# PUB.bitminer Malware **URL:** \ **Category:** NYSpeed Off Topic\ **Created:** [December 5, 2011, 10:59am UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905 "2011-12-05T10:59:37Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![walter](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/walter/32/7202_2.png) [@walter](https://forums.speedlife.net/u/walter)\ **Post date:** [December 5, 2011, 10:59am UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/1 "2011-12-05T10:59:37Z")
Anyone every had to deal with this before? I can’t get rid of this fucker and usually can get most stuff. Still runs in safe mode. MWB/MSE/some other thing/rkill don’t seem to touch it. It plays random audio clips all the time which is annoying as hell. I’m sure its doing other crap I don’t want. I scan and find it, can remove it, but then its back as soon as I restart, even if I run rkill, reboot in safe mode, all of that normal stuff. Google just mostly turns up people asking for help and no real solutions, any suggestions appreciated. Thanks ---
**Author:** ![Gl1](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/gl1/32/5471_2.png) [@Gl1](https://forums.speedlife.net/u/Gl1)\ **Post date:** [December 5, 2011, 11:18am UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/2 "2011-12-05T11:18:52Z")
can you get to the internet on that computer? if so i have found the norton power eraser works on some weird infections that other programs don’t. you could also try running combofix ---
**Author:** ![TradersBASE](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/tradersbase/32/5321_2.png) [@TradersBASE](https://forums.speedlife.net/u/TradersBASE)\ **Post date:** [December 5, 2011, 11:23am UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/3 "2011-12-05T11:23:44Z")
In for replies as I’ve not heard anything about this one yet. Modern day malware I don’t bother removing myself, I backup the profile data and do a fresh OS install. I know most don’t agree with just wiping but that’s my preference. ---
**Author:** ![walter](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/walter/32/7202_2.png) [@walter](https://forums.speedlife.net/u/walter)\ **Post date:** [December 5, 2011, 11:37am UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/4 "2011-12-05T11:37:08Z")
> [@Gl@re](#): > > can you get to the internet on that computer? if so i have found the norton power eraser works on some weird infections that other programs don’t. > > you could also try running combofix Yes. Will try both of those tonight. ---------- Post added at 02:37 PM ---------- Previous post was at 02:35 PM ---------- > [@TradersBASE](#): > > In for replies as I’ve not heard anything about this one yet. Modern day malware I don’t bother removing myself, I backup the profile data and do a fresh OS install. I know most don’t agree with just wiping but that’s my preference. Yea, I had a long streak of not having any issues (see LZ’s protection thread). Don’t know what happened here, but as he pointed out, probably some exploit I left opened more than going to a weird website or download. I don’t have any system restore points so… I’ll keep plugging at it for a bit. Then I’ll back up my important data and just go clean. ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [December 5, 2011, 11:50am UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/5 "2011-12-05T11:50:26Z")
[http://www.sophos.com/en-us/products/free-tools/sophos-anti-rootkit.aspx](http://www.sophos.com/en-us/products/free-tools/sophos-anti-rootkit.aspx) [http://www.gmer.net/](http://www.gmer.net/) [http://blog.teesupport.com/pup-bitminer-wont-go-away-how-to-manually-remove-pup-bitminer-completely/](http://blog.teesupport.com/pup-bitminer-wont-go-away-how-to-manually-remove-pup-bitminer-completely/) ---------- Post added at 02:50 PM ---------- Previous post was at 02:42 PM ---------- Or you can paypal me money and I can do some reverse analysis on the malware sample 🙂 ---
**Author:** ![walter](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/walter/32/7202_2.png) [@walter](https://forums.speedlife.net/u/walter)\ **Post date:** [December 5, 2011, 11:50am UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/6 "2011-12-05T11:50:33Z")
> [@LZ](#): > > [http://www.sophos.com/en-us/products/free-tools/sophos-anti-rootkit.aspx](http://www.sophos.com/en-us/products/free-tools/sophos-anti-rootkit.aspx) > > [http://www.gmer.net/](http://www.gmer.net/) > > [http://blog.teesupport.com/pup-bitminer-wont-go-away-how-to-manually-remove-pup-bitminer-completely/](http://blog.teesupport.com/pup-bitminer-wont-go-away-how-to-manually-remove-pup-bitminer-completely/) Thanks, will try the first two. I tried the third yesterday without too much luck. Was unable to figure out (or find) all of the files it was referencing. ---
