Security expert handling infection XMRig CPU Miner process

I have seen this before, the rebooting thing is new though. Should be easy enough to clean up! A little about me: I have over 15 years system administration experience with a number of distributions of linux / unix and windows server, working for a large number of blue chip companies here in the UK. Skill-List (Including but not limited to): Windows 2000-2016 Server Exchange 2003-2016, Office365 Linux / Unix Administration SAN Storage (NetApp, EMC Clariion, HP MSA/EVA/Lefthand) Server Virtualization (Vmware ESX, XenServer, Openstack) Desktop Virtualization (Vmware View, Xen Desktop) Application Virtualization (Thinapp, Xenapp) Networking (Cisco, Juniper, HP, Extreme, Ubiquiti) Firewall / IDS (Cisco, Fortigate, Juniper) Backup (CA Arcserve, HP Data protector, R1Soft, Veeam) Server administration (MsSQL, MySQL, Oracle (inc forms & reports), InnoDB, IIS, Apache, SCCM, WSUS) VoIP Solutions (Nortel, Avaya, Shoretel, Asterisk, FreePBX) Penetration Testing / Server Security/Hardening WHMCS, DirectAdmin, cPanel, Webmin AWS, Azure Config/Management

Hello , I have reviewed your project description and I would like to handle infection XMRig CPU Miner process with all features as per your requirements . I have extensive experience handling varying security threats, regulating data access, and leading various security task forces. I have the skills to implement network security software and hardware to help maintain a secure database. I can analyze your network system to look for areas where the security is weak and recommend ways to enhance your security. Through continuous education and research, I am up-to-date on industry trends and technologies, and remain one step ahead of all cyber attacks. It is my focus to ensure company information remains safe and in the proper control. I would appreciate the opportunity to meet with you further talk about my previous experience. Best Regards.

Hey, I've been doing cybersecuriy and reverse engineering for the last 4 years. I can help you with this case ASAP. First of, you can see the process right? Thats good, means its not injected in memory. So.. why is server rebooting? In order to prevent being removed from the system, malwares use a set of features to make them persistant. In this case, your servers executed under admin rights the malware, being able in this way to become a Critical/system process that causes BSOD(blue screen or reboot) when process is removed. Also, the malware is coming back after reboot, that means its installed. There are multiple ways of achieving this, the most common ways are: 1) Registry modification, so that malware is installed on RUN folder and executed on startup. 2) Added a task on windows scheduler. There are more complex methods, I know most of them if not all. Overall, I've done many disinfections in the past, if you want a skilled person in this field, hire me. I'll be waiting for you on live chat, hopefully we can resolve this problem today.