How to get rid of the miner. How to find a hidden miner on a PC. For those who think from their own botnet

Computer security is a rather complex issue. And few users are able to quickly and efficiently provide this process his operating system. Quite often, situations arise in which a computer becomes infected with viruses. And, of course, they have to be removed. Today we will learn how to find and eliminate a miner virus. It is worth noting right away that this is not the easiest process. After all, our current infection has a somewhat non-standard purpose and origin. Let's try to deal with the problem presented to us as quickly as possible.

What is it

Scanning

Now you can try to remove the miner virus. How can I check for its presence on my computer? Firstly, it has already been said - by manifestations in the operating system. And secondly, any modern antivirus will see this infection. Do a deep dive and then look at the result.

Everything is potential dangerous files needs to be "treated". In any antivirus there is for this special button. True, in the case of a miner, quite often this technique does not work. You just have to remove all threats. In principle, if you have encountered viruses, then this process will not surprise you. Nothing complicated, right?

Removing threats

How to find a miner virus and remove it? Think carefully about why you started making changes to your operating system. Maybe you installed some software?

Most likely, this is true. Therefore, in order to finally get rid of the virus, you will have to find the malicious application and get rid of it. Typically, miner distributors include torrents (especially the latest version of UTorrent), download managers and some online games. In particular, GameNet products. Using the control panel, uninstall all such applications and only then continue to fight the infection.

Terminating processes

Next you will have to work with the dispatcher Windows tasks. Call this service and look at the "Processes" tab. The miner virus will definitely be shown here. How to check which line exactly refers to it? For example, look at how many computer resources a particular task consumes. If the figure is more than 5% (provided the main application is turned off) or more than 20% when the mode is turned on, this is our infection.

What should I do? End the process. Just highlight the desired line, and then click on the right mouse button. In the list that appears, select “Finish”. Agree to the warning (it says that unsaved application data will be lost) and confirm your actions.

Control stripping

How to remove miner virus? Now that almost all possible steps have been completed, it is worth turning to the help of additional software. It's about about SpyHunter, CCleaner and Dr.Web CureIT. The first and last application should be launched one by one and set to scan the system. After issuing the results, just like in the case of an antivirus, all dangerous objects are disinfected or deleted. In principle, after using CureIT, the miner virus usually disappears.

But to be more confident, it’s worth doing a little work with your computer’s registry. Launch CCleaner, and then click on “Analysis” in the lower right corner of the window. Please note that in the settings (left panel of the program) all scans must be checked sections of hard disk, as well as browsers and background applications(if possible). After the process is completed, click on “Cleanup”. That's it. Reboot the computer and look at the result. Now we know how to remove the miner virus. In some cases, if the operating system has not been disinfected, you will need complete reinstallation computer from hard formatting disk.

There are people who mine this “cryptocurrency” honestly, buy equipment, and there are people who do it with the help of others.

The other day, one user began to complain that his computer began to slow down a lot. After looking at the antivirus logs and the computer log, I noticed that a strange program was installed on his computer under the user profile IMG002 and began to load the processor. User caught Miner Bitcoin. After conducting the analysis, I want to share with you what the user caught and how to deal with it.

Trojan.CoinMiner is a large family of Trojan viruses that have already infected millions of computers. Trojan.CoinMiner is an extremely dangerous Trojan horse that intrudes deeply into your system. The program enters the computer fraudulently and uses its capabilities for the owner’s purposes. The main task of the Trojan is to mine cryptocurrency using other people's resources. You can download and install a Bitcoin miner by accident - the program often looks like a photograph or Word file. At the same time, the worm not only “pumps” resources from the computer, but also steals personal information, which can be even more dangerous for the user.

The Bitcoin miner program was created by people who set the task of connecting as many PCs as possible to work and increasing Bitcoin earnings. The attackers relied on the fact that many people use 10-20% of their “machines” resources. When mining cryptocurrency, more power is consumed - up to 80-100%. Today, every network user can turn into a miner without his knowledge. The only difference is that such a person will not receive a profit - it goes to the person who “infected” the computer. The PC itself turns into a cryptocurrency mining robot. The Bitcoin system rewards “miners” and provides 25 Bitcoins for one mined block as a bonus. Actually, thanks to the active activity of miners and the processing of ongoing transactions, the operability of the entire structure is ensured.

