[Resolved possibly undetected malware miners monero or any coins]

Hi Kevin,

Thank you for your reply, yes it was my desperate measure that I have to delete all those file because I saw them from process explorer ( I don't have the screenshot right now) that conhost.exe was running under wlanext.exe (so I assumed it was somekind of powershell script was running when windows called wlanext.exe).

For the high cpu usage 100% it will last long until I shutdown the computer and when I do shutdown the computer it said this application is preventing shutdown (noname application probably a malware script or malware program was running in the background), but right now it never show up again.

Hopefully it won't give me any trouble when I deleted those files.

Thank you

[Resolved possibly undetected malware miners monero or any coins]

Hi,

I just want to share a possibly new or undetected malware that resides in my windows 10, I really hate windows 10 because it has so many backdoors for malwares to use any methods for persistence inside the windows operating system, I wished I hadn't upgraded from my windows 8.1, First I detected possibly a malware from Task manager with 100% cpu usage and made my computer lagged, especially when I connected my laptop to an outlet. I use Process Explorer to see a conhost.exe to be called everytimes I rebooted my machine and look for the main process that called conhost.exe it happened to be wlanext.exe, devicecensus.exe and tiworker.exe (virustotal said its all clean, so strange) so many persistence programs used by the malware and I deleted all the programs right away and turned out it didn't harm my windows 10 operations, and I saw some services with strange ending such as OneSyncSvc_9036f2 and many more around 6 of them and I can not disabled them from services panel, so I deleted them all manually , I was using regedit.exe and right now my laptop is running smoothly with only 15% to 25% cpu usage.

If somebody can recognize what kind of malware is it please let me know, because I think the main script or powershell script is still running in the background but can't do any harm anymore (hopefully).

I hope this topic can help somebody else too