bgsvcgen.exe?

[alegator]

I have this process running in the background, is it necessary? If not, how to get rid of it? Thanks

[Ai Haibara]

Here's basically what I've found about it: http://www.processlibrary.com/directory?files=bgsvcgen.exe

An additional Google search (I use the above site to check on running processes, if I find one I'm not sure about) turned up much the same thing. Are you (or were you) using the "B's Recorder GOLD" program?

[alegator]

I checked the file and it's located in the c:\windows\system32 folder. I scanned it with NIS2005, NOD32, Spyware Doctor and Spysweeper and none of them report it as malware.
What concerns me is that I don't have any B.H.A. software products installed, so I don't know how this process sneaked in my system. I guess then that I can remove it. What would be the proper removal method?

[Bjs]

A: Check > start > program files , is it listed , the program "Bs Recorder GOLD"
B: Start > settings > control panel > add/remove , check list for program .

If in neither place , then its likely to be one of two things .

A: The program was installed , and not unistalled completely , at some point in time .
B: Some other , we dont want to guess , but we can test it to see .

Start with :

Hijackthis : http://www.spywareinfo.com/~merijn/programs.php
Direct : http://www.merijn.org/files/HiJackThis_v2.exe

Run > scan > Save log , pm it to me if you wish for anyalisis

----

Perform the following , in the exact order only .

Part 1 :

From the Desktop:
Start -> Run -> services.msc (press 'Enter')

In the right hand pane , find Bs rRecorder Gold (scrolling down if necessary)

Right click on it and select 'Properties'

In dialog window that opens, on the 'General' tab , make a note of the current Startup Type (we might need it later)

Using the pull down menu, change the Startup Type to 'Disabled'

Press 'OK'

Close all windows and reboot

This will keep the service from loading but will not physically remove it.

Re-enable is simply the opposite procedure

See how system responds for the time being , the next can be ignored if system remains stable .

----

Part 2 : Remove problem and its associated remnants using hijackthis .

Run HiJackThis and press the Scan' button

When the scan is finished , check any item refering to bgsvcgen.exe only , and click "fix checked"

Click the button "config" (lower right)

Click button "misc tools"
Click button "delete a file on reboot"
From here , browse to windows/system32 , and sellect the offender

System will now ask you to reboot

By default , hijackthis will backup the file , incase it needs to be restored later .

Note : Some may require this to be performed in safe mode .

----

Final :

It may also have found its way into system restore points , but if system appears stable , for the moment , I would not do the following .

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.

It's what you have to do sometimes when a real problem reappears for no reason (its not gone till system restore is killed off , and a complete new restore point is set) .

Should have it covered .

[alegator]

Wow, those are really complete instructions BJs! Thanks.
Anyway, I followed your steps, this is what I did:
1) Firstly, I have System Restore turned off
2) I went to Administrative Toools/Services and found the following service listed: "B's Recorder GOLD Library General Service" with the following description:"CD/DVDのリッピング、ライティングを管理します。(LibGen)" (some chinese letters) and it made reference to the following path:"C:\WINDOWS\system32\bgsvcgen.exe". The startup tyoe was in "automatic" and I changed it to "Disabled".
3) I rebooted
4) I ran HiJackThis and press the Scan' button
5) There was no line making any reference to "bgsvcgen.exe" so I did not check any of them.
6) I closed HiJackThis
7) Making a quick look at the registry with regedit I found this line:
HKEY_LOCAL_MACHINE\SOFTWARE\B.H.A
I also found several other lines that make reference to the process.
As an additional note, bgsvcgen.exe was no longer running in the background after reboot, as I disabled the service. BUt as you say it's still not physically removed. The file I can delete from the System32 folder but how can I remove it so the service is not listed under "Services"? Thanks.

[j4gg3rr]

It's installed with TMPGEnc DVD Author with DivX Authoring

[Bjs]

Think you might be wanting to play god on that one , but

1: Go to offending file .
2: Zip that file up , and move that zip to your windows main dir , as a backup .
3: Follow the step on the usage of hijackthis to delete the original back in system32 (system now needs to reboot) .

Check services after , it might be gone if lucky .

On the odd chance , if hijackthis failed to show it up , go to start > run , type REGEDIT , in new window , click the little pc icon at the top of the list , then Edit , Find , and enter it by name .