After downloading and installing the Bitcoin miner, the PC is loaded to its maximum. At the same time, the owner of the victim computer may not notice that someone is “downloading” the computer’s resources. It is not difficult to recognize a virus - the computer load factor increases several times. Moreover, “heavy” programs can be closed. The main task of an attacker who infects a computer is to make the crime less noticeable and force users to follow the insidious link. As soon as the program is downloaded, the PC's capabilities become the property of the hacker. At the same time, a criminal can solve many problems, from mining cryptocurrency to collecting personal information.

By the way, the Miner Bitcoin Trojan is far from the only program of this kind. Before its appearance, antivirus programs were already able to find a lot of worms using PC resources for their own purposes. One of these is Badminer, a program that searched for information processing blocks in a PC and used them in cryptocurrency mining. A computer is not capable of mining Bitcoin on its own. But nothing is impossible for hackers. Computer scientists find hacked “machines” that have a history of mining cryptocurrency and send their viruses there. If an attacker manages to find the key to more than a million computers, then his costs (time and financial) are fully recouped.

Trojan.CoinMiner is common name for all viruses of this type.

There are several other similar symptoms of how the virus enters your system:

A random app is using almost 100% CPU

Your computer starts to run slowly or freezes every time.

All websites are taking longer to load than usual.

If your computer or laptop is overheating, turn it off or restart.

Also, if your computer is infected, you can check this folder on your computer:

C:\Users(Your username)\AppDataRoaminghodl

C:\Users(Your username)\AppDataRoamingETH

C:\Users(Your username)\AppDataLocalEthash

The last directory can often take up several gigabytes on your computer. This virus can give remote access to your PC, so that the creator of Trojan.CoinMiner can easily control your computer without you seeing anything.

You can often notice that you are infected with this virus if you see cmd.exe or Engine.exe(also known as - sgminer.exe or SGM.exe) in the task manager. These processes load the processor to 100% and your computer starts to run slower or simply freezes for a short time.

And if we look in the task manager, we will see.

How do antiviruses react to this virus?

How to get rid of this infection?

The first step, of course, is to disconnect this computer from the network, but I did not have this opportunity because the computer is located far away, and I added the sites where the virus is breaking into the proxy server, thereby blocking its access.

Then I went to the nod 32 website to download nod 32

And we do bootable USB flash drive. We talked about how to make a bootable USB flash drive in our lesson “”.

And we check the computer for viruses. NOD 32 copes with this task perfectly.

But there is another situation like mine, the computer is far away and there is no way, then in this case KVRT (Kaspersky Virus Removal Tool) will help us.

Unfortunately, I didn’t find it on the official website current version antivirus, and followed another link and downloaded the current one

Due to the large number of files on the computer, the computer scan was delayed. But after checking and rebooting, the computer began to work stably.

Conclusion:

Network users should be careful when downloading and installing suspicious files, as well as when working with torrent clients. Otherwise, the computer may turn into a “robot” that only mines Bitcoins. I hope that we helped someone get rid of of this virus and if you get caught, you will know what to do.

The passion for easy, dishonest money is an unchangeable part of human nature. So methods of making money like this will continue to be invented as long as humanity itself exists. In the century information technology the most popular method of this type of enrichment is the creation computer viruses, from which their creators earn a lot of money. Every year viruses develop, become more sophisticated, and are increasingly difficult to detect. One of the most striking examples of such a “smart” virus is a miner virus.

Before answering this question, we need to delve a little deeper into the theory and complex terms. Mining is the extraction of cryptocurrency. Cryptocurrency is a digital currency that is based on cryptographic methods (that is, methods for ensuring confidentiality and data integrity).

Cryptocurrencies have become popular for two reasons:

• firstly, transactions involving cryptocurrencies are anonymous;
• secondly, their exchange rate is unstable and constantly “jumps”, which provides good ground for trading (earning money from changes in exchange rates).

Cryptocurrency mining involves a huge number of complex calculations. To perform these calculations, use computing power computers. Many miners (people involved in mining) spend a lot of money on purchasing equipment that allows the necessary calculations to be performed. But the creators of virus miners went even further - they do not want to make large investments, they want to use the computing power of your computer for personal enrichment. This is precisely the essence of the work of this type of virus.

Why is he dangerous?

Virus is different from virus. Some viruses are relatively harmless (for example, some kind of Amigo browser that installs against your wishes), while others are those that cannot be called anything other than outright extortion and a threat (for example, winlockers that block your computer and demand that you transfer money to a certain wallet in order to unlock it) ). At first glance, the miner seems to be a harmless virus. Allegedly, someone is making money from you, but you yourself are not losing anything from this. But this is not entirely true.

