Search the Community

What is OSDSoft?The Malwarebytes research team has determined that OSDSoft is a crypto currency miner. These miners are designed to earn cryptocurrency by using system resources.This particular one is a so-called XMRig (Monero) miner.How do I know if my computer is affected by OSDSoft?You may see a file called explorer.exe with this icon:How did OSDSoft get on my computer?Miners use different methods for distributing themselves. This particular one was installed by a bundler.How do I remove OSDSoft?Our program Malwarebytes can detect and remove this miner. Please download Malwarebytes to your desktop. Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program. Then click Finish. Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu. If another update of the definitions is available, it will be implemented before the rest of the scanning procedure. When the scan is complete, make sure that all Threats are selected, and click Remove Selected. Restart your computer when prompted to do so. Is there anything else I need to do to get rid of OSDSoft? After the reboot you can remove the OSDSoft entry from your list of installed Programs and Features if it belonged to the Trojan. How would the full version of Malwarebytes help protect me?We hope our application and this guide have helped you eradicate this trojan.As you can see below the full version of Malwarebytes would have protected you against the OSDSoft trojan. It would have warned you before the trojan could install itself, giving you a chance to stop it before it became too late. and we block the domain that hosts the coin-miner(s): Technical details for expertsPossible signs in FRST logs: (www.xmrig.com) C:\Users\{username}\Desktop\explorer.exe C:\Users\{username}\AppData\Local\Temp\explorer.exe Malwarebytes log: Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 10/24/18 Scan Time: 9:10 AM Log File: eec5bf1f-d75b-11e8-a940-00ffdcc6fdfc.json -Software Information- Version: 3.6.1.2711 Components Version: 1.0.463 Update Package Version: 1.0.7497 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {computername}\{username} -Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 238151 Threats Detected: 2 Threats Quarantined: 2 Time Elapsed: 2 min, 37 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 0 (No malicious items detected) Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 0 (No malicious items detected) File: 2 RiskWare.HeuristicsReservedWordExploit, C:\USERS\{username}\APPDATA\LOCAL\TEMP\EXPLORER.EXE, Quarantined, [5758], [293543],1.0.7497 Trojan.BitCoinMiner, C:\USERS\{username}\DESKTOP\EXPLORER.EXE, Quarantined, [553], [583341],1.0.7497 Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end) As mentioned before the full version of Malwarebytes could have protected your computer against this threat.We use different ways of protecting your computer(s): Dynamically Blocks Malware Sites & Servers Malware Execution Prevention Save yourself the hassle and get protected.

explorer.exe found in AppData/Local/Temp explorer.zip mbam_report_2018-02-08.txt

Hi! I recently got a virus that shows about 50 explorer.exe files on my processes section. I had Avira and scanned my computer with it, but no luck. Then I got Malwarebytes, and it detected 6 unwanted programs. I logged on to my profile, but the virus was still there! I then got Kaspersky, and it didn't detect anything. I was wondering if any of you could help me? PLZ!!

I have the paid version of 3 on my desktop. I downloaded trial version for my laptop. The trail cleaned a few PUPs out. On Laptop, while while using Windows Explorer, I get MB popups stating that it blocked outbound to such places as "click.smytratrafficfilter.com", "clicksgear.com", "popcash.cnet" and more similar toilet-sites. Details show it to be from "C:\windows\sysWOW64\explorer.exe" each time. I have manually scanned explorer.exe with MB and Norton, both OK. I removed the HDD from the laptop and attached as slave to desktop (yes I can) and scanned it with paid version of desktop MB. Nothing there. Scanned with Norton as well - OK. Any ideas? o

Hello Malwarebytes folks, I unfortunately have downloaded some russian software and it installed ALOT of things on my computer one of them being explorer.exe high cpu usage What i have noticed till now : explorer and many services cpu usage after i installed the thing also some unnamed services in task manger when i click open location it direct me to explorer.exe. Fake Chromium install in roaming local folders in C drive with alot of python files etc.. Many folders and files are created in roaming and temp folders randomly named and have cpu usage in task manger. (Tried deleting the files but something generates them even if offline. Some of the text on explorer ribbon and tabs is missing. I can follow any procedure provided while being offline on the infected laptop and download anything from android/linux device and copy it to the infected laptop via usb.