Crazy Unknown Virus

Hey folks, a couple of weeks ago, my laptop started playing random adverts every 10 minutes or so. The adverts are not videos, but play through the speakers, and it's so damn annoying. I have searched the internet on many occasions to try to find out how to remove this random advert player. There is not a single piece of information on the internet regarding this virus. When the advert plays, I open task manager and the advert player is called "FormsApp" and when I open the file location the program is called "Mcduff". The Mcduff program is located in program files x86 in the hidden folder Calc. I have tried to open the exe file Mcduff but nothing happens. I have even installed Revo Pro Uninstaller in an attempt to remove the program, but the program does not exist in Revo, even when I search the hidden programs. The Mcduff program also does not exist in the control panel and it does not exist in CMD when I search all installed programs. This is the most dodgy virus or whatever it may be that I have come across...there is literally no information on the internet regarding Mcduff.

 

I have attached two photos. One of the FormsApp in task manager and one of the Mcduff in it's file location.

 

I would appreciate if someone could please help me and offer some advice.

 

Thanks for your time!

Greetings TheSun369 and to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

===================================================

Ground Rules:

• First, please keep in mind most of us at BleepingComputer volunteer our assistance for your benefit in your time of need. Please try to match our commitment to you with your patience toward us.
• It is important to not run any tools or take any steps other than those I will provide for you.
• Please perform all steps in the order they are listed. If things are not clear or you experience problems be sure to stop and let me know.
• Please copy and paste all logs into your post unless otherwise requested.
• When your computer is clean I will let you know, provide instructions to remove tools and reports, and offer you information about how you can combat future infections.
• If you do not reply to your topic after 5 days I will assume it has been abandoned and I will close it.

===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and let me know.

Thank you for your patience thus far.

Please do this.

===================================================

Farbar Recovery Scan Tool (FRST)

--------------------

• Download Farbar Recover Scan Tool for 64 bit systems and save it to your Desktop. <<< Important
• If your computer language is other than English right click on the FRST64 icon and rename it to FRST64english
• Right click on the icon and select Run as administrator
• Note: If you receive any warning about the download it is a false positive and you can ignore it
• Click Yes to the disclaimer
• Click Scan and allow the program to run
• Click OK on the Scan complete screen, then OK on the Addition.txt pop up screen
• 2 Notepad documents should now be open on your desktop.
• Please copy and paste the contents of each report in separate reply windows

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• FRST.txt
• Addition.txt

Thank you very much for the help. Here are the results from the scan.

 

First -

 

Greetings.

It is my pleasure to help clean your computer.

Please consider and do this.

===================================================

Peer to Peer (P2P) Warning

--------------------

Going over your logs I noticed that you have Peer 2 Peer (torrent) program(s) installed. It is pretty much certain that if you continue to use P2P programs, you will get infected again.

• Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
• They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
• Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
• The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

I would recommend that you uninstall Peer 2 Peer programs, however that choice is up to you. If you choose to remove the program, you can do so via Start > Control Panel > Add/Remove Programs.

If you are still leaning toward using this program, please take a look at this information about CryptoLocker Ransomware, a type of Ransomware which can be delivered via P2P file transfers. The newest variation of Ransomware can make it impossible to recover the files this malicious software encrypts. In other words, you will probably lose most if not all of your valuable information, including pictures. In addition it has recently been reported that P2P downloads may be tracked resulting in your IP address being monitored by copyright authorities.

If you wish to keep it, please do not use it until we are completely done and your machine is determined to be clean and updated.

