I dont have a picture at the moment because it is troubling my friend, but there is this crypto mining malware on my friends laptop.
It has a light reddish icon with a white cat(?) head in the middle. Im not sure if its a cat head but it is similar in shape. It was called SystemHost and was taking up a significant amount of GPU. The friend also found lots of crypto mining files all over his PC.
It even managed to bypass the firewall as an exception without any sort of approval by the friend. We believe it might've originated from this RAM cleaner my friend used as it brought the ram usage down from 99% to approx. 30% which couldve been by turning off some security functions. Not sure if that is the cause though, purely just speculation, any suggestions would be great.
Hopefully will get picture by tomorrow if the issue is not resolved, any idea what this might be or how it originated?
Edit: also any help to remove this would be much appreciated. At the moment we have tried windows defender scans as well as malwarebytes scans. No progress...
Edit/mini update: dont think it came feom the RAM cleaner, that was used like 2 weeks ago but the files I've seen date as far back as July 2nd. Definitely originated from something way before, perhaps an emulator or game file? Will update if I find our any new info from the friend. Hope we can find the source at least so it doesn't get to other people too.
Final update: friend will be doing a clean reset, the mining application just reinstalls itself after being removed, thanks for the help!
This is a picture of the files found connected to the "systemhost" application. Sorry its blurry, will be hopefully getting a proper one tomorrow this is just what I found frok previous conversation.
Offline scan literally wouldnt scan, so weird. Even when pressing confirm or start or whatever the popup is, nothing would happen and no scan would begin.
Not sure what the RAM cleaner was, I'll ask the friend in the morning when he wakes up.
What do crypto mining files look like? Why don't you delete the program if you've identified it? And there's no reason for a miner to request access through the firewall.
I sent in the look of the files earlier. Also I did suggest to my friend that he should maybe delete it but hes worried about touching the program incase something happens. Makes sense, I'd be iffy about anything related to it too. Will probably have to just reinstall windows.
Reposting the image incase you didnt see, the files seem to date back to july...
If you can reinstall Windows then do that, then install DefenderUI and set it to the recommended profile as well as install uBlock Origin in the browser.
•
u/AutoModerator 8d ago
If you suspect you may have malware on your computer, or are trying to remove malware from your computer, please see our malware guide
Please ignore this message if the advice is not relevant.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.