Re: strange file HBEPGUID.TXT in Security http://www.dslreports.com/forum/r20210334 en Mon, 06 Oct 2008 09:23:59 EDT Mon, 06 Oct 2008 09:23:59 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20223215 jarrycanada : I wasn't trying to be a smart ass or anything but I was checking my own writing with the little spell check button and ti doens't cathc a thin g... LOL]]> http://www.dslreports.com/forum/remark,20223215 Tue, 25 Mar 2008 14:45:16 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20222636 anon : Tehy hvae a splel cekcher hree? Did not konw taht. See you can raed tihs wtihuot porlebm. Why need slepl cehekcr? :)]]> http://www.dslreports.com/forum/remark,20222636 Tue, 25 Mar 2008 13:13:26 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20220280 jarrycanada : all that looks good Name Game, but symlcsvc.exe isn't running in the Task manager. it's set to Manual in services and but the program doesn't seem to be running. not sure if I should set that to automatic or just leave it. Hmmm

Hey thanks by the way for all of your help.

Plus anyone notice the spell checker doesn't work here.

added the next day, symlcsvc.exe now shows up like normal. I think it has something to do with clicking load auto-protect at system startup. what ever. hope that helps someone in the future. ]]> http://www.dslreports.com/forum/remark,20220280 Mon, 24 Mar 2008 23:21:10 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20219056 Name Game : I think that is correct and the two ccSvcHst.exe ... you can download a copy of hijackthis..and see what is running for symantec and also what else comprises the registry entires for all of it. Don't post the log..just see what is there.

Here is a typical log
»forums.whatthetech.com/baseline_···667.html

should see things like this in a typical log.

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\NPC\2.0\HSLoader.exe
C:\Program Files\Common Files\Symantec Shared\NPC\2.0\HSLoader.exe

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/]]> http://www.dslreports.com/forum/remark,20219056 Mon, 24 Mar 2008 19:51:38 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20218916 jarrycanada : Here is something interesting. when you do a install of NIS 2008 in task manager all that seems to run is two copys of ccSvcHst.exe. Did they kill off ccApp.exe and appSvc32.exe? for just two ccSvcHst.exe apps.?]]> http://www.dslreports.com/forum/remark,20218916 Mon, 24 Mar 2008 19:07:44 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20218026 Name Game :
said by jarrycanada See Profile :

Name game guy did you have that problem too?

What I can't really understand is why it doesn't do it on my xp pro pc and it does this on my Xp home ...

and what is ccSvcHst.exe and what does it do?
No not me..but saw this being moved during a cleaning of someones Log..

C:\Documents and Settings\Owner\Application Data\Install.dat moved successfully.
C:\Documents and Settings\All Users\Documents\ccErrDspLog.txt moved successfully.
C:\Documents and Settings\All Users\Documents\HBEPGUID.TXT moved successfully.
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/]]> http://www.dslreports.com/forum/remark,20218026 Mon, 24 Mar 2008 16:16:07 EDT Re: ccsvchst.exe http://www.dslreports.com/forum/remark,20217927 EGeezer : See here.
--
Mayors of New York come from nowhere and go nowhere.
Wallace Sayre (apparently, so do governors... )]]> http://www.dslreports.com/forum/remark,20217927 Mon, 24 Mar 2008 15:56:58 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20217744 jarrycanada : Name game guy did you have that problem too?

What I can't really understand is why it doesn't do it on my xp pro pc and it does this on my Xp home ...

and what is ccSvcHst.exe and what does it do? ]]> http://www.dslreports.com/forum/remark,20217744 Mon, 24 Mar 2008 15:20:02 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20216524 Name Game : All that makes sense now

C:\Documents and Settings\All Users\Documents\HBEPGUID.TXT moved successfully.

HBEPGUID.TXT -> %AllUsersProfile%\Documents\HBEPGUID.TXT -> [Ver = | Size = 49 bytes | Modified Date = 2008-02-25 22:09:33 | Attr = RHS]
Symantec -> %AllUsersProfile%\Documents\Symantec -> [Folder | Created Date = 2008-02-15 19:14:34 | Attr = ]
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/]]> http://www.dslreports.com/forum/remark,20216524 Mon, 24 Mar 2008 11:30:25 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20214600 EGeezer : Nice piece of detective work ! Sounds like another little Norton giftie.. ]]> http://www.dslreports.com/forum/remark,20214600 Sun, 23 Mar 2008 22:35:00 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20214562 jarrycanada : has nothing to do with my printer.
all bets are off now.

I was playing around with that tool anon101 told me to use. I deleted my copy of HBEPGUID.TXT and rebooted. Then I checked my shared folder again. Nothing, good. Then I ran File monitor and waited and waited. That was the hard part.

