Intruder Using My CPU to mine coins?

[HagbardCeline]

I have several computers on my home network.  One of them is an older computer that I use for a house server.  I jumped onto this computer a few days ago and found that my AVG had been disabled and there was a command box open that looked like this:

 

 

I re-ran the AVG installer and repaired it, then rebooted.  Then a day later this same thing happened again.  I did a full MBAM scan that came up empty, and HJT didn't turn up anything as far as I could tell either, but I ran both of them after I'd repaired AVG and rebooted.  Is there anything else I can run to see where this malware is hiding?  Any steps on the router side of things?

 

Thanks in advance. 

 

J

[kevinf80]

Hello and

 

P2P/Piracy Warning:

 

   

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Many common forms of DNS hijacker infections will infect router firmware. What we commonly tell people is to do the below.

If you have a router hooked up then you need to follow the instructions for your hardware and reset it to factory default settings. Normally there is a recessed push button type switch that needs to be held down for some number of seconds to do this. After resetting to factory defaults on your router, you will need to reconfigure the router for your network if you have made any changes to the default network setup.

 

Next,

 

Download Farbar Recovery Scan Tool and save it to your desktop.

 

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
  
• Press Scan button.
  
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
  

 

Kevin..

[HagbardCeline]

Thanks for the quick reply.  I used to have an account on here, but it was so long ago that it seems to be deleted. 

 

I'll run Farbar and post logs.  Has this replaced HJT as the log generator of choice?

[kevinf80]

HJT is outdated, If you read the stickies at the top of the forum DDS is listed as the preferred diagnostic scanner. I prefer FRST, hence I ask for those logs...

[HagbardCeline]

Well, problem solved.  I spotted some unusual autoruns and traced them back to a hidden folder with coin mining malware in it.  I suspect it was included in a package for an old driver package I was forced to download from an iffy site. 

[kevinf80]

Are we done, do you want this thread closed out?

 

Kevin....

[HagbardCeline]

Yes, please close the thread.  Thanks!

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!