SilentCryptoMiner icon indicating copy to clipboard operation
SilentCryptoMiner copied to clipboard

BotKiller option

Open sa6ta6ni6c opened this issue 2 years ago • 32 comments

Hello! I think it would be great to add a function to the miner to remove other malware when installed. I have seen this feature in many paid miners.

sa6ta6ni6c avatar Jun 26 '22 09:06 sa6ta6ni6c

Sure but it would need some method to find the malware, I'm not sure how the paid miners do it but I guess you'd have to find out how each malware works/installs and find some sort of way to identify each one (since just deleting registry entries or Tasks won't do much if they have things against that). If you know of any methods then you're free to post them.

UnamSanctam avatar Jun 26 '22 10:06 UnamSanctam

Maybe you can use open source miner killers (from GitHub) or I can send you miner I bought recently with builder that has botkiller option

sa6ta6ni6c avatar Jun 26 '22 10:06 sa6ta6ni6c

There aren't really any online that I can found that actually works well, for example none that I could find would be able to kill my miner from what I can see. But have you tried out the botkiller in the miner you bought? If you install my miner and maybe some RAT does your bought miner kill and remove them?

UnamSanctam avatar Jun 26 '22 10:06 UnamSanctam

It only kills malware that present on system when private miner is installed. However I would like to test it but have no clue how to remove it after

sa6ta6ni6c avatar Jun 26 '22 10:06 sa6ta6ni6c

You could maybe install it on a Virtual Machine and test unless the private miner has an anti-VM protection.

UnamSanctam avatar Jun 26 '22 10:06 UnamSanctam

Ok ill try it now

sa6ta6ni6c avatar Jun 26 '22 10:06 sa6ta6ni6c

Can I test it in Windows 7?

sa6ta6ni6c avatar Jun 26 '22 10:06 sa6ta6ni6c

Can I test it in Windows 7? U cant

asxtin avatar Jun 26 '22 11:06 asxtin

Can I test it in Windows 7? U cant

miner doesn't work in windows 7?

sa6ta6ni6c avatar Jun 26 '22 11:06 sa6ta6ni6c

It works on Windows 7 so you can test with that.

UnamSanctam avatar Jun 26 '22 11:06 UnamSanctam

Ok, as soon as I download windows 7 Ill record a video and send it here

sa6ta6ni6c avatar Jun 26 '22 11:06 sa6ta6ni6c

It works on Windows 7 so you can test with that.

I thought windows 10 and above worked:/

asxtin avatar Jun 26 '22 11:06 asxtin

I thought windows 10 and above worked:/

The miner is tested and works on Windows 7, Windows 8, Windows 10 and Windows 11, and also the corresponding Windows Server versions.

UnamSanctam avatar Jun 26 '22 11:06 UnamSanctam

Sadly, I can't get my virtual machine on MacBook working and my windows pc is not in service.

sa6ta6ni6c avatar Jun 26 '22 18:06 sa6ta6ni6c

Sure but it would need some method to find the malware, I'm not sure how the paid miners do it but I guess you'd have to find out how each malware works/installs and find some sort of way to identify each one (since just deleting registry entries or Tasks won't do much if they have things against that). If you know of any methods then you're free to post them.

I know one method, kill all .exe or .vbs in %appdata%, %temp%, %userprofile%, %windir% and startup folder.

SuperSnake802 avatar Jun 26 '22 23:06 SuperSnake802

I know one method, kill all .exe or .vbs in %appdata%, %temp%, %userprofile%, %windir% and startup folder.

But many are injected (so then original file is not running), and even then they may have watchdogs or similar things. So this would only really work for the basic malware and not any advanced ones. I know some that also have repeating tasks, so that for example a task runs in the Task Scheduler every hour to make sure that it's running. That's what makes it difficult, it's possible to search through all processes to try and find the injected ones and kill those but nowadays many are more complex than that.