As mentioned above, mining works through a huge number of calculations. To carry out these calculations, the computer loads its hardware components (processor, RAM, but mainly the video card, because it is where all the calculations take place and it is its power that the attacker is interested in). The more these components are loaded, the hotter they become. Excessive load causes overheating, and overheating causes component failure. In the best case, the presence of a miner virus will negatively affect the performance of the computer, for example, it will reduce FPS in games (the number of frames per second). If you are an avid gamer, then this alone should make you want to get rid of this virus as quickly as possible.

Types of mining viruses

Mining viruses can be divided into two categories: executable files and browser scripts. Many people to this day quietly use a computer and do not even suspect that at this time he is making money for someone else.

Let's take a closer look at each of the categories of viruses, and also look at ways to detect and remove them.

Virus miner in the form of an executable file XMRig CPU Miner

Most viruses are executable files with the .exe extension, and the miner virus is no exception. Such viruses can enter your computer using different methods, but the most common method is additional modules when downloading files that are installed along with them. Below we will look at ways to detect and remove them.

How to detect

The miner virus in the form of an executable .exe file is called XMRig CPU Miner. It should not be confused with a program that has the same name. Unlike a program, which is quite useful, a virus consumes much more computer resources and works not for you, but for someone else. But there will be no problems with confusion - everything is simple here. If this program is installed on your computer, it means that you voluntarily installed it and knew why it was needed and what functions it performed. After all, unlike the virus of the same name, it does not seek to penetrate file system your computer by deception and by any means complicating the process of detection and removal.

To detect this virus, it is necessary to carry out periodic testing. That is, do the following things:

It is advisable to carry out such monitoring regularly to monitor the condition of the computer. If you see in the Task Manager that the load on components is too high, although you are not running any demanding games or programs, then you should think about the presence of malicious files.

The same goes for checking the temperature - if it is too high, then perhaps the hardware components are overheating due to the presence of a virus (provided that you clean the computer from dust at least twice a year and replace the thermal paste).

If your computer is overloaded and overheating, then it’s time to check the processes, since this is where the XMRig CPU Miner virus should be displayed. To do this, follow these steps:

1. Launch Task Manager using the buttons Ctrl+Alt+Delete" or " Ctrl+Shift+Esc".

   

   Note! It is advisable to get into the habit of constantly keeping the “Task Manager” running and minimized. It will help you learn a lot in one click useful information O current state computer, while it itself consumes very few resources.

2. Go to the tab "Processes".

   

3. If you find yourself in the processes XMRig CPU Miner, then your suspicions about the miner virus have been confirmed.

   

How to remove

The XMRig CPU Miner virus, after penetrating the computer, becomes firmly entrenched in it. It takes root deep into the operating system, which makes its removal not an easy task. Removing this virus requires a consistent and comprehensive approach.

First of all, you need to scan your computer with an antivirus. The following programs are suitable for this:

• Kaspersky;
• Avast;
• DrWeb;
• AdwCleaner.

Let's look at the deletion scanning process using the example program AdwCleaner. Among its advantages are the high speed of scanning and removal of detected threats. So, if you want to remove viruses using this program, then follow these step-by-step instructions:

1. Download AdwCleaner. You can do this using the following link: https://toolslib.net/downloads/viewdownload/1-adwcleaner/.

   

2. Click on the button "Download" and wait for the file to download.

   

3. Run the file "adwcleaner_7.2.4.0.exe". 7.2.4.0 is latest version programs at the moment.

   

   Reference! If, while you were reading the article, new version, it will be listed on the download page above. The version number will also be indicated in the file name. After downloading, the file will be moved to the folder "Downloads" on your computer. To access this folder, go to the following directory: " C:"/"Users"/" Your computer name"/“Downloads”.

4. Open the tab on the left "Control Panel" and press "Scan".

   

5. Wait for the scan results. AdwCleaner is famous for its high speed, which means you won’t have to wait long for the scanning process to complete.

   

6. After the program shows you the scan results and detected malicious files, click on the button "Clean and restore".

   

Important! After clicking this button, AdwCleaner will warn you that the computer will restart, so you should save your current work (for example, save a document in Word, a picture in Photoshop, music file in FL Studio or just save in the game). “Save” wherever you can, then confirm to reboot.

