beacucqitear.exe trying to run? Also Ptch_zaccess.six malware.

[PatrickGSR94]

Wow did I really stump Google search on this? Read on...

This afternoon my Win7 x64 machine at my office started having its Trend Micro pop up about once every 1-2 minutes saying that some threat had been taken care of. It mentioned "PTCH_ZACCESS.SIX" and said the problem was in the Services.exe file in the system32 folder.

So I clicked on the details link which took me to this Trend site: PTCH_ZACCESS.SIX | Low Risk | Trend Micro Threat Encyclopedia

I decided to use the SFC method mentioned at the bottom. I rebooted into safe mode, and ran SFC on the services.exe file only. It said it was corrupt and said it repaired the problem. So I rebooted normally.

After my system came back up, I started Outlook 2010. Within seconds after Outlook 2010 started, the UAC popped up saying some file was trying to run, from C:\users\patrick\ and the file was beacucqitear.exe. I kept clicking NO but the thing kept popping up with no end.

So I did a hard shut down, rebooted again into safe mode. I navigated to that folder, and did a Shift+Delete on the file. After that I ran a registry search and deleted anything with "beacucqitear.exe" in it. Also ran a complete SFC operation and no problems were found.

I rebooted again normally and everything seems to be good now. What's odd is that I did a Google search on "beacucqitear.exe" and it found NO RESULTS! Really? Am I the first person in the entire world to have this file pop up on their system? Is there really ZERO information on the internet about it?

I don't know if that file has anything to do with that PTCH_ZACCESS thing or what. Hopefully I got everything sorted.

 

[ThomB]

Beacucqitear.exe appeared on my computer a few hours ago. Shortly after that McAfee kept saying that it had detected and removed ZeroAccess trojan from my computer. This happened every time I rebooted and was followed by beacucqiter.exe trying to change my hard drive.

I tried various other software such as hitman pro, but nothing seemed to work. So in the end I just deleted beacucqiter.exe from c:\Users\thomas before removing anything in the registry containing the words beacucqiter. Things seem to be okey for now.

Googling beacucqitear.exe lead me here, which is the only place I've found that mentions beacucqiter.exe. Very strange!

Anyone have any thoughts?

 

[PatrickGSR94]

Lol yeah NOW Google has something on that file. But before I made this post it had nothing on it which is absolutely shocking to me.

 

[RChagas]

I came across the same beacucquitear.exe trying to run as a "dial up" pop up box asking for password and user; not letting me cancel any task;
so I forced the shutdown and started in safe mode.
Then searched for anything with that name (only one file appeared) cleaned it all and rebooted, searched again for anything beacucquitear.exe and finally it all seems clear and running OK - i also run antivirus scan and no threat detected

Seems this bug is quite new and no new in Google except for this forum

 

[Golden]

Hi,

Its a pity you guys deleted these files, if its something very new in the wild, it would be useful to upload it here:

https://www.virustotal.com/

Does anyone still have a sample?

Regards,
Golden

 

[QH185]

Hi,

Its a pity you guys deleted these files, if its something very new in the wild, it would be useful to upload it here:

https://www.virustotal.com/

Does anyone still have a sample?

Regards,
Golden

Sure do mate, was in my User profile sitting by itself. "Left Qualifier Winbond"

Uploaded n' scanned it just like you said, it came up with 3 hits :1 - ESET-NOD32 a variant of Win32/Kryptik.AJIK 2 - Kaspersky Trojan.Win32.Jorik.Totem.vr 3 - TrendMicro-HouseCall TROJ_GEN.F47V0802.

And Security essentials seems to be off and unable to reboot.

 

[Golden]

Hi,

Nice one. Can you try this tutorial, and let us know the results:

http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html

Regards,
Golden

 

[QH185]

So basically the defender did find a crap load of HKEY trojans and the like, it also found the file 'beacucqitear.exe' but it was unsure of it's nature so it sent it to Microsoft to determine if it was malicious or not. When I rebooted it was still the same, security Essentials was still locked down and the beacucqitear was trying to access permission. So I just did a system restore to 5 days ago and that worked. I did a full scan with SE, Malbytes, and a few other scanners after the restore and nothing was found.

 

[Borg 386]

I would guess, based on what I've read about the new Sirefef variants, that these were either viruses imported by the main virus, or random generated names. The new Sirefef is capable of all these behaviors. It even has it's own storage space for viruses it imports.

 

[TooNew]

I'm so new to this kind of thing... But I got that same Beacucqitear.exe poping up on my computer, and saying the whole "Left Qualifier Winbond" stuff.
I restarted in Safe Mode and deleted it.. It hasn't shown up since. Am I good? Or would it still be somewhere on my computer? Evry scan I run on McAfee says there's nothing there...