(and you can't kill all in %WINDIR% since the computer would close down the majority of Windows processes)

UnamSanctam avatar Jun 26 '22 23:06 UnamSanctam

I think I know one method, maybe you can make it so miner removes other stuff except itself from windows defender exclusions list (when ran with administrator) As I know, windows defender is updated a lot, so it can be a great “BotKiller”

sa6ta6ni6c avatar Jun 27 '22 00:06 sa6ta6ni6c

I think I know one method, maybe you can make it so miner removes other stuff except itself from windows defender exclusions list (when ran with administrator) As I know, windows defender is updated a lot, so it can be a great “BotKiller”

Yeah that's possible though currently it excludes everything and not a specific location so that you can't really figure out what added the exclusions, since for example if it excluded AppData then that would probably reveal that whatever added the exclusions is inside AppData.

UnamSanctam avatar Jun 27 '22 00:06 UnamSanctam

I think I know one method, maybe you can make it so miner removes other stuff except itself from windows defender exclusions list (when ran with administrator) As I know, windows defender is updated a lot, so it can be a great “BotKiller”

Great idea! But what if malware was FUD?

SuperSnake802 avatar Jun 27 '22 02:06 SuperSnake802

I think I know one method, maybe you can make it so miner removes other stuff except itself from windows defender exclusions list (when ran with administrator) As I know, windows defender is updated a lot, so it can be a great “BotKiller”

Yeah that's possible though currently it excludes everything and not a specific location so that you can't really figure out what added the exclusions, since for example if it excluded AppData then that would probably reveal that whatever added the exclusions is inside AppData.

What if it deletes everything there first and then adds itself to exclusions?

sa6ta6ni6c avatar Jun 27 '22 06:06 sa6ta6ni6c

I think I know one method, maybe you can make it so miner removes other stuff except itself from windows defender exclusions list (when ran with administrator) As I know, windows defender is updated a lot, so it can be a great “BotKiller”

Great idea! But what if malware was FUD?

They usually fail runtime check and windefender gets smarter

sa6ta6ni6c avatar Jun 27 '22 06:06 sa6ta6ni6c

也许你可以使用开源矿工杀手(来自GitHub),或者我可以给你发送我最近购买的矿工,使用具有botkiller选项的构建器

Do you have telegram, can I add your buddy?

blincc1031 avatar Jul 03 '22 12:07 blincc1031

You could maybe install it on a Virtual Machine and test unless the private miner has an anti-VM protection.

Hello again! I finally fixed my laptop, so here is the video link: https://www.youtube.com/watch?v=hFNi3jcSoaY

sa6ta6ni6c avatar Jul 04 '22 22:07 sa6ta6ni6c

@UnamSanctam

sa6ta6ni6c avatar Jul 04 '22 22:07 sa6ta6ni6c

Oh so it kills the miner but not the watchdog (so the miner will just start up again after a minute or two). Interesting, maybe it kills processes with long command lines, since it didn't kill the watchdog which is also injected.

UnamSanctam avatar Jul 04 '22 22:07 UnamSanctam

Oh so it kills the miner but not the watchdog (so the miner will just start up again after a minute or two). Interesting, maybe it kills processes with long command lines, since it didn't kill the watchdog which is also injected.

I don’t know how it works, I can send private miners builder and stub if that helps

sa6ta6ni6c avatar Jul 04 '22 22:07 sa6ta6ni6c

I need a miner who supports Linux systems, please ask where to buy

blincc1031 avatar Jul 07 '22 13:07 blincc1031

I need a miner who supports Linux systems, please ask where to buy

Hello! I recommend xss.is

sa6ta6ni6c avatar Jul 07 '22 13:07 sa6ta6ni6c

xss.is registration failed, are there any other recommendations?

blincc1031 avatar Jul 09 '22 03:07 blincc1031

xss.is registration failed, are there any other recommendations?

Administrator should approve you, just wait

sa6ta6ni6c avatar Jul 09 '22 06:07 sa6ta6ni6c

My account has been declined

blincc1031 avatar Jul 09 '22 06:07 blincc1031

My account has been declined

Try another browser or don’t use vpn, also try different email. If doesn’t help, use LOLZ forum

sa6ta6ni6c avatar Jul 09 '22 07:07 sa6ta6ni6c