Shadowsocks Miner Trojan

Researchers have recently detected a new cryptocurrency miner Shadowsocks Miner Trojan. It uses victims’ PCs resources to mine Monero, Bitcoin, Dashcoin, or other cryptocurrencies for its developer. This Trojan usually enters users’ systems without permission, it does not have an interface, and, of course, it works in the background, so it does not surprise us at all that the majority of people do not know anything about its installation. Most probably, you suspect that its presence might be the reason your computer works slower if you are reading this article. If it turns out that it is really active on your system, delete Shadowsocks Miner Trojan right away without hesitation. It is usually not that easy to remove Trojan infections from the system, so we are not surprised at all that Shadowsocks Miner Trojan leaves leftovers on victims’ PCs when it is deleted too. No matter how hard it might be to remove this infection, you must delete it as soon as possible because its presence will only bring all kinds of problems. If it is not enough, read the rest of this article to find out why our experienced specialists have a negative opinion about it.

Shadowsocks Miner Trojan does not do anything good to victims whose PCs’ resources it uses. They do not get some money it mines either. The only activity it performs is mining the cryptocurrency to its developer, so do not be surprised that your CPU’s power is used in full swing and, as a consequence, your machine is running considerably slower, it freezes more often, and some programs crash out of the blue. You cannot do anything to change it, so we see the only solution to the problem here – the complete Shadowsocks Miner Trojan removal. There is no other way to stop it. No, it is not enough to restart the computer because this infection can start together with the Windows OS, meaning that it will start working again the second your Windows OS loads up even if you reboot your computer. We cannot promise that it will be very easy to delete it because it leaves some leftovers although it has an uninstaller, but we cannot let you keep it installed on your computer either because it will not stop using your CPU’s power anytime soon, and, consequently, you might find it impossible to perform daily activities.

You could have downloaded Shadowsocks Miner Trojan from the web and then installed it on your computer by mistake, but it is more likely that it has arrived on your PC in a software bundle next to third-party applications. These applications might not be harmful, but there is no doubt that Shadowsocks Miner Trojan is nothing else than malicious software. Although Shadowsocks Miner Trojan does not have an interface, it is still possible to find out about its successful entrance. First, if it has slithered onto your computer, you should be able to find its entry in Control Panel. Second, you should be able to find new registry keys in the system registry, e.g. HKEY_CURRENT_USER\Software\Shadowsocks. Last but not least, you will see its folder in %PROGRAMFILES(x86)% or %PROGRAMFILES%. Finally, you will find two scheduled tasks in %WINDIR%\Tasks and %WINDIR%\System32\Tasks. Do not let another similar infection to enter your computer again and apply all these undesirable changes on your system – go to install security software on your computer after the full Shadowsocks Miner Trojan removal.

You will definitely have to put some effort into the manual Shadowsocks Miner Trojan removal because it leaves some leftovers. Specifically speaking, you will need to delete two registry keys, two files, and two scheduled tasks yourself after you uninstall it through Control Panel. Of course, it does not mean that it is the only way to delete this cryptocurrency miner. It can be fully eliminated automatically as well. Of course, you need to have a special tool to erase it in an automatic way. A bunch of tools claiming to be powerful malware removers are available on the market, but not all of them are powerful scanners for sure, so double-check the scanner you are planning to install before actually doing that.

How to delete Shadowsocks Miner Trojan

Windows XP

1. Click Start.
2. Select Control Panel.
3. Click Add or Remove Programs.
4. Select the cryptocurrency miner.
5. Click Remove.

Windows 7/8/8.1/10

1. Press Win+R.
2. Enter Control Panel in the box and press Enter.
3. Click Uninstall a program.
4. Select the undesirable program and click Uninstall.

Delete Shadowsocks Miner Trojan leftovers

1. Tap Win+R on your keyboard.
2. Type regedit.exe in the box and click OK.
3. Delete two registry keys:

• HKEY_CURRENT_USER\Software\Shadowsocks
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ShadowsocksS

4. Close Registry Editor and launch Explorer (Win+E).
5. Type C:\Applications in the URL bar and press Enter.
6. Delete Service.exe and websock.exe.
7. Open %WINDIR%\Tasks and delete ^ShadowsocksS\.job$.
8. Remove ^ShadowsocksS$ from %WINDIR%\System32\Tasks.
9. Empty Recycle bin.