===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST will do it for you

Start::
CreateRestorePoint:
CloseProcesses:
HKLM\...\Run: [Peso] => C:\Program Files (x86)\Sacrificed\Mcduff.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyftgbnhyotgbnhyntgbnhyttgbnhyetgbnhyntgbnhyotgbnhyttgbnhystgbnhyutgbnhy. (the data entry has 116 more characters). (No File)
HKLM\...\Run: [Calligraphic] => C:\Program Files (x86)\pushkin\Baroda.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyftgbnhyotgbnhyntgbnhyttgbnhyetgbnhyntgbnhyotgbnhyttgbnhystgbnhyutgbnhy.tgb (the data entry has 113 more characters). (No File)
HKLM\...\Run: [Altarpiece] => C:\Program Files (x86)\Calc\Mcduff.exe [315392 2022-05-27] (Dell) [File not signed]
HKLM-x32\...\Run: [Kobler] => C:\Program Files (x86)\Sacrificed\Mcduff.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyftgbnhyotgbnhyntgbnhyttgbnhyetgbnhyntgbnhyotgbnhyttgbnhystgbnhyutgbnhy. (the data entry has 116 more characters). (No File)
HKLM-x32\...\Run: [Whited] => C:\Program Files (x86)\pushkin\Baroda.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyftgbnhyotgbnhyntgbnhyttgbnhyetgbnhyntgbnhyotgbnhyttgbnhystgbnhyutgbnhy.tgb (the data entry has 113 more characters). (No File)
HKLM-x32\...\Run: [Breakaways] => C:\Program Files (x86)\Calc\Mcduff.exe [315392 2022-05-27] (Dell) [File not signed]
HKU\S-1-5-21-466771246-433639398-4200461963-1001\...\Run: [Ephesus] => C:\Program Files (x86)\Sacrificed\Mcduff.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyftgbnhyotgbnhyntgbnhyttgbnhyetgbnhyntgbnhyotgbnhyttgbnhystgbnhyutgbnhy. (the data entry has 116 more characters). (No File)
HKU\S-1-5-21-466771246-433639398-4200461963-1001\...\Run: [Eros] => C:\Program Files (x86)\pushkin\Baroda.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyftgbnhyotgbnhyntgbnhyttgbnhyetgbnhyntgbnhyotgbnhyttgbnhystgbnhyutgbnhy.tgb (the data entry has 113 more characters). (No File)
HKU\S-1-5-21-466771246-433639398-4200461963-1001\...\Run: [Carborundum] => C:\Program Files (x86)\Calc\Mcduff.exe [315392 2022-05-27] (Dell) [File not signed]
HKU\S-1-5-21-466771246-433639398-4200461963-1001\...\Run: [Typical] => C:\Program Files (x86)\Sacrificed\Mcduff.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyftgbnhyotgbnhyntgbnhyttgbnhyetgbnhyntgbnhyotgbnhyttgbnhystgbnhyutgbnhy. (the data entry has 116 more characters). (No File)
HKU\S-1-5-21-466771246-433639398-4200461963-1001\...\Run: [Fraternally] => C:\Program Files (x86)\pushkin\Baroda.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyftgbnhyotgbnhyntgbnhyttgbnhyetgbnhyntgbnhyotgbnhyttgbnhystgbnhyutgbnhy.tgb (the data entry has 113 more characters). (No File)
HKU\S-1-5-21-466771246-433639398-4200461963-1001\...\Run: [Outsold] => C:\Program Files (x86)\Calc\Mcduff.exe [315392 2022-05-27] (Dell) [File not signed]
HKU\S-1-5-21-466771246-433639398-4200461963-1001\...\MountPoints2: {a99b2bfb-c05d-11ec-910a-e8039af622b8} - "D:\startme.exe"
Startup: C:\Users\joshu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wombats.lnk [2022-05-27]
Startup: C:\Users\joshu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wombatswombats.lnk [2022-05-27]
