Sign in to follow this  
Followers 0
moltra

unkown PLC software

8 posts in this topic

I am working on a machine with a NT computer running some kind of PLC software. All the information I have is that when the PLC is started the following programs are started. bhwin.exe fkvisu.exe. Any help or information would be greatly appreciated.

Share this post


Link to post
Share on other sites
The two executables you listed are both related to spyware/malware. I doubt they have anything to do with the PLC software.

Share this post


Link to post
Share on other sites
They both are specificly ran by the system when it starts. This is straight from the factory. and when they are ran it says PLC starting. the machines are from Germany Here is the bat file that starts the PLC. @echo off rem del c:\logs\logfile.old >>NUL rem ren c:\logs\logfile.txt logfile.old >>NUL sleep 5 start .\bhwin.exe start .\fkvisu.exe rem start .\ComInterface.exe rem start .\fk_debug.exe Edited by moltra

Share this post


Link to post
Share on other sites
I wonder if you could open the programs in notepad or something and look for ASCII text.. Works most of the time when trying to figure out the contents of EPROMs anyway!

Share this post


Link to post
Share on other sites
In addition to being listed a possible spyware/malware. BHwin.exe also shows up as a runanble palm pilot application. http://nasoftware.com/Helperdocs/palmpilotinstall.html The good news is neither Symantec or Mcafee have any data on Bhwin.exe or FKvisu.exe in their spyware, malware, virus databases as of my search this morning.

Share this post


Link to post
Share on other sites
I used a program called Resource tuner and got the following: (I blanked out the company Name If anyone wants it PM me) Length Of Struc: 033Ch Length Of Value: 0034h Type Of Struc: 0000h Info: VS_VERSION_INFO Signature: FEEF04BDh Struc Version: 1.0 File Version: 1.0.0.12 Product Version: 1.0.0.12 File Flags Mask: 0.63 File Flags: File OS: WINDOWS32 File Type: APP File SubType: UNKNOWN File Date: 00:00:00 00/00/0000 Struc has Child(ren). Size: 736 bytes. Child Type: StringFileInfo Language/Code Page: 1033/1200 CompanyName: * FileDescription: Beckhoff/Windows//H42a/H42a FileVersion: 1, 0, 0, 12 InternalName: BHWin LegalCopyright: Copyright © 2005 LegalTrademarks: OriginalFilename: BHWin.EXE ProductName: Beckhoff/Windows//H42a/H42a ProductVersion: 1, 0, 0, 12 Child Type: VarFileInfo Translation: 1033/1200

Share this post


Link to post
Share on other sites
Beckhoff has a HMI solution called "TwinCat PLC HMI". Maybe the files are associated with that. Like I asked on the other forum: "Which PLC ?" Is the "PLC" a soft PLC running on said PC ? Beckhoff's TwinCat PLC is such a soft-PLC. Or is the "PLC" some other kind of "real" PLC ? Anyway, I think you have no chance to do anything with these files. With exe files you need the source file in order to change anything. Why are you asking about these files ? Edited by JesperMP

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0