The developer encountered a persistent cryptocurrency miner that blocked system tools, including Task Manager and antivirus software. Manual removal initially took one hour, involving the suspension of malicious processes, modification of file permissions, and cleaning of registry keys and task scheduler entries.
To automate the process, the developer created a C# utility. The tool uses WinAPI to suspend suspicious processes, clear access restrictions, and manage quarantined objects. It employs a scoring system based on heuristic analysis to identify potential threats rather than relying solely on signatures.
The software, now known as MinerSearch, has evolved from a simple script into a modular application with 12 scanners. It features a GUI for reviewing threats, a quarantine manager for potential recovery, and support for various operational modes, including silent scanning and WinPE compatibility.
The architecture now follows a pipeline: Scanner, ThreatObject, ThreatAnalyzer, ThreatDecision, and ThreatHandler. This separation allows for more flexible threat management and easier maintenance compared to the original monolithic design.
