CPU miner malware?
I found my computer using 100% cpu (on all 8 threads)... I think I found the culprit: cpm.exe.
Apparently, somehow, someone installed a cpu mining program on my computer that only works when the computer is idle. If not for the cpu desktop widget, I wouldn't have noticed it!
Here's the configuration file, in case we can stop this upstream on bases of fraud:
C:\Users\Avi\AppData\Roaming\cpuminer: cpm.exe cpuminer-conf.json cpuminer-uninst.exe msvcr120.dll
Conf reads, but poolminer.net doesn't resolve.
{ "api-bind" : "0",
"url": "stratum+tcp://pool22.poolminers.net:2844", "user" : "miner", "pass" : "X",
"algo" : "cryptonight",
"on-idle" : 30, "on-idle-low" : 30,
"background" : true, "quiet" : true }
5 comments
[ 4.0 ms ] story [ 23.4 ms ] threadRootkit Analysis Tools Collection by usb http://www.filedropper.com/rootkitanalysistools
Process Monitor v3.2 https://technet.microsoft.com/en-us/sysinternals/processmoni...
Process Explorer v16.12 https://technet.microsoft.com/en-us/sysinternals/processexpl...
Non-authoritative answer: Name: pool22.poolminers.net Address: 66.117.6.5