The file CUDAMINER.EXE is identified as a virus dropper.
The dropper CUDAMINER.EXE is used for downloading and installing other malware, Trojans, viruses by the commands received from the Command Center.
The file CUDAMINER.EXE loads into the computer memory and tries to connect to the dangerous web site.
Usually the CUDAMINER.EXE dropper does not infect the files on the computer and does not replicate itself on other computers.
Kill the CUDAMINER.EXE process and delete the file CUDAMINER.EXE.
Malware Analysis of CUDAMINER.EXE
Full path on a computer: C:\temp\cudaminer.exe
Detected by UnHackMe:
CUDAMINER.EXE
Default location: C:\temp\cudaminer.exe
Removal Results: Success
Number of reboot: 1
CUDAMINER.EXE is known as:
Trojan.BitCoinMiner, RiskTool.BitCoinMiner, a variant of Win32.BitCoinMiner.W, not-a-virus:RiskTool.BitCoinMiner, Trojan.BitCoinMiner.W
CUDAMINER.EXE hash:
- MD5: d7093d530b0a27a907f2f65535d7f6dc
The file tries to connect to the dangerous web site.
How to quickly detect CUDAMINER.EXE presence?
![]( "Registry")
Registry:
![]( "Folders")
Folders:
![]( "Files")
Files:
Registry:- HKLM\Software\Microsoft\Windows\CurrentVersion\Run\wstart: “C:\temp\winstart_1312182008.exe”
- HKLM\System\CurrentControlSet\Services\BITS\Start: 0×00000003
Folders:- %Temp%\extensionInstallerHelperFolder
- %Temp%\nsj3.tmp
- C:\Downloads
- C:\temp
Files:- %Temp%\extensionInstallerHelperFolder\InstallerHelper.dll
- %Temp%\nsj3.tmp\bg.bmp
- %Temp%\nsj3.tmp\image.bmp
- %Temp%\nsj3.tmp\md5dll.dll
- %Temp%\nsj3.tmp\nsDialogs.dll
- %Temp%\nsj3.tmp\nsResize.dll
- %Temp%\nsj3.tmp\sf.bmp
- %Temp%\nsj3.tmp\System.dll
- %Temp%\nso2.tmp
- C:\Downloads\.xdl!
- C:\Downloads\Software_131218.exe
- C:\temp\after.exe
- C:\temp\cudaminer.exe
- C:\temp\cudart32_50_35.dll
- C:\temp\down.exe
- C:\temp\libcurl-4.dll
- C:\temp\minerd.exe
- C:\temp\pthreadGC2.dll
- C:\temp\pthreadVC2.dll
- C:\temp\winstart_1312182008.exe
- C:\temp\zlib1.dll