Endpoint Protection

I am seeing the following being installled on some of my clients' machines:
C:\WINDOWS\system32\chg.exe

I have done searches for it and I am getting conflicting results.  Does anyone know what it is?  Is it a virus or other malware?

I found a somewhat obscure thread on this specific .exe. The full thread can be found here http://www.wilderssecurity.com/showthread.php?t=194114.

The relavent part was:

"I got my suspicions after seeing from the logs that the OP over at MajorGeeks also had an HP computer. From what I understand chg.exe is responsible for launching PCAngel.exe when required. PCAngel is a rollback tool and is a part of the HP Protected Tools suite."

So are you seeing this .exe on HP computers???

Cheers
Grant

Upload that fie to http://www.virustotal.com/ and see what is the result of it.... 

 Upload the file to Symantec...

Use these urls based on support contract

https://submit.symantec.com/basic
https://submit.symantec.com/gold
https://submit.symantec.com/essential
https://submit.symantec.com/platinum
https://submit.symantec.com/bcs

We are a small systems integrator and have several customers with Symantec support contracts.  On the support certificate, there are all kinds of numbers, but no indication of what level of support we have.  I have called Symantec customer support in the past using the "RTSM ID / Support ID" number and gotten support with no problem.  How can I tell what level of support we have?

The various forms above ask for a "Contact ID"; however, nowhere on the Symantec suppport certificate (it is a PDF file) is there a "Contact ID"...there is a "Sales Order #", a "Symantec Agreement (SAN) #", a "Disti / Cust PO:", a "Resell:", a "Certificate #:", a "Customer Number:", a "Serial Number", a "Part #", and a "RTSM ID / Support ID"...is it any of these or something else entirely?

I submitted to virustotal.com, but I don't understand the results:
http://www.virustotal.com/analisis/9c6d16f0b9dd38d428fed13216793e8060798211669ad1f81990868f28420ee8-1259073881

What do the results indicate?  Is the file a problem or not?

But I am just wanting to make sure that it is not an a virus masquerading as something else.
.

 https://www-secure.symantec.com/connect/articles/online-virus-and-behavioural-scan-engines

Call support and ask for the Contact ID need for submission they will give to you..I symantec we used to get many calls for that ... :)
Or if you have any case number PM any Symantec Employee/Techincal Support they will be able to give it to you.

virustotal is reporting 0.0% of virus engines as having detected as a virus

Thanks to everyone for your help!