After you have scanned and “cleaned” your computer, you need to do the same with the registry. The program is perfect for this procedure. CCleaner. It not only checks the registry for problems and inconsistencies, but is also widely used to optimize the performance of the computer by freeing up space on system disk C.

So, to clean the registry, follow these steps:

1. Download CCleaner from the official website http://ccleaner.org.ua/download/. On the download page, select your OS version and click on the program name. After clicking, the download will start automatically.

   

2. Run the file "ccsetup547.exe". 5.47 is the latest version on at the moment. The file will be stored in the folder "Downloads"(the system address of this folder is indicated above).

   

3. After launch, click on "Install" to begin installing the program.
4. Wait for the installation to complete. The program itself is not demanding, so it will install in a matter of seconds. After installation, you can immediately launch it by clicking on the button "Run CCleaner". Do so.

   

5. Go to the tab « » and check the boxes next to each parameter (“Fonts” can be left alone). Then click on "Search for problems" and wait for the program to scan the registry. In most cases, this process takes less than a minute.

   

6. When scanning is complete, click on "Correct Selected". You will be prompted to save backups changes. Decide for yourself whether to do this or not, but this will not affect the registry cleaning process in any way.

   

7. Click on the button "Correct marked", to fix all the errors found at once, rather than sort through them one by one. After fixing, you can close the program.

   

1. Launch menu "Run". This can be done by simultaneously pressing the keys " Win+R".

   

2. Enter text in the input field « regedit» and press "OK".

   

3. Click on the button combination " Ctrl+F" to run a search in the registry or select the appropriate function in the tab "Edit".

   

4. In the search, enter "xmrig"(letter case is not important), press "Find Next".

   

5. Delete all registry settings that contain this name. This is done by right-clicking on the parameter, then left-clicking on "Delete".

   

6. Restart your computer.

And remember! Always look at what checkboxes you check when installing files, especially if they were downloaded from a dubious resource!

Video - Miner virus, how to find and remove?

Browser miner

The miner virus in the form of an executable file was not difficult to detect; difficulties could arise in the process of removing it. But in the case of an “online” miner, the opposite is true. Moreover, removing it is not just difficult - it is impossible to do. And in order to detect it, you need to have at least superficial knowledge of web programming (in particular, know the structure of an HTML page). But first things first.

How to detect

There is such a popular programming language as JavaScript. Its capabilities are quite wide, but most often it is used to improve appearance website pages. Almost all sites have several scripts installed, and if your browser does not support JavaScript, then you will not even be able to access VK from it.

But some craftsmen used the capabilities of the language to create an online miner. It works as follows - while you are sitting on the page, the script uses the resources of your computer through the browser to mine cryptocurrency. Such scripts are mainly used on sites that are intended for long-term viewing.

These include:

• websites with online books. While you are replenishing your intellectual luggage, the attacker, with your help, is replenishing his wallet;
• websites with films and TV series. Watching movies takes long time, and this plays into the hands of the attacker;
• sites for adults.

Few users are able to ensure complete security for their device. It has only become more difficult recently to fully protect the operating system from hacking and various malware. Due to surfing Internet resources and downloading suspicious software, your computer is constantly at risk.

Of course, at the moment there are a huge number of different types of viruses, but today we will take a closer look at how to find and remove a miner virus. It is worth mentioning that this malware is not the weakest. It will take a little effort to detect it and subsequently eradicate it from the system.

The miner virus has a somewhat specific origin and purpose. This article will discuss the process of how to detect it and later remove it from your PC.

What is this virus?

Before you remove a miner virus from your computer, you need to learn about its essence and the dangerous effect it has on your device. The more information you know about it, the easier it will be to avoid it getting onto your PC again.

Typically, users believe that the best thing to do is simply reinstall the operating system, but in this case this is not necessary. It will be enough for you to use a third-party software and use a few tips that will be discussed below.

The miner virus can be called a kind of Trojan. It gets onto devices most often through malicious files, and later they begin to load the PC’s central processor more and more. Over time, malicious software uses all available resources on your device to work. With your help, the creators of these types of viruses earn cryptocurrency called bitcoins, which can later be exchanged for real money.

In addition to all the actions described above, a miner virus can have the same effect on a PC as any other malware:

• He steals wallet data, bank cards and social networks.
• Destroys the OS.
• Makes your computer more vulnerable to other viruses

Sometimes it can do this, but the main goal of the named “infection” is to enrich the creator of the virus by earning cryptocurrency from the infected computer.

How to detect a miner virus?

