VirusUndeletable coin mining malware lasting over a year
VirusUndeletable coin mining malware lasting over a year
I've observed strange activity on my computer. When it's idle, the GPU and CPU fans spin at maximum speed, which is typical for those experiencing malware attacks. I realized this when I unplugged the Ethernet cable or opened Task Manager to slow down the fans. I ran Malwarebytes and found entries for updaterx.exe and uninstaller-updaterx.exe, but I'm unsure if these are the culprits. After quarantining it, I usually see a temporary resolution until I restart or connect to the internet as the infection persists. I blocked the IP address in hosts, but Malwarebytes became unstable afterward, crashing essential processes and causing BSODs. I deleted Malwarebytes and tried HitmanPro for a while. I restored Windows to factory settings using reset PC services and wiped the SSD data. Unfortunately, within minutes after reinstalling, the virus returned—either from an app or during the reset. A full scan still showed only those executables. Now it's worsening; my PC crashes frequently, mines in the background during rendering tasks, and I receive a kernel security check failure. KMODE_EXCEPTION_NOT_HANDLED. Things are getting worse.
Use ad blockers in the future and avoid downloading unless fully certain. Switch drives to another OS on a different machine. Don’t restore from backups since you probably already have them. Update BIOS, wipe the USB, make a bootable Windows installer, reinstall your drives, then set up Windows.
Consider a fresh Windows setup. Obtain the Windows Media Creation Tool and place it on a bootable USB. When you start the tool, it should let you build the USB for installation. Simply supply the drive, boot from the flash, erase all C: partitions, then follow the on-screen steps for a clean install. Ensure your computer isn’t online during this process to avoid unexpected updates or downloads. When prompted for your registration key, you can bypass that step and proceed with the install.