall TROJ_GEN.F47V0802.

And Security essentials seems to be off and unable to reboot.
My System SpecsSystem Spec
03 Aug 2012   #7
Golden
Microsoft MVP

Windows 7 Ult. x64
 
 

Hi,

Nice one. Can you try this tutorial, and let us know the results:

Windows Defender Offline

Regards,
Golden
My System SpecsSystem Spec
03 Aug 2012   #8
QH185

Vista 32bit
 
 

So basically the defender did find a crap load of HKEY trojans and the like, it also found the file 'beacucqitear.exe' but it was unsure of it's nature so it sent it to Microsoft to determine if it was malicious or not. When I rebooted it was still the same, security Essentials was still locked down and the beacucqitear was trying to access permission. So I just did a system restore to 5 days ago and that worked. I did a full scan with SE, Malbytes, and a few other scanners after the restore and nothing was found.
My System SpecsSystem Spec
03 Aug 2012   #9
Borg 386

Win 7 32 Home Premium, Win 7 64 Pro, Win 8.1, Win 10
 
 

I would guess, based on what I've read about the new Sirefef variants, that these were either viruses imported by the main virus, or random generated names. The new Sirefef is capable of all these behaviors. It even has it's own storage space for viruses it imports.
My System SpecsSystem Spec
03 Aug 2012   #10
TooNew

Windows 7
 
 

I'm so new to this kind of thing... But I got that same Beacucqitear.exe poping up on my computer, and saying the whole "Left Qualifier Winbond" stuff.
I restarted in Safe Mode and deleted it.. It hasn't shown up since. Am I good? Or would it still be somewhere on my computer? Evry scan I run on McAfee says there's nothing there...

I'm a complete newbie, it took me about 15 minutes to even figure out how safe mode works. So i'm really unsure about what I should be doing. :/
My System SpecsSystem Spec
Reply

 beacucqitear.exe trying to run? Also Ptch_zaccess.six malware.




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Changing File Decription for link to Malware Bytes Anti-Malware
Have been using Win 7 Ultimate x64 for quite a while but tonight ran into a small problem. I like to keep the titles for links very short and want to rename "Malwarebytes Anti-Malware" (I am a registered, paid user) to simply "Malwarebytes". I am listed as an Administrator and I used LockHunter to...
System Security
Malware Removal Guide 2011: How to Get Rid of All The Latest Malware
Read more at: Maximum PC | Malware Removal Guide 2011: How to Get Rid of All The Latest Malware
Security Basics
Malware help...
Im running Win7 professional edition and I believe I have some sort of malware though Avast, Malewarebytes, spybot search and distroy, and microsoft security essentials pic up nothing... the reason i know i have something is that regedit is running as a process and regedit 32 on occasion... any...
System Security


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 05:46.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App