[SOLVED] I have a miner that is not detected by any scanner programs

Feb 4, 2022
8
0
10
I recently did a scan on my pc after a large group of downloads using malwarebytes, it detected and deleted a couple miners, although my GPU is still 100% busy when task manager is not open, i tried downloading process hacker, but this miner seems to dodge it as well
Please help
My hardware:
Processor: AMD Ryzen 5 3600(3,6GHz)
GPU: RX 5700
16 GB RAM
Software:
Windows 10 Pro, ver. 21H1, build:19043.1466
 
Last edited:
Solution
Drive space is cheap, software is free and easy.
There is NO reason to lose data from something like this.

Not much different than if that physical drive had died yesterday. They do that.
Feb 4, 2022
8
0
10
Update your post to include full system hardware specs and OS information.,

= = = =

Also look in Resource Monitor to see what else may be going on....

Try Process Explorer (Microsoft, free).

https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

Process Explorer may be able to reveal what is running.
Ok, just updated my post and downloaded Process Explorer, it seems that Process Explorer CAN actually detect it, i'll attach a couple of screenshots below
It is named powershell.exe and has a child process named conhost.exe
Howerer, i can't do anything with it, as it has absolutely no information on it's directory whatsoever when i try to inspect it through Process Explorer
How can i get to it?


Screenshot
 

USAFRet

Titan
Moderator
Ok, just updated my post and downloaded Process Explorer, it seems that Process Explorer CAN actually detect it, i'll attach a couple of screenshots below
It is named powershell.exe and has a child process named conhost.exe
Howerer, i can't do anything with it, as it has absolutely no information on it's directory whatsoever when i try to inspect it through Process Explorer
How can i get to it?


Screenshot
powershell and conhost.exe are not necessarily bad. They are a part of Windows.

Now....they may have been hijacked by whatever malware you installed.
 
Feb 4, 2022
8
0
10
powershell and conhost.exe are not necessarily bad. They are a part of Windows.

Now....they may have been hijacked by whatever malware you installed.
Yeah, i just know it's them because when i open Process Hacker and my GPU is at 100%, these two processes are rapidly closed, and then GPU is down to normal again
The miner seems to be detected only by Process Explorer(By that i mean that these two processes don't exterminate themselves when it is opened)
 

USAFRet

Titan
Moderator
Given that, your best option might be to revert to a previous Restore point, or whatever full drive backup method you use.
Sometime before this download and infection.
Or, a full wipe and reinstall.

Since your AV and MWB found some things and 'cleaned', and you still have this process acting up....what else might be in there, currently undiscovered?
 
Feb 4, 2022
8
0
10
Given that, your best option might be to revert to a previous Restore point, or whatever full drive backup method you use.
Sometime before this download and infection.
Or, a full wipe and reinstall.

Since your AV and MWB found some things and 'cleaned', and you still have this process acting up....what else might be in there, currently undiscovered?
I'm afraid that if i dont find a solution for this, a reset is the only thing i will be able to do, which is quite problematic because of the number of files that i will be forced to lose :(
 

USAFRet

Titan
Moderator
I'm afraid that if i dont find a solution for this, a reset is the only thing i will be able to do, which is quite problematic because of the number of files that i will be forced to lose :(
A reinstall, or whatever, should never ever result in loss of data.

Backups are your friend.

I have 6x physical drives in my current system.
Right now, if any of them were to fail, or I have to do a full wipe and reinstall (actually a recovery), of ALL of them...The most I might lose is whatever I did between midnight and Now().
 
Feb 4, 2022
8
0
10
A reinstall, or whatever, should never ever result in loss of data.

Backups are your friend.

I have 6x physical drives in my current system.
Right now, if any of them were to fail, or I have to do a full wipe and reinstall (actually a recovery), of ALL of them...The most I might lose is whatever I did between midnight and Now().
Good for you, because i've never ever done a backup in my life, well, i guess i'll learn from my mistakes, but for now, my current data is a lost cause for sure, lmao
 
Feb 4, 2022
8
0
10
Why not start NOW?
Instead of before this potential wipe and reinstall.

Just don't bring in any of those "files" you downloaded recently.
The thing is, i don't actually know where this malware could sit, so i'm kinda suspicious of bringing any of my recent data to a copy
 
Feb 4, 2022
8
0
10
Drive space is cheap, software is free and easy.
There is NO reason to lose data from something like this.

Not much different than if that physical drive had died yesterday. They do that.
By the way, would you reccomend me to reinstall windows completely, or do a system reset in this situation?
 

USAFRet

Titan
Moderator
By the way, would you reccomend me to reinstall windows completely, or do a system reset in this situation?
Full wipe and reinstall.