High CPU and Memory usage with Win64/DisguisedXMRigMiner detected

Question

Dear All,

       I have an exchange server 2019, and recently i rebooted the server and after i realized the CPU and Memory usage is very high, and i used MSERT to scan my server, and below virus detected, and MSERT helped to remove it and after i restart the server, but the issue still exist, and i run MSRET again Win64/DisguisedXMRigMiner detected again, just wonder any other method to remove this viruses ? 

Win64/DisguisedXMRigMiner

Best Regards,

Keith

Answer 1

Hello

Thank you for posting in Microsoft Community forum!

This is a vicious Trojan infection that can slow down your PC performance, corrupt your routine applications, hijack your web browsers, and even steal your computer privacy. Here are some steps you can take to remove it:

End malicious processes: Open the Windows Task Manager by pressing Ctrl + Shift + Esc keys at the same time. Find and end any malicious processes related to Win64/DisguisedXMRigMiner.

Uninstall malicious programs: Press Win + R keys together to open the Run screen. Type appwiz.cpl in the Run window and click the OK button. In Control Panel, click Uninstall a program under Programs. Look for any malicious app related to Win64/DisguisedXMRigMiner, right-click on it and click Uninstall.

Remove malicious files: Delete any files created by Win64/DisguisedXMRigMiner or related malware.

Reset Web Browsers: Remove any browser extensions installed by Win64/DisguisedXMRigMiner and related malware.

Use an Anti-Malware tool: Download and install an anti-malware tool like GridinSoft Anti-Malware, perform a “Standard scan”, move all detected items to quarantine, reset browser settings, and restart your computer.

Please note that this virus is associated with the remote code execution vulnerability CVE-2021-44228 (also referred to as “Log4Shell”) in the Log4j component of Apache. Make sure to update the Log4j component to log4j-2.17.0 or ensure that the device is set to start with log4j2.formatMsgNoLookups set to True.

Remember, it’s important to maintain regular backups of your data and keep your system updated.

Answer 2

this fix my problem, thanks for your great answer