3 ms·
CPU miner malware?
I found my computer using 100% cpu (on all 8 threads)... I think I found the culprit: cpm.exe.
Apparently, somehow, someone installed a cpu mining program on my computer that only works when the computer is idle. If not for the cpu desktop widget, I wouldn't have noticed it!
Here's the configuration file, in case we can stop this upstream on bases of fraud:
C:\Users\Avi\AppData\Roaming\cpuminer:
cpm.exe
cpuminer-conf.json
cpuminer-uninst.exe
msvcr120.dll
Conf reads, but poolminer.net doesn't resolve.
{
"api-bind" : "0",
"url": "stratum+tcp://pool22.poolminers.net:2844",
"user" : "miner",
"pass" : "X",
"algo" : "cryptonight",
"on-idle" : 30,
"on-idle-low" : 30,
"background" : true,
"quiet" : true
}
- chapeuxGris 10y agoThese tools should tell you 98% of what this .exe is doing! Rootkit Analysis Tools Collection by usb http://www.filedropper.com/rootkitanalysistools http://www.filedropper.com/rootkitanalysistools Process Monitor v3.2 https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx https://technet.microsoft.com/en-us/sysinternals/processmoni... Process Explorer v16.12 https://technet.microsoft.com/en-us/sysinternals/processexplorer.aspx https://technet.microsoft.com/en-us/sysinternals/processexpl...
- deleted 10y ago[deleted]
- yosoyoso 10y agoi hope this help https://toolslib.net/downloads/viewdownload/1-adwcleaner/ https://toolslib.net/downloads/viewdownload/1-adwcleaner/
- _RPM 10y agoHave you considered switching operating systems if you're the least bit concerned about malware?
- mod 10y ago$ nslookup pool22.poolminers.net Server: 192.168.0.1 Address: 192.168.0.1#53 Non-authoritative answer: Name: pool22.poolminers.net Address: 66.117.6.5