Once you have an idea of ​​the virus itself and the effect it has on your device, you can move on to the question of how it can be detected.

The simplest thing you can do is look at the general state and behavior of the operating system in certain situations. You can often immediately detect the presence of viruses of this type, such as a miner. An infected PC will noticeably lag or simply slow down. This may be the first sign that the device has been attacked by a virus. However, this situation is observed in all Trojans, and not just in the miner.

Next, you need to check the status of the task manager. If a virus penetrates, unknown strings will appear in it, which greatly affect the performance of the computer. It is not at all necessary that the processes will have a suspicious name. There are cases when hackers disguise running software as commonly used programs. So, instead of a running Trojan in the task manager, you can see processes such as steam.exe or chrome.exe.

The most noticeable effect when infected with the named virus is that the central processor personal computer always very busy. This may be noticed when you disable all third party programs and even after rebooting the device. The percentage of CPU utilization when infected with a virus will range from 90 to 100%. Also, while the PC is running, you can hear the video card operating very loudly.

If you have the symptoms that were described above, then we can say that the PC was subject to a virus attack and was infected with such unpleasant software as a miner. And if it is not removed soon, then you will suffer from a large number of lags, and later the harmful effects on components will begin due to constant overheating.

Now that you have learned how to find a miner virus, you can begin to eliminate it.

Preparing to remove the virus

To accurately say that a computer is susceptible to a miner virus, several manifestations of a Trojan program will not be enough. The best way to do this is to use special programs, allowing you to identify all the malicious software that is on your computer. Preparing to clean your PC should be done with great care so that the consequences of your actions do not worsen the situation.

The very first thing to do when taking any action related to system files, is copying all important files to another medium (flash drive or external hard disk).

Be sure to buy or download an antivirus program and software to scan your PC for viruses. The most universal antiviruses are Doctor Web and NOD32, and CCleaner and SpyHunter are suitable as supporting programs. Although you can do without the last two. True, then you are unlikely to be able to completely clean the device of malicious software.

In addition to what was described above, it would be nice to have a disk with the operating system. You won't need it in the process of getting rid of viruses, but it's still better to have a backup option in case your Windows system files are damaged.

Now all that remains is to free yourself for a couple of hours and start cleaning your PC from the Bitcoin miner virus.

Avoiding mistakes

The very first thing that needs to be done is to avoid all situations in which the system will not be able to display the virus. First of all, close all existing programs that are running in the background. The fewer processes running, the better.

Why is this needed? As was said earlier, the virus we are describing disguises itself as other commonly used programs. But if you close everything, it will be much easier to see malicious software in the list of running processes.

Ideally, only two programs should be running on your computer - an antivirus and Windows Update. All download managers, browsers and others background programs must be closed and not turned on throughout the entire process of getting rid of the virus.

Virus detection

Now you can move on to how to remove the miner virus. How to determine if malware is present on a PC? For example, according to the method described earlier - manifestations in the operating system. Any modern antivirus can also detect the virus. To do this, select the deep PC scan button and wait for the result.

All suspicious or infected files can be “cured” antivirus program. But in the case of a miner, this method does not always work. In our case, they will simply have to be deleted.

Removing a threat

It’s worth thinking carefully about the event after which glitches began to occur in your operating system. This may have happened after downloading a file or game. And most often this is true. That is why it is worth finding the infected application and simply uninstalling it.

Typically, the virus we described comes to your computer through downloading pirated games and programs using a torrent. This can also happen through download managers or online games. GameNet products suffer from this most of all.

You just need to get rid of all potentially infected programs and only then continue the war against computer “infection”.

Running processes

Now let's move on to working with the task manager in Windows. Go into it using the “Start” menu and go to the tab called “Processes”. Since you closed everything running programs and games, then finding a miner will be much easier. You just have to look at how much computer resources a running process takes up. If the percentage of involvement central processor is more than 20%, then most likely it is our virus.

What to do after discovery? All you need to do is click on the process right click mouse and select “Finish”. Further, agree that after closing it, unsaved data will be lost. Now the miner will not take up all the PC resources to receive the cryptocurrency that goes to the hacker.

Final cleaning

Let's move on to the final step of how to treat the Bitcoin miner virus. Once everything described above has been done on your computer, you can turn to the help of auxiliary programs. CCleaner, Doctor Web, CureIT or SpyHunter are most suitable for this. Everything is extremely simple with them - you just need to set them to scan the system and wait for the process to complete. After this, dangerous files and programs will be “cured” or removed from the PC.