I'm a complete newbie, it took me about 15 minutes to even figure out how safe mode works. So i'm really unsure about what I should be doing. :/

 

[Golden]

Hi TooNew,

Follow my suggestion in post #7 above.

Regards,
Golden

 

[dmstar]

Beacucqitear

I can't get rid of Beacucqitear. When I search and try to remove it says it can't be deleted because it is open in the Left Qualifier??

 

[richtv]

running winxp but googling took me here so i'm posting my experience and the solution that worked for me.

had the same issue.

couldn't even delete beacucqitear.exe in safe mode with Admin rights, which was located in C:\Documents and Settings\Rich as a hidden file ....if u search for the file, be sure to include both hidden and system folders

i downloaded Windows Defender Offline but when i ran the program, it said i was missing and needed to install IMAPI 2.0 which i did at Download: Image Mastering API v2.0 (IMAPIv2.0) for Windows XP (KB932716) - Microsoft Download Center - Download Details

after running the M$ update, my drive actually vanished!.....even tried to get it back in the Device Manager / DVD/CD-ROM drives where the drive was being shown with a yellow exclamation point ie not recognizable or bad drive or missing driver.

i tried to update it but nothing, so i uninstalled my dvd drive and rebooted thinking it would come back, it didn't.

i therefore ran a system restore from a few days earlier [Start / Programs / Accessories / System Tools / System Restore

and now everything is back to normal and Norton is showing a clean computer.

even that beacucqitear.exe is gone after running a full search on it!

 

[stuartputt]

Hey guys i just got this problem right now i sorta? fixed it but the file is still in my users area but nod 34 has it locked down but i still want it gone but im not a fan of going back 5 days as i have got lots of videos and other items that i need and un able to back up when i try to delete it it just says you do not have the rights -.- when i am the Admin on my pc so not sure what to do on this one ;O i am a pc nerd but when it comes to viruses im a derp any help would be most welcomed!

Also really worried as my Nod 32 seams to be turned off and i can not for the life of me turn it back on even with restarts

 

[sternenfarben]

Am not a profi...

yesterday Mc'Affee found ZeroAccess in several endings. (.ee .eu .el) and gets this message regularly.. told me it is removed.

today beacucqitear.exe popped up - that it wants to do changes on the computer.. i denied..

deleted

now the firewall is deactivated...

whenever i try to activate McAffee firewall.. it deactivates itself within one or two seconds...

 

[QH185]

Am not a profi...

yesterday Mc'Affee found ZeroAccess in several endings. (.ee .eu .el) and gets this message regularly.. told me it is removed.

today beacucqitear.exe popped up - that it wants to do changes on the computer.. i denied..

deleted

now the firewall is deactivated...

whenever i try to activate McAffee firewall.. it deactivates itself within one or two seconds...

It was doing the same thing to me mate. Can you do a system restore to a earlier point? IE before it was doing it? Because I booted Windows Defender off a USB, and tons of scans but the only thing that really worked was doing a system restore to before it starting happening. Just type 'System Restore' in your windows search bar and run it. Try that.

 

[sammy3417]

Hi Guys,

I would have a try of hitman pro.....Hitman Pro 3 - SurfRight

See what this brings up

Good tut here http://www.youtube.com/watch?v=4-5Punj4A60

Post results

 

[richtv]

@stuart, a system restore does not affect your videos and such.

what it does is revert your system files and programs.

if you wish to read up on it here is a link:

it is valid for xp, 7, etc.

System Restore - Windows 7 features - Microsoft Windows

 

[richtv]

@Stern, after system restore, you might need to uninstall McAfee and reinstall it if it is working oddly.

You can use McAfee's removal tool here:

1) Uninstall McAfee via normal way.
2) Run McAfee's removal tool, i'd actually recommend running twice, rebooting between each run.
here's a link to the mcpr.exe and documents at McAfee's website: How to uninstall or reinstall supported McAfee products using the Consumer Products Removal tool (MCPR)
3) Reinstall McAfee.

i prefer Norton myself.

 

[Golden]

Hi,

If this is a newer variant of the Sirefef malware, you are strongly advised to wipe your systems and install from scratch:

For wiping previous installations:
http://www.sevenforums.com/tutorials/52129-disk-clean-clean-all-diskpart-command.html

For retail Windows 7 installations:
http://www.sevenforums.com/tutorials/1649-clean-install-windows-7-a.html

For OEM (pre-installed) Windows 7 installations:
http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html

Regards,
Golden