CCSVCHST.exe was creating this file. so I uninstalled norton and am waiting to see if this file will show up again. I think it has something to do with fact that my copy of norton is about to run out in a month or so so it has to report back home to make sure I am not stealing it.

Two hours file still hasn't shown up again.

I got a new copy sitting right here waiting to be installed. but thats another day. Too much fun with Norton Internet Security. One thing I love about norton is that you can never fully uninstall that app, you have to alwasy get that one little tool that does it for ya. ]]> http://www.dslreports.com/forum/remark,20214562 Sun, 23 Mar 2008 22:25:11 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20214407 DiscardedVet : I am by far not in the levels of some of the tech folks here, but I do hold my own.

One thing I do for suspicious files is time correlation. The time that file was created, correlate it with what Internet activity there was (history, IE cache, firewall logs, etc), as well as do a PC file search for files both created and accessed at the same time.

MANY times this action has brought me to a sound conclusion of what the file stems from.

Best of luck to ya :)

D-Vet
--
Bush is the Prez.... Think Patriot Act II.... This outspoken dissident.... In jail I'll be soon.]]> http://www.dslreports.com/forum/remark,20214407 Sun, 23 Mar 2008 21:48:23 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20213792 Name Game :
said by jarrycanada See Profile :

well I got both hehehe, that computer was my old computer so it had a epson rx700 and now it's got a hp printer. When I am done scanning it with microsoft live i'll try uninstalling all the printer drivers and see if that goes away.

I am sorry but I don't understand the birthday card thing.
And you may have never used that feature ;)

EPSON Stylus Photo RX700, EPSON RX700 Printer, EPSON C11C583001 ...You can even create photo greeting cards using your favorite photo and your own hand-written message.

»www.supermediastore.com/epson-st···ter.html

see also..
»www.google.com/search?hl=en&q=ep···G=Search
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/]]> http://www.dslreports.com/forum/remark,20213792 Sun, 23 Mar 2008 18:54:17 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20213612 jarrycanada : well I got both hehehe, that computer was my old computer so it had a epson rx700 and now it's got a hp printer. When I am done scanning it with microsoft live i'll try uninstalling all the printer drivers and see if that goes away.

I am sorry but I don't understand the birthday card thing.]]> http://www.dslreports.com/forum/remark,20213612 Sun, 23 Mar 2008 18:12:04 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20213602 Name Game : Maybe it is even Epson Printer

»www.google.com/search?hl=en&sa=X···&spell=1

What kinde of printer do you have and what software is installed for it?
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/]]> http://www.dslreports.com/forum/remark,20213602 Sun, 23 Mar 2008 18:08:43 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20213488 jarrycanada : I was thinking that too]]> http://www.dslreports.com/forum/remark,20213488 Sun, 23 Mar 2008 17:48:41 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20213274 jarrycanada : I ran that program but it's a little beyond my ability to understand it.]]> http://www.dslreports.com/forum/remark,20213274 Sun, 23 Mar 2008 17:03:45 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20213270 Name Game : Since at one time someone posted they also found with word BETTER OFF BirthDay in a HBEPGUID.TXT maybe it does have something to do with HP software packages that are installed by default on some of those installation disks that can make cards with your printer with either graphic or actual photos and text.

They even have on line places to do that..for consumer greeting cards.
»h30393.www3.hp.com/printing/app/···rds.aspx

But if the HBEPGUID really is a clue to why the text file was created..I was thinking along the lines of the episode guide site and what a user might download there..

»epguides.com/HeyPaula/
»www.tv.com/hey-paula/episode-7/e···ary.html

»epguides.com/WhostheBoss/

BETTER OFF BirthDay
»www.tv.com/whos-the-boss/better-···ary.html

but maybe the HB part is happy birthday..and the EP is printer

Good luck in the mystery ..sure would be nice to know what it is all these people have in common.
--
Gladiator Security Forum »www.gladiator-antivirus.com/
Missing Kids
»www.missingkids.com/]]> http://www.dslreports.com/forum/remark,20213270 Sun, 23 Mar 2008 17:03:29 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20213252 anon : I don't think you need to go to the extent of reloading OS. Maybe try something like file monitor with filtering to find out what is happening. I don't have this program so I don't know how to set it up. In any event, I would be curious as to what was happening before I reloaded new OS.

