Question FONDUE.exe constantly popping up

[tomshardwareuser7]

This FONDUE.exe window keeps popping up:

https://imgur.com/a/QRCyef1

View: https://imgur.com/a/QRCyef1


Any ideas what it is?

Thanks

 

[tomshardwareuser7]

ok thanks will check.

 

[tomshardwareuser7]

Found it C:\Users\micro\AppData\Local\Rocard.exe

It wasn't in either of the Startup folders @ex_bubblehead linked to, however that required me to Show Hidden Files which opened it up

It plays audio adverts in the background, so assume it's Malware

I deleted it, but then it reappeared here: C:\Users\micro\AppData\Local\Temp\nsuDC8D.tmp\Rocard.exe

AVG or Malwarebytes didn't pick this up, so no idea what else to do apart from a clean install, the ISO is a direct download from Windows created with Rufus.

 

[Colif]

try running this - https://www.bitdefender.com.au/solutions/free.html

or https://www.hitmanpro.com/en-us

I figured it must be malware since no one can find it on Google.

 

[tomshardwareuser7]

try running this - https://www.bitdefender.com.au/solutions/free.html

or https://www.hitmanpro.com/en-us

I figured it must be malware since no one can find it on Google.

Thanks, both installers halt because of no internet connection. Despite my internet working fine

https://imgur.com/a/2vEl1ES

View: https://imgur.com/a/2vEl1ES


Could it be the malware stopping them ?

EDIT: Disable Windows defender and they're installing now

 

[tomshardwareuser7]

Both apps found no threats - Literally as ads were playing 😂

Time to do a clean install?

Pretty crazy really, I did everything by the book

 

[Colif]

before you do, can you copy the exe onto here, curious what it shows
https://www.virustotal.com/gui/home/upload

 

[tomshardwareuser7]

https://www.virustotal.com/gui/file/3dc429511a6332648feb35a04892a56423a585408519f700de47671a53543da3

 

[tomshardwareuser7]

https://www.virustotal.com/gui/file/3dc429511a6332648feb35a04892a56423a585408519f700de47671a53543da3

Going by that, maxsecure seems like the best option

 

[Colif]

its a new or rare trojan you got there.

Maxsecure is an indian AV company so they might have just run into it first.

guess you need to clean install.

 

[tomshardwareuser7]

lucky me

Thanks very much for your help

Quite the introduction to Windows for me this was

 

[Colif]

Um, yeah, irony, Move from Mac to windows and get a trojan. Not nice

It isn't normal really, I never had a virus installed but I have found one uninstalled on an old folder before. Close calls.

On another PC, download the Windows 10 media creation tool and use it to make a win 10 installer on USB

boot from installer

follow this guide: https://forums.tomshardware.com/faq/how-to-do-a-clean-installation-of-windows-10.3170366/

reinstalling windows is easy part, getting all the applications takes time.

Your results just show that the safest security system is between your ears. All the ones that didn't find that file are normally at top of the list on AV tests, so they can't protect you from new files or yourself.

I have bitdefender and malwarebytes installed, neither would see that file. I also use Ublock Origin on all my browsers to stop me even going to sites that might give me those files.

name of file doesn't really mean anything when it can be renamed.

 

[tomshardwareuser7]

Um, yeah, irony, Move from Mac to windows and get a trojan. Not nice

It isn't normal really, I never had a virus installed but I have found one uninstalled on an old folder before. Close calls.

On another PC, download the Windows 10 media creation tool and use it to make a win 10 installer on USB

boot from installer

follow this guide: https://forums.tomshardware.com/faq/how-to-do-a-clean-installation-of-windows-10.3170366/

reisntalling windows is easy part, getting all the applications takes time.

Thanks - Would it be safe to create the installer on this computer ?

 

[ex_bubblehead]

Thanks - Would it be safe to create the installer on this computer ?

No. It's compromised and there's no way of knowing (likely yes here) whether or not the malware will propagate to a new machine via any installation media you create on it.

 

[Anna_Banana031]

Hey all I had the exact same problem except mine says Bolan.exe in the additional error message....It's given me Grey hairs before 30 😔

 

[USAFRet]

Hey all I had the exact same problem except mine says Bolan.exe in the additional error message....It's given me Grey hairs before 30 😔

Please start a NEW thread for your particular situation.

This one is a year old.