I have a bad feeling about this one...

SunnyD

Belgian Waffler
Jan 2, 2001
32,674
146
106
www.neftastic.com
I hopped on this afternoon to determine what damage the wife and I had done to the bank account after Christmas shopping... and for some odd reason today FireFox would hang and I could immediately hear the hard drive start churning. Crash dump maybe? But no instant windows message notifying as such. Hmm...

Immediately I check the task list as well as AntiVir... AntiVir is happy as a pig. The task list shows this entry for BeepApp.exe. I dig... it has no properties and is hiding itself in the SysWOW64 directory. It doesn't appear to be a service. Google turns up only a few pages of hits, most being foreign, pretty much all asking "What is BeepApp.exe?" No one seems to know.

Kill the process. Hello... it takes a second and comes back with a vengeance. Hrm... Open up the hex editor and look for a string table or constants list, nothing. Looking at the import symbol table, that gets scary... it's importing things like GetUserCP, CreateThread, CreateMutex, among other things like virtual memory functions. This can't be good.

Search the registry... nothing except the MRU entries from me looking for it, as well as a lone entry in the SharedDLL section. Now what is BeepApp.exe doing as a shared DLL? And why is FireFox locking up ONLY at my bank account all of a sudden?

So, armed with just about nothing (and an impending reinstall of Vista come Phenom II), I take a gamble (after exhausting a bunch of other resources like disabling services and whatnot), I open up task manager & explorer and attempt to delete the offending file. Interesting... it catches the process as "in use" the first time. End process again and quickly hit try again, and away the file goes. Lucky.

Afterwards, a reboot later no service/runtime errors, and I can log into my bank account in FireFox again.

So long story short... anyone have any idea what BeepApp.exe is? :)
 

mechBgon

Super Moderator<br>Elite Member
Oct 31, 1999
30,699
1
0
You might want to upload a copy of the file to VirusTotal.com for analysis, and/or upload it to Sunbelt's sandbox at http://www.sunbeltsoftware.com...per/Sunbelt-CWSandbox/ to see what it does there. If you want to send me a copy, I could run it in a VM and see if it'll do anything interesting. If so, put it in a Zip file and email it to mechbgon originpoint com.
 

SunnyD

Belgian Waffler
Jan 2, 2001
32,674
146
106
www.neftastic.com
Originally posted by: mechBgon
You might want to upload a copy of the file to VirusTotal.com for analysis, and/or upload it to Sunbelt's sandbox at http://www.sunbeltsoftware.com...per/Sunbelt-CWSandbox/ to see what it does there. If you want to send me a copy, I could run it in a VM and see if it'll do anything interesting. If so, put it in a Zip file and email it to mechbgon originpoint com.

(Un)fortunately it is now gone. When I deleted it, that was the only copy present on the system. It doesn't appear to have taken anything down with it either.

The only saving grace is that in hitting up google, one of the translated pages mentioned that their Vista 64 system had that file as well. So it just might supposed to be there.