Filemon: »www.microsoft.com/technet/sysint···mon.mspx ]]> http://www.dslreports.com/forum/remark,20213252 Sun, 23 Mar 2008 16:56:26 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20213207 jarrycanada : I searched for HBEP and any of the set of numbers found nothing. I would think nothing of this file but what scares me is the folder I found it in. I run HijackThis all the time. I don't see anything new in there. getting to the point I am thinking about just reinstalling the os. sad part is the system runs fine. no strange error messages. no weired log files or anything showing up on my firewall logs. I nuked the IE internet folder and all the cookies. ]]> http://www.dslreports.com/forum/remark,20213207 Sun, 23 Mar 2008 16:45:28 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20210334 anon : well, it doesn't look too harmful. Judging from the name (HBEPGUID) seems like an ID of some sort along with a MAC address. Maybe they found a new way to set cookies?
I would tend to believe you have something running on your system that checks if the item is there, and if not rewrites it. Open Task Manager and see what is running. Kill any processes you don't know about. Check your startup programs. Most likely there is something in there that starts up with your system. Have you run a HijackThis? ]]> http://www.dslreports.com/forum/remark,20210334 Sat, 22 Mar 2008 23:46:06 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20210321 jimkyle : search the registry also for "HBEP" since this file is apparently storing a process-identifying GUID value together with the MAC of your network card. It quite well may be something innocent. However I would expect a search of the registry for just the GUID portion of the current file's content to have at least one hit, probably in the HKLM hive...
--
Jim Kyle]]> http://www.dslreports.com/forum/remark,20210321 Sat, 22 Mar 2008 23:43:39 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20210193 jarrycanada : anon101, I did open it with notepad. it just says

i've got two numbers so far.

278cd9b7-9f46-4742-9430-328be6c44b79|000E0CB14FC7
e8cd3a8e-073f-4bd2-a6cc-1173c7f30160|000E0CB14FC7

Damon85 is right the last number is my mac address. but the other numbers don't come up at all. I seached the drive and the registry now for them.]]> http://www.dslreports.com/forum/remark,20210193 Sat, 22 Mar 2008 23:16:21 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20210147 anon : It's a text (TXT) file. Open it with Notepad and see what it says. Probably "Happy Easter from the Easter Bunny". :D ]]> http://www.dslreports.com/forum/remark,20210147 Sat, 22 Mar 2008 23:06:56 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20210044 Damon85 : Just taking a stab in the dark, but that looks like a SID, a pipe, and then a MAC address. You might want to check those to see if they have any meaning to you. A good place to search for the SID might be to open up regedit and run a search for it -- that might at least lead you to more information about the origin of the file.

Edit: Sorry, I didn't mean SID but I forgot the actual name of them... At any rate, check in the registry to see if it exists there.]]> http://www.dslreports.com/forum/remark,20210044 Sat, 22 Mar 2008 22:45:15 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20209907 jarrycanada : just that number

e8cd3a8e-073f-4bd2-a6cc-1173c7f30160|000E0CB14FC7]]> http://www.dslreports.com/forum/remark,20209907 Sat, 22 Mar 2008 22:08:02 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20209793 Cudni : try filemon to track it
»technet.microsoft.com/en-us/sysi···642.aspx

what is inside the .txt file if anything?

Cudni
--
"Mercifully, he hit him with the soft end of the pistol."
Help yourself so God can help you.
Microsoft MVP, 2006-2007]]> http://www.dslreports.com/forum/remark,20209793 Sat, 22 Mar 2008 21:44:00 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20209777 jarrycanada : I've seen the cnet stuff already. I can't really find anything about that would create such a file. I've scanned my system with AVG, a-squared Free, Windows Defender, AVG Anti-Spyware 7.5, AVG Anti-Rootkit Free, Spybot - Search & Destroy, Ad-Aware 2007, list goes on system running normal. no strange out going connections.]]> http://www.dslreports.com/forum/remark,20209777 Sat, 22 Mar 2008 21:39:18 EDT Re: strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20209728 Cudni : check for malware/spyware using tools listed and if still have problems post in SCU forum
»Security Cleanup FAQ »Mandatory Steps Before Requesting Assistance

also see
»forums.cnet.com/5208-6142_102-0.···=2735652

edit: one further link
»www.castlecops.com/t217151-HBEPG···der.html

Cudni
--
"Mercifully, he hit him with the soft end of the pistol."
Help yourself so God can help you.
Microsoft MVP, 2006-2007]]> http://www.dslreports.com/forum/remark,20209728 Sat, 22 Mar 2008 21:30:31 EDT strange file HBEPGUID.TXT http://www.dslreports.com/forum/remark,20209670 jarrycanada : I found this strange file on one of my systems. here is the weird part it's just a .txt file but I found it in the C:\Documents and Settings\All Users\Documents\HBEPGUID.TXT whats srange about it is that if I delete it it just comes back in a number of hours. it's got this strange number in it that just keeps changing.

e8cd3a8e-073f-4bd2-a6cc-1173c7f30160|000E0CB14FC7

I've scanned my system all day and know a lot about computers but this one is just bugging the hell out of me. anyone ever seen anything like that before? or know what it may be ? ]]> http://www.dslreports.com/forum/remark,20209670 Sat, 22 Mar 2008 21:17:12 EDT