Task: {06A484BD-7E5A-44A6-AD7B-EFDB932CE9A2} - System32\Tasks\0k6huw\8kstn4\44vljz\3y3yj8\9tj2xw\ym1w9e\yd7iut\gwzw10\lr01r4\9ngzox\u6uet2\lqmptk\rmthwh\90oyp7\vzmki2\6yj4f5\6tx0rk => C:\Program Files (x86)\pushkin\Baroda.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyftgbnhyotgbnhyntgbnhyttgbnhyetgbnhyntgbnhyotgbnhyttgbnhystgbnhyutgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhypn2be0be2btgbnhye2be0gn5gntgbnhy2pn7pnbeastgbnhypngjZmJpLltgbnhyc3ocXhRvU0tgbnhy0" (No File)
Task: {2F9DEE8E-FE12-405C-AF6A-81E94B65FAE3} - System32\Tasks\ddf30l\sq4cml\a9f6eg\1jh7ae\jydlov\nzoqzo\24qijf\5nmpax\no7il6\5gcqkm\y9tkh3\6e33fi\btci11\h6zxyp\a0wx3q\5dppmp\3l0yak => C:\Users\joshu\AppData\Local\Mcduff.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyftgbnhyotgbnhyntgbnhyttgbnhyetgbnhyntgbnhyotgbnhyttgbnhystgbnhyutgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhypn2be0be2btgbnhye2be0gn5gntgbnhy2pn7pnbeastgbnhypngjZmJpLltgbnhyc3ocXhRvU0tgbnhy0" (No File)
Task: {3A960624-4962-47AE-B506-A450CD248BB2} - System32\Tasks\pk4i5r\5rshj5\c0q553\u2cqn3\yqhd76\m3qmqo\ulejgh\kdc9na\khso82\nopsgz\7uy0fn\fitb6y\9h6o7x\d1az1x\4vtlq7\981gem\ift3w4 => C:\Program Files (x86)\Sacrificed\Mcduff.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyftgbnhyotgbnhyntgbnhyttgbnhyetgbnhyntgbnhyotgbnhyttgbnhystgbnhyutgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhypn2be0be2btgbnhye2be0gn5gntgbnhy2pn7pnbeastgbnhypngjZmJpLltgbnhyc3ocXhRvU0tgbnhy0" (No File)
Task: {4EF2661C-6B28-457E-8DA6-B59CA21D7701} - System32\Tasks\wfwm1m\xo3dpi\9gzuol\4mldqh\lrg1sa\dcaood\urhkcl\6znouq\0wygvb\bkrm8s\91foap\xj4qgd\ulworh\5dz6fa\vkfbcp\b5f6ea\rtcs2r => C:\Program Files (x86)\Sacrificed\perlite.exe (No File)
Task: {5930089C-B4A7-4010-B907-6580BAFBE2EA} - System32\Tasks\4cpzxp\58jjjo\i7zs9j\zbwys0\h4hwql\qxsfxq\trdd3i\jgy211\g3io60\5do6r5\75datd\o4a5sb\rybeoc\wzo8rn\m4lwma\xoykv1\vlho0k => C:\Users\joshu\AppData\Local\Baroda.exe [315392 2022-05-27] (Dell) [File not signed]
Task: {64CE9108-E016-46D9-A582-B8538AE9B84A} - System32\Tasks\acyewc\l32b80\61vvch\9obpgv\6xcbyc\3dexl2\xjrq9q\8q30t6\wfjajv\cfmhua\dojghf\6cchb2\g06ot2\hnfrcg\aqfe5v\xbl612\orqw9i => C:\Program Files (x86)\Calc\Mcduff.exe [315392 2022-05-27] (Dell) [File not signed]
Task: {80EA4776-7ADF-409E-90BC-FCEB167BCACF} - System32\Tasks\m4gneg\oa4vfg\mfbfps\c7t27l\nvqsag\d869kx\etdci6\eh2rtu\1qpmmi\8zdfpe\7idkub\2mjfy6\jajoai\egwqaj\3s8xca\kwh3rv\ezwzob => C:\Users\joshu\AppData\Local\Mcduff.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyftgbnhyotgbnhyntgbnhyttgbnhyetgbnhyntgbnhyotgbnhyttgbnhystgbnhyutgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhypn2be0be2btgbnhye2be0gn5gntgbnhy2pn7pnbeastgbnhypngjZmJpLltgbnhyc3ocXhRvU0tgbnhy0" (No File)
Task: {906878AE-2654-46BE-824B-0D0A1C35C94B} - System32\Tasks\93w2z1\ptsz81\yb9ade\t1j7gd\rdb5dq\992l6x\gihl6v\d19y6t\3pvnid\jfhioq\822ebn\x98bod\1m1nmp\gsvah5\207yg3\i3jbzz\ytgqb7 => C:\Program Files (x86)\Blemished\penniless.exe [63717 2022-05-27] () [File not signed]
Task: {95BF14C0-DC2B-4A81-B87F-7C01FD92CDAD} - System32\Tasks\66kzfz\nvm5df\ixxe6p\62t4nt\aoqs3g\zjraqo\qley8c\i4l6ir\522d9n\8txqaf\ffbt9z\194scc\zhi7pj\iadhul\6e69n6\t0xdfo\sjrem0 => C:\Users\joshu\AppData\Local\guido.exe [46184 2022-05-27] () [File not signed]
