i have found a coin miner laying around taking around 50% of my cpu causing 100% usage but i ended the proccess and it went back to normal
the filename was idk generated letters but i have gotten it on virustotal
i deleted the file sorry though
there was over 4 files of them
2 of them were from two days ago
and 1 of them was from a day ago
and 1 of them was today which is the one i uploaded it to virustotal
heres the virustotal analysis
i had this virus from about 3 days
so please take a look at the coinminer and register as a trojan.coinminer in your antivirus database please if you can
I found the file again
Everytime i start the computer
It makes another file of it but with different filenames in letters
It always drops itself at c:\windows\temp
It drops a file called zkl.exe and then a different generated file
this thing is a coinminer trojan
comodo please try to get rid of it
i will try to send the files to you guys to see whats wrong with it in comodo valkyrie
I analyzed the file myself
It was at a folder called c:\windows\ccc
It starts an executable named powermgmt.exe
Then starts loading the other files and loads the reg file that modifies registry to make it run at startup
Then it generates an executable and drops it at c:\windows\temp
It was a trojandropper.dexel.a
Https://imgur.com/a/7k86mzp
This is inside the powermgmt.reg here
Https://imgur.com/a/pqemkl7
Idk how it happened
But i started rkill.exe
And it managed to find the exe and terminate it and then comodo starts detecting the ccc.exe files and quarantines them
I managed to clean myself from this coinminer trojan dropper
hxxps://www.dropbox.com/s/wt524j9qtyz6vm1/coinminers.7z?dl=1
heres the file if anyone wants to see it
the password is:dontopen
WARNING DONT OPEN THESE FILES
ONLY USE THEM FOR ANALYZING THEM OR TESTING THEM FOR EXAMPLE A VM
I obfuscated the url to dropbox as an extra security measure to make less experienced users think twice.
I also changed the all caps text to normal case.
OK thanks I was pretty mindless for using caps lock