Submitted via IRC for SoyCow8317
When the CPU utilization on a computer is high, games become less responsive, frame rate goes down, and gameplay stutters. To diagnose these problems, users will commonly open process manager utilities such as Task Manager, Process Explorer, or Process Hacker to determine if any processes are using too much of the CPU power.
Knowing this, the developer of this mining Trojan does something pretty clever; they terminate the miner when the processes for popular games or process managers are launched. This causes the computer to appear to be operating normally when running certain games and when trying diagnose CPU utilization.
This discussion has been archived.
No new comments can be posted.
CryptoCurrency Miner Plays Hide-and-seek with Popular Games and Tools
|
Log In/Create an Account
| Top
| 9 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)
(1)
(Score: 2) by nobu_the_bard on Thursday June 14 2018, @12:06PM (4 children)
I don't think this is all that exceptional. Maybe because this trick works even if the malware is only running in userspace.
I've seen tons of infected Virtual Machines where none of the tools used on the VM itself showed any abnormal CPU usage, outgoing connections, or high memory use, despite having poor responsiveness. Then you look at the host system, and can easily show the machine has 100% CPU utilization, tons of active connections, and heavy memory use. It's been awhile since I let a system get that bad though; have really clamped down the availability of admin rights even on VMs.
(Score: -1, Flamebait) by Anonymous Coward on Thursday June 14 2018, @12:43PM (1 child)
Cool story, grandpa. How often do you run popular games in a VM, Mr Non Gamer?
(Score: 3, Insightful) by nobu_the_bard on Thursday June 14 2018, @01:11PM
Isn't that basically how Minecraft servers work?
(Score: 0) by Anonymous Coward on Thursday June 14 2018, @01:36PM
Okay, I find this interesting because I've seen this. VM thinks it's find. Host machine is being flogged. Nice to know. Thanks.
(Score: 0) by Anonymous Coward on Thursday June 14 2018, @05:22PM
Plus they are doing this the hard way for evading non-diagnostic programs. Just run your executable or mining threads with lower priority. Windows will automatically make sure that your machine stays responsive for everything else and the miner will kick into high gear whenever you aren't doing anything. But then again, some malware has been doing this for years, so maybe the new kids forgot some of the old tricks.
(Score: 2, Insightful) by Anonymous Coward on Thursday June 14 2018, @02:54PM (3 children)
So the easy solution is to have the task manager launch on boot? That would prevent the mining trojan from ever running, right?
(Score: 2, Insightful) by higuita on Thursday June 14 2018, @03:25PM (1 child)
or simply run linux! :D
(Score: 3, Funny) by Rosco P. Coltrane on Friday June 15 2018, @04:45AM
To be extra sure, run the Windows Task Manager in Wine.
(Score: 0) by Anonymous Coward on Saturday June 16 2018, @04:32PM
When you minimize it it shows up as a CPU usage indicator in the system tray, so you can monitor CPU usage even without having it in foreground.