Windows_stealth.exe?

Kierannock · 10 Jul 2013 at 19:32

Hi, after installing my new PSU I noticed my pc took a tad longer to boot up, so I checked start up programs and then processes, everything there looked normal except one thing
I can't find upload image so i'll type what i see
Image Name | User Name | CPU |Memory (Private working set) >
Windows_stealth.exe*32 | Kiwi | 00 | 2496k
> Description
Windows_stealth

I tried the regular things, open file location, and it's just an EXE file in my Appdata/roaming folder, i also noticed a 2nd oddity in the form of another exe titled "stel" however, on with Windows_Stealth.exe, i tried googling to no avail, tried ending process but it auto restarts, running AVG finds nothing, is this something I should worry about?
Thanks in advanced
P.S. anything about "stel" would also be appreciated.

Hyburnate · 10 Jul 2013 at 19:35

Hmmm, sounds like some kind of bitcoin mining program by a quick Google.

Is your GPU Usage up recently? What are your GPU Temps like?

Kierannock · 10 Jul 2013 at 19:42

Quick restart and a rescan with avg gets it as a trojan horse generic28.bxfa
other than programs loading a second to 2 slower everything seems fine, avg recons it "secured" the file but I don't trust it, i'm gonna try a safe mode scan and remove.

Hyburnate · 10 Jul 2013 at 19:54

I'm not very good at things like this I'm afraid, I'd definitely say its Bitcoining/Litecoining though.

KIA · 10 Jul 2013 at 20:58

MBAM in safemode.

Kierannock · 10 Jul 2013 at 21:15

I did a scan with avg while in safemode and deleted windows stealth and the stel thing+emptied bin manually, things are running good now, still unsure what stel was though, thanks