Task: {CC93B223-99DA-4540-8EA0-C7F63357BA31} - System32\Tasks\86arl1\9mf0zo\orcyoy\o42bbz\5x30h4\7jpd15\9xsr8y\47w1ov\q45fyt\7ibktu\uwyimz\axgwi5\ohu70n\sygf70\5spkif\0cug3q\b1draq => C:\Program Files (x86)\Calc\Baroda.exe [315392 2022-05-27] (Dell) [File not signed]
Task: {F9E20B1B-6812-4B5B-BF47-FAFA4240CC9C} - System32\Tasks\ej2pnm\beycey\9w9z57\rtt1hu\5nm0sv\ji82zs\0px8mm\1gsb8h\g5j5qy\h98fef\ujthj3\kct4ut\eqzzzf\8al05d\3ukawl\k8y9ch\ly0wc1 => C:\Program Files (x86)\pushkin\Baroda.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyftgbnhyotgbnhyntgbnhyttgbnhyetgbnhyntgbnhyotgbnhyttgbnhystgbnhyutgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhypn2be0be2btgbnhye2be0gn5gntgbnhy2pn7pnbeastgbnhypngjZmJpLltgbnhyc3ocXhRvU0tgbnhy0" (No File)
HKLM\...\StartupApproved\Run: => "Altarpiece"
HKLM\...\StartupApproved\Run: => "Peso"
HKLM\...\StartupApproved\Run32: => "Breakaways"
HKLM\...\StartupApproved\Run32: => "Kobler"
HKU\S-1-5-21-466771246-433639398-4200461963-1001\...\StartupApproved\StartupFolder: => "wombats.lnk"
HKU\S-1-5-21-466771246-433639398-4200461963-1001\...\StartupApproved\Run: => "MicrosoftEdgeAutoLaunch_8CFE0D2E897E6F5DD7117E6C430C171E"
HKU\S-1-5-21-466771246-433639398-4200461963-1001\...\StartupApproved\Run: => "Outsold"
HKU\S-1-5-21-466771246-433639398-4200461963-1001\...\StartupApproved\Run: => "Typical"
HKU\S-1-5-21-466771246-433639398-4200461963-1001\...\StartupApproved\Run: => "Carborundum"
HKU\S-1-5-21-466771246-433639398-4200461963-1001\...\StartupApproved\Run: => "Ephesus"
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
C:\Program Files (x86)\Sacrificed
C:\Program Files (x86)\pushkin
C:\Program Files (x86)\Calc
C:\Users\joshu\AppData\Local\Mcduff.exe
C:\Program Files (x86)\Blemished
C:\Users\joshu\AppData\Local\guido.exe
U4 Sense; no ImagePath
C:\Users\joshu\AppData\Local\Baroda.exe
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
cmd: netsh winsock reset catalog
cmd: netsh int ip reset C:\resettcpip.txt
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state ON
cmd: bitsadmin /reset /allusers
cmd: ipconfig /flushdns
Removeproxy:
hosts:
Emptytemp:
End::

• Click Fix
• When completed the tool will create a Fixlog.txt file located in the same directory as FRST64.exe . Please copy and paste the contents of the file in your reply.
• Note: This step resets your Firewall settings and you may be asked later to grant permission for legitimate programs to pass through the Firewall. If you recognize the program agree to the request.
• Note: The Emptytemp: command will remove cookies and may result in some websites (like banking) indicating they do not recognize your computer. It may be necessary to receive and apply a verification code.

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Fixlog
• Update on computer performance

Greetings,

===================================================

Do You Still Need Help?

It has been 3 days since my last post.

• Do you still need help with this?
• If you have not replied within 48 hours I will assume you have abandoned the Topic and it will be closed.

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.