According to reviews from users who fought the miner, the CureIT program from Doctor Web copes well with the virus, since after its use the malicious software disappears forever.

Conclusion

The miner virus is not difficult to remove. You can actually get rid of it using the methods described above. You just need to download all the necessary software on the Internet and get started.

The process of removing a virus such as a miner does not require any special knowledge from you. The downloaded programs will do all the work for you, and it will take no more than an hour.

If your computer is constantly slowing down and running at maximum capacity, then this is a reason to check it for miner viruses. Let's look at how to detect a hidden miner on a computer and remove it.

What is it and why is it dangerous?

A hidden miner is a virus program that uses the performance of your PC to mine cryptocurrencies. Infection occurs through:

• malicious messages;
• downloaded files;
• spam mailing.

The video explains in more detail what mining is and how it works.

The first mentions of hidden mining appeared in 2011, but then these were isolated cases. At the beginning of 2018 this problem occupies one of the leading positions in news feeds.

The Trojan miner poses a great danger to the PC:

1. Reduces the service life of hardware.
   The PC runs at maximum load for a long time, which negatively affects maximum period services:
   • processor;
   • video cards;
   • cooling systems.
2. Limits performance.
   When using an infected computer for their tasks, the user receives scanty performance, because the bulk of it goes to hidden mining.
3. Provides access to personal data.
   Since the miner is a Trojan, it gains access to the user’s personal information. Recently, cases of theft of electronic wallets and passwords have become more frequent. The attacker not only uses your PC's performance, but also steals confidential data.

Pay attention! Latest update Windows has received protection against mining. You can get acquainted with the information by clicking on the link “Windows 10 protects your PC from hidden mining.”

How to detect and remove

Advice! Scan your system with an antivirus, you may come across a regular miner that does not hide its presence. In this case, it will be detected and automatically removed by antivirus software.

It is usually quite difficult for a user to detect a Trojan, because the developers of the virus software have tried to hide its operation as much as possible. New miners are able to disguise their activities:

• Disable while the user is working with demanding applications.
• Disguise as other applications in Task Manager.
• Work only when the PC is idle.

Your computer could be infected without you even noticing it. It all depends on the ingenuity of hackers. We will try to explain in as much detail as possible how to identify malware.

Important! Be careful when deleting any file, especially if you are not sure of its purpose. You do all actions at your own peril and risk!

Via Task Manager

Let's touch on Internet mining a little. There are sites that, using a special script, gain access to the performance of your PC. A hacker, bypassing the protection of an Internet resource, uploads his malicious code, which mines cryptocurrencies while you are on the site.

It’s very easy to understand that you’ve encountered one, because when you visit it, your computer will start to slow down, and the Task Manager will show a heavy load on the hardware. It is enough to simply leave the site to stop the mining process.

To detect malware on the system:

1. Go to the Task Manager by holding down “Ctrl + Shift + Esc” at the same time.
   
2. Observe the processes for 10 minutes of complete inactivity (including mouse movements and keystrokes).
   

   Important! Some viruses close or block the Task Manager in order to hide their activity.
   If the dispatcher closed on its own or some program began to load the system, this means that the PC is infected with the miner.

3. If the virus is not detected, go to the “Details” tab.
   
4. Find a process that differs from the standard (for example, strange symbols) and write down the name.
5. 
   
6. “Edit” → “Find”.
   
7. 
   

   Important! If you are not sure that the file can be deleted, write to us in the comments, we will try to help.

   
   
8. Scan the system with an antivirus (for example, use standard antivirus, which is located in “Start” → “Settings” → “Update and Security” → “ Windows Defender»).
9. Restart your PC.

Via AnVir Task Manager

The multifunctional process manager AnVir will help you detect a hidden virus.

1. Download and install the utility.
2. Launch it and view the running processes.
   
3. If you are suspicious, hover your cursor over an application to display information about it.
   
   

   Pay attention! Some Trojans disguise themselves as system application, but they don’t know how to fake details.

4. Then RMB → “Detailed information” → “Performance”.
   
   
5. By selecting “1 day”, view the load on your PC during this time.
   
   
6. If a process heavily loaded the system, hover your cursor over it → write down the name and path.
   
   
7. Right-click on the process → “End Process”.
   
8. IN Windows search type “regedit” → go to the registry.
   
9. “Edit” → “Find”.
   
10. Enter a file name → remove all matches.
    
11. If threats are detected, confirm their removal.
12. Restart your PC.