A new miner malware, using the SearchGo name and the fake process Svchost.exe.exe has been reported to infect victims computers and install a Trojan horse which begins to mine for the cryptocurrency Monero by automatically launching a fake svchost.exe file. The file, named svchost.exe.exe begins to use GPU and CPU power of the infected computer and may increase the processor utilization to up to 95%. In the event that you see the svchost.exe.exe process on your computer, reccomendations are to check for the SearchGo or Svchost.exe.exe miner Trojan and remove it, using the information in the article below.
|Short Description||Infects your computer, drops it’s payload, after which begins to mine for the cryptocurrency Monero (XMR).|
|Symptoms||Elevated GPU and CPU temperature and utilization. Fake process, named svchost.exe.exe running in the background as a system process in Task Manager.|
|Distribution Method||Via bundled installers, fake setups or via other PUP that has already been installed on your PC.|
|Detection Tool|| See If Your System Has Been Affected by Svchost.exe.exe Malware |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss Svchost.exe.exe Malware.|
Svchost.exe.exe (SearchGo) Miner Trojan – Infection Methods
In order to infect the computers of victims, the SearchGo miner malware may use such techniques that expose the infection file to as many potential victims as possible. The most widely used such technique is if the malware is spread via e-mail spam messages, containing the infection file as an attachment, for example:
The infection file may be concealed in those e-mails to resemble an Invoice, a receipt or any other seemingly legitimate document. But this is not the only method by which you can become infected with the svchost.exe.exe miner malware. The virus may also spread passively via files uploaded online, like:
- Fake setups of programs that are available for download in suspicious websites.
- Fraudulent key generators, software license activators or other game cracks and patches.
Svchost.exe.exe Miner – Malicious Activity
In addition to being a Monero miner, the Svchost.exe.exe malware is also a Trojan Horse, meaning that it has all the capabilities of Trojan as well. Once infecting your computer the infection file uses obfuscation in order to conceal it’s malicious files from any protection software. The files dropped, contain the fake svchost file which aims to imitate the original Windows process and it is being dropped in the following location:
Once the infection commences, the Svchost.exe miner may begin the infection by initiating a process call by incjecting script in the legitimate Service Host to launch the fake file as an administrator. From there, the fake file is launched and connects the victim to a mining pool of other infected computers. All of the infected computers lead to the account and wallet of the hacker behind the Svchost.exe.exe miner. If the attacker has infected several computers, here is how a logical mining pool linked to his wallet may look like:
The only realistic sign of seeing this malware infecting your computer is if you see the process on your Windows Task Manager running with a 95% or more CPU utilization under the User Name SYSTEM.
Besides being a miner malware, the Svchost.exe.exe miner is also a Trojan horse, meaning that it can also perform all of the spyware activities done by a Trojan, such as:
- Log the keystrokes you type.
- Take screenshots on your computer.
- Collect usernames and passwords.
- Steal important files from your computer.
- Update itself.
- Install other malware on your PC.
Remove SearchGo (Svchost.exe.exe) Miner from Windows
In order to fully remove ths miner malware from your computer, reccomendations are to follow the removal instructions below. Since they are divided in manual and automatic removal, reccomendations are only to follow the manual removal in case you have experience in removing viruses this way. Otherwise, experts outline the best way to remove the SearchGo (Svchost.exe.exe) malware is by using an advanced anti-malware software, specifically created to remove such threats and protect your computer in the future against them as well.