Monroe coin mining Trojan horse generator

1. This trojan takes advantage of the "eternal blue" vulnerability to attack and spread in the local area network. It builds a robust botnet of the infected machine, supports the self-renewal of the intranet, and lurks in the computer for a long time to extract Monroe money. Because most ordinary personal computers have been patched by windows security update and Tencent computer manager and other security software, they are basically not affected by wanna miner. It is suggested that if the suspected wanna miner mining Trojan horse is found, the poisoned machine can be located and isolated in time. It can be judged by scanning port 26931. If the port is open, the host has been infected; If you need to patch the intranet, all the computers that have not been patched. It is suggested that professional terminal security management software should be installed in the whole network, such as Tencent Yudian. The administrator should carry out mass antivirus and patch installation for the whole network to avoid unnecessary losses.

2. Try Tencent computer housekeeper killing, antivirus management 2 in 1, Trojan horse killing upgraded to professional antivirus, killing more thoroughly; Integrated with jinshanyun killing engine and xiaohongsan local killing engine, the computer manager's own anti-virus engine can fully guarantee the effect of virus killing. In addition, the computer manager system repair engine can help users repair the system when system problems are detected.

3. You can install some anti-virus software on the computer, such as 360 security guard, and then keep it on all the time. In this way, you can prevent the virus from entering the computer. If it has been poisoned, use 360 first aid box to check it in the safe mode.

4. It is safe to use 360 to protect your computer and manage your Monroe on the largest digital asset platform in China

5. No
Monroe can solve these privacy problems by automatically applying confidentiality technology to every transaction. You can rest assured that you can't have a "contaminated" Monroe. This is an economic concept, called "interchangeability", historically considered to be an important feature of all currencies

6. Don't worry about this. 360 has automatic interception function
Mining Trojan horse is now in the limelight, and its gold sucking power is catching up with blackmail virus. Recently, 360 security guard intercepted a Monroe coin mining Trojan horse spread by "eternal blue". Due to carrying heavy attack ammunition, the Trojan horse spread a large amount, reaching 100000 times a day at the peak, and 360 recently intercepted more than one million attacks

it is understood that this is a large-scale attack of mining Trojan horse carrying "eternal blue" against ordinary Internet users. In order to prevent computers from becoming the coolie of hackers mining, 360 reminds Internet users to ensure that they are well patched and immune to all kinds of attacks using "eternal blue", and at the same time, 360 security guard is opened to comprehensively defend against all kinds of mining Trojan horse
.

7.

April 9, 2020 update reply, the problem has been solved, in the bottom of the answer

April 8, 2020:

although it has been a long time, but still answer, I recently encountered a similar problem, you may hit the Monroe coin mining Trojan horse, there is a cmdc.exe in the deep directory of Disk C, every time the mouse stops for a period of time, it will start to execute, The mouse disappears from the resource manager with the help of Microsoft's Process Explorer tool. We haven't found a solution yet. After deleting it, the mouse will be still for a while and the related files will be created again. The config file at the bottom indicates that it is generated by XmR stak, which can be found in network search

on April 9, 2020, the problem has been solved. It is estimated that it is a novice or novice of mining Trojan horse. After replying to this problem on April 8, the following actions have been continued:

1. according to the file creation time of cmdc.exe, if you use the directory where CMDC is located to open it directly with resource manager, you can't see any files, We can only use the advanced search function of tools to find the files created on the same day and two days before. We find that there is a cmdc.zip in the superior directory of cmdc.exe, in which the files related to cmdc.exe are deleted

2. according to the file creation time of cmdc.exe, find all the programs installed within 18 days and 2 days. During this period, the program installed is Utorrent, and the program is unloaded. Continue to use the search everything tool to search all the files by the keyword Utorrent, and delete them
   
   after the above, the computer did not operate for 20 minutes, and there was no cmdc.exe again, and the computer resource curve was stable, and there was no temperature surge and fan crazy running

< / OL >

later, I searched for Monroe coins on station B, and there was a mining tutorial..... After a few eyes, this thing is to use the CPU or GPU of the computer for mining, generally the CPU. What I met was GPU, and there would be the user account of Monroe coins in the relevant configuration file (I only blame that my file was deleted too fast to find)

in a word, the lesson is that if you don't use the cracking tools, you need to be prepared for psychological and property losses. When the temperature of the computer soars abnormally, you should pay special attention to this situation, and you may have been caught,
P.S. at the beginning, I thought that there was something wrong with the heat dissipation, cleaned the fan, and re coated with silicone grease, but it didn't work

8. The game, program or web page you use is implanted with Trojan horse. You use your computer to secretly dig virtual currency in the background and send it to hackers. In fact, you use your computer to help them do things. This will increase the fever of your computer, accelerate the loss of your computer, make more use of your home's electricity, and even affect the running speed of the program,

9. Enter the activity interface! That's it

10. Zombieboyminer, also known as Zombie boy's mining Trojan, is said to have infected 70000 computers and illegally g Monroe coins. Tencent computer housekeeper can check and kill it, it can also repair loopholes, unified control, and policy control and other comprehensive security management functions, to help enterprise managers fully understand and manage enterprise intranet security, and protect enterprise network information security.