Mining virus reappears in the world, and China Telecom is also infected

Recently, China Telecom Jiangsu Branch encountered some embarrassing problems. The "Tianyi Campus Client" provided for download on its campus portal website (pre.f-young.cn) was implanted with a backdoor virus. The virus can accept remote commands from hackers and use infected computers to increase advertising traffic. It will also release the "Monero" mining virus for mining.

It is reported that after users install the "Tianyi Campus Client", the speedtest.dll file, which is the main body of the virus, will be automatically released in the installation directory. All operations such as downloading and releasing other virus modules are performed by this file. After the ad-brushing module is executed, it will create a hidden IE window, and then start reading cloud instructions, simulating users to operate the mouse and keyboard to brush ads in the background. In order to prevent users from noticing this situation, the sound card is also blocked from playing the sound in the ad page.

Another virus mining module was found to mine "Monero", a digital virtual currency similar to "Bitcoin", which costs about 500 yuan per stick. When the virus module starts "mining", the computer CPU resource usage soars significantly, causing the computer performance to deteriorate and the heat to rise. At the same time, the computer fan will run at a high speed, and the computer noise will also increase.

Finally, it was discovered that a Chinese Calendar with the signature of "China Telecom Co., Ltd." also contained the backdoor virus. Generally speaking, the signature of a large enterprise like Telecom should not have any problems. The virus implanted this time is indeed a bit strange, but how it was implanted is still unknown.