If anything is discovered , right click on the folder in the left pain and select "export" to back it up , call each instance in numerical order as they are discovered , prior to deleteing it . Those entries can be added back by simply clicking on those exported registry backups , should anything go pear shaped .

Be certain of registry entries .

If system instability of any kind is discovered after , boot into safe mode , and unpack the file to where it came from , and reboot , and add back the exported registry backups , as the problem file may be linked too deep into the os , and only a complete system reinstall will beable to resolve it .

Now that would be a pain .

----

We then move onto " playing with fire" , if you follow this info , which is something related to this particular task , put your head between your knees , and hold your breath , oh , and pray like theres no tomorrow .

It is important that users have a backup image of their system before attempting to play about here , as this is a task with its own trappings .

http://svn.collab.net/repos/svn/trunk/notes/windows-service.txt

Dont hold me on that one , you do that at your own risk , make a system restore image , in your case , I'd say right about .... now .

----

Do not attempt this on any "dedicated system service" , or that backup image will be worth pure gold , and no one will get upset with you , as the system backup only takes a few minutes to return the system to prior state .

Drive backup images are your best bud , and the best defence against complete , well , stupidity , so make 2 of them , you know what cd / dvd media is like .

I highly recommend you backup all important data , just to be completely safe to a seperate disc set .

Ie favs , outlook express folder (system hidden) , photos , movies , music , you name it .

----

Remember , I did say it would hurt , if it gose pearshaped .

----

Edit : j4gg3rr

We will need to see if others can report the same , until then .

[alegator]

BJs, I got lost when you mentioned that link. If I understand correctly svnserve is a utility to install or uninstall any particular service in the Services listing? If so, what you're saying is that using this utility is very risky in that it might deeply damage the OS forcing me to reinstall it? (of course if I did not back it up).
And lastly, given that now the task is not running anymore in the background since the associated service is disabled, is it worth trying to physically uninstall it? I mean, how does it hurt my system leaving things as they are now? Thanks.

It's installed with TMPGEnc DVD Author with DivX Authoring

I did install TMPGEnc DVD Author with DivX Authoring. SO uninstalling it will remove this service too?

[j4gg3rr]

I supose it would uninstall when uninstalling TMPGEnc DVD Author.
But why? It only uses 288KB running as a service.
I suggest you get used to the idea its OK now rather than later and forget about it.
http://www.bhacorp.com

[Xylob the Destroyer]

Description:
bgsvcgen.exe is a B's Recorder GOLD Service Library from B.H.A Corporation belonging to B's Recorder GOLD8

[Bjs]

If its confirmed , that nimwitt , tmpgenc dvd author with divx authoring , is responsible , then it should beable to remove the service entirely .

Though why it would contain it in the first place would be a question .

If the product is not installed , it should be reinstalled , then uninstall correctly , who ever done it .

However , should the problem remain , like I said , you do one of two things .

1: System remains stable = ignore it .

2: System instability = deal with it .

Personally its enough to be anoying , but , if tmpgenc dvd author with divx authoring was responsible , then it should be capable of removing the particular service , since it was involved with the install .

As I said , if it was indeed respossible , we wont talk of the other types here , just the legit item in question .

Because it behaves like the later , then the offending item its treated just like the sony root kit , the hell out of here .

----

As for that link , you only need to come down to about half way on the page , as SC.EXE , resides in the windows\system32 folder , and only needs to be activated using the parameters specified , and its gone .

Its a similar process to unregistering and re-registering ocx's and alike using regsvr32 , but has more drastic consequences .

[TheTinkeringToad]

Ok i confirmed that it is installed via tmpg DVD Author
From what i can tell it is used for the programs disc writing ability.
Though why they would include a product that is commercial rather then a autodetect script to use the writer you already have installed is a bit confusing.
Also they do not explain that they are isntalling a 3rd party app anyplace which is a bit annoying.
DVD author is a good program but for the price and lack of respect to the consumer about this issue and a few others, the price tag is a bit high for the inconvience of more programs on my system then i want.
Thumbs down for TMPG for this no go buy from me on this product from them.
Uninstalling the dvd author program should get rid of the program but to be honest i dont know.
Im quite sure there will be left over files and registry entries due to this.