This program is designed to find and destroy hidden miners. It is an auxiliary tool for searching suspicious files, directories, processes, etc. and is NOT an antivirus.
Caution
Version v1.4.9.2
- Added a new FormThreatReview form allowing users to choose an action for each detected threat
- Moved the "Allow sending statistics" toggle to a separate form
- Fixed false positive triggers related to Throne proxy
- Fixed a bug where UAC status was not being determined
- Fixed a ReleaseMutex bug that caused the application to crash after scanning in --silent mode
- Added validation for invalid characters when checking scheduled tasks & firewall rules
- The main FinishEx window no longer has the 'TopMost' attribute
- Added a link to the official application page
- Updated rules for detecting and removing new cryptominers
Completely unzip the archive with the program into a separate folder and launch the application. Wait for the scan to complete. When using the program for the first time, you are offered to report the scan results to the author at your discretion. After completion, a form will be shown with a brief report on the threats that have been eliminated. You can view the detailed report by clicking the "Open Report" button. Clicking the "Quarantine" button will open the Quarantine Manager, in which you can completely delete a file or restore it.
How to switch language in the app?
- Create language.cfg file if it doesn't exist yet
- Open it with any text editor
- Set your preferred language: RU or EN
The application also supports additional launch parameters (listed below). To use them, you should:
- Run the command line (cmd) as administrator
- Hold Shift and right-click on the application - select "Copy as path"
- Paste the path into the command line and add the necessary parameters* after a space
Additional launch parameters (usually not required):
| Short Option | Long Option | Description |
|---|---|---|
-h |
--help |
Show this help message |
-a |
--accept-eula |
Accept the End-User License Agreement (EULA) |
-nl |
--no-logs |
Do not write logs to a file |
-nstm |
--no-scantime |
Scan only processes |
-nwmi |
--no-scan-wmi |
Do not check WMI integrity and/or event subscriptions |
-nr |
--no-runtime |
Do not scan processes (only directories, files, registry keys, etc.) |
-nse |
--no-services |
Skip scanning services |
-nst |
--no-scan-tasks |
Skip scanning scheduler tasks |
-nsu |
--no-scan-users |
Skip scanning user profiles |
-nss |
--no-signature-scan |
Skip signature scanning of files |
-nsr |
--no-scan-registry |
Skip scanning system registry |
-nrc |
--no-rootkit-check |
Do not check for rootkit presence |
-nch |
--no-check-hosts |
Skip checking the hosts file |
-nfw |
--no-firewall |
Skip scanning firewall rules |
-cm |
--console-mode |
Activate console mode without dialog boxes |
-p |
--pause |
Pause before cleanup |
-ret |
--remove-empty-tasks |
Remove task from Task Scheduler if its application file does not exist |
-so |
--scan-only |
Display malicious or suspicious objects, but do not perform treatment |
-fs |
--full-scan |
Add all other local drives for signature scanning |
-f |
--force |
Used to suppress confirmation prompts for potentially dangerous functions |
-s |
--select |
Scan only the selected directory, including subdirectories |
-s= |
--select= <path> |
Same as --select (-s). Where <path> specifies the directory path to scan |
-si |
--silent |
Enables silent (background) mode without dialog boxes. The application switches to background mode, messages are not displayed, but are still written to the log. Incompatible with --select or --winpemode parameters. |
-d= |
--depth=<num> |
Where <num> is the maximum search depth level. Example usage: -d=5 (default is 8) |
-v |
--verbose |
Outputs detailed information about processes to the console, and also disables the filter for lines with files not recognized as malicious. May increase log file size. |
-w |
--winpemode |
Starts scanning in WinPE mode (without scanning processes, registry, firewall rules, services, scheduler tasks) |
-q |
--open-quarantine |
Open the quarantine manager |
-res |
--restore= <list> |
Restore files from quarantine in console mode (e.g., 1,2,3). Enter -q -cm to view the list. |
-del |
--delete= <list> |
Delete files from quarantine in console mode (e.g., 1,2,3). Enter -q -cm to view the list. |
- Not necessarily in strict order
Symbols in logs
| Hint | Description |
|---|---|
| [!] | Minor warning |
| [!!] | Warning worth paying attention to |
| [!!!] | Threat detected |
| [!!!!] | Rootkit detected |
| [Reg] | Scanning registry key(s) |
| [+] | Successful completion of action (treatment, removal, etc.) |
| [x] | Error |
| [xxx] | Critical error: for example, when running in a sandbox |
| [#] | Status |
| [.] | Description |
| [_] | Unblocking directory and deleting if empty |
| [i] | Info |
| [$] | Scan elapsed time |
Stop and remove malicious processes and their support components, which make malware deletion harder
General information form