**Author:** ![boxxa](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/boxxa/32/5045_2.png) [@boxxa](https://forums.speedlife.net/u/boxxa)\ **Post date:** [December 5, 2011, 11:55am UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/7 "2011-12-05T11:55:03Z")
Format. If its a rootkit, you will be pulling your hair out trying to get rid of it and still may leave holes for future command and control software loads. On a side note, it would be entertaining as hell if a malware producer managed to make their own virus, then, flooded google with “removal” articles which were actually ways to get more infected. Muhahahahha. Profit?! ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [December 5, 2011, 11:55am UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/8 "2011-12-05T11:55:54Z")
I think it’s pretty sweet someone wrote some malware that mines for bitcoin :lol: ---
**Author:** ![ProgRocker](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/progrocker/32/5434_2.png) [@ProgRocker](https://forums.speedlife.net/u/ProgRocker)\ **Post date:** [December 5, 2011, 2:20pm UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/9 "2011-12-05T14:20:36Z")
The sophos stuff works pretty well. If all else fails, ComboFix that bitch. ---
**Author:** ![walter](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/walter/32/7202_2.png) [@walter](https://forums.speedlife.net/u/walter)\ **Post date:** [December 5, 2011, 6:18pm UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/10 "2011-12-05T18:18:31Z")
bleh, still no luck. lots of “i can find it but I can’t get rid of it” grrr ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [December 5, 2011, 6:24pm UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/11 "2011-12-05T18:24:03Z")
Do you know when it got infected? Boot off another distro search by creation date and look for dlls and exes that shouldn’t be ---
**Author:** ![ProgRocker](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/progrocker/32/5434_2.png) [@ProgRocker](https://forums.speedlife.net/u/ProgRocker)\ **Post date:** [December 5, 2011, 6:24pm UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/12 "2011-12-05T18:24:32Z")
Even combofix? does anything show the file location? ---
**Author:** ![Gl1](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/gl1/32/5471_2.png) [@Gl1](https://forums.speedlife.net/u/Gl1)\ **Post date:** [December 5, 2011, 6:27pm UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/13 "2011-12-05T18:27:53Z")
At this point it will probably be faster/easier to back up, format, and re-install ---
**Author:** ![walter](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/walter/32/7202_2.png) [@walter](https://forums.speedlife.net/u/walter)\ **Post date:** [December 5, 2011, 7:05pm UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/14 "2011-12-05T19:05:52Z")
I want to punch this thing in the face. I’m going to format and reinstall later, just don’t have time to bother these days… look for a thread asking about a NAS recommendation ---
**Author:** ![TradersBASE](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/tradersbase/32/5321_2.png) [@TradersBASE](https://forums.speedlife.net/u/TradersBASE)\ **Post date:** [December 6, 2011, 6:14am UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/15 "2011-12-06T06:14:56Z")
I’ve wasted countless hours on newer malware/virus/trojans only to opt for the format method. It’s often quicker than doing the several scans with different products and in the end you know for sure you’re drive is clean. Fresh registry etc… usually speeds you up as a side reward for your efforts. 🙂 ---
**Author:** ![Tunerfreak](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/tunerfreak/32/7427_2.png) [@Tunerfreak](https://forums.speedlife.net/u/Tunerfreak)\ **Post date:** [December 6, 2011, 2:20pm UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/16 "2011-12-06T14:20:14Z")
I had something like this a few years ago, never found it/fixed it so I just formatted ---
**Author:** ![TradersBASE](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/tradersbase/32/5321_2.png) [@TradersBASE](https://forums.speedlife.net/u/TradersBASE)\ **Post date:** [December 6, 2011, 3:31pm UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/17 "2011-12-06T15:31:53Z")
They should have called it PIITB.bitminer ---
**Author:** ![walter](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/walter/32/7202_2.png) [@walter](https://forums.speedlife.net/u/walter)\ **Post date:** [December 6, 2011, 5:17pm UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/18 "2011-12-06T17:17:00Z")
combofix seems to have gotten it finally, annoying, but seems clear for the moment. Still reformatting this weekend. ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [December 6, 2011, 5:55pm UTC](https://forums.speedlife.net/t/pub-bitminer-malware/218905/19 "2011-12-06T17:55:36Z")
You should work on figuring out how you got it in the first place.