Terminating Wise XMRig (Trojan Horse)

What is Wise XMRig? And how does it work?

Wise XMRig is a Trojan horse infection that utilizes a victim’s CPU resources to mine digital currency. The Trojan got its name Wise XMRig because of its uninstall entry which is called Wise that it adds to Windows once it is installed. During its infiltration, it will install a miner called AudioHD.exe which is automatically launched once users logs into their PCs. It then attempts to mine digital currency using victims’ computer processor.
Mining digital currency without a user’s knowledge is definitely a malicious activity as it uses an extensive amount of CPU power which results to high processor’s temperature that will decrease system performance. In other words, this miner will cause tons of system issues and as time passes, the system’s performance will deteriorate. But how do you exactly know if your computer is infected with Wise XMRig Trojan? There really is no outward indication that a miner is installed in your computer unless you check your Task Manager. If your computer is infected with the Wise XMRig miner, you should notice the following signs:

You will see an uninstall entry named Wise.
You will see a process named exealong with a decription of XMRig that runs in the Task Manager and uses a lot of CPU resources.
You will see a process named exe along with a description of WindowsHub that also runs in the Task Manager.
Your Windows PC will minimize and maximize excruciatingly slow and whenever you play audio or video, it will stutter.
Your programs won’t open as fast as before.
Overall slowness of system performance.

How is Wise XMRig miner disseminated online?
This Trojan horse spreads through software bundles. Wise XMRig is added as an extra program in a software package. Meaning to say, you can get infected with this Trojan infection when you install software bundles using only the quick or standard setup instead of the recommended Advanced or Custom setup – this setup allows you to deselect any extra programs added in the bundle. So if you are still planning on installing software bundles or freeware and shareware in the future, make sure that you always opt for the recommended setup instead of rushing the installation with the quick setup.
Carefully follow the removal guide below to get rid of Wise XMRig.
Step 1: Open your Task Manager by tapping Ctrl + Shift + Esc on your keyboard.

Step 2: Once the Task Manager is opened, go to the Processes tab and locate the AudioHD.exe and winserv.exe processes and end each one of them.

Step 3: Close the Task Manager and open Control Panel by pressing the Windows key + R, then type in appwiz.cpl and then tap Enter or click OK.

Step 4: Look for Wise and then uninstall it.

Step 5: Close Control Panel and then tap the Win + E keys to open File Explorer.
Step 6: Navigate to the following locations.

%HOMEDRIVE%\Applications\
%WINDIR%\Tasks
%WINDIR%\System32\Tasks
%USERPROFILE%\Downloads
%USERPROFILE%\Desktop
%TEMP%

Step 7: Look for the malicious files created by Wise XMRig such as AudioHD.exe and winserv.exe and then delete them.
Step 8: Close the File Explorer.
The next step below is not recommended for you if you don’t know how to navigate the Registry Editor. Making registry changes can highly impact your computer. So it is highly advised to use PC Cleaner Pro instead to get rid of the entries that the PUP created. Unlike Wise XMRig, PC Cleaner Pro is a trusted program that helps in improving your computer’s overall performance by repairing any registry issues as well as optimizes your system. If you are not familiar with the Windows Registry skip to Step 14 onwards. However, if you are well-versed in making registry adjustments, then you can proceed to step 10.
Step 9: Open the Registry Editor, to do so, tap Win + R and type in regedit and then press enter.

Step 10: Go to the following locations and look for the registry keys and sub-keys created by Wise XMRig Trojan.

HKEY_CURRENT_USER\Software\winserv.exe
HKEY_CURRENT_USER\Software\exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ winserv.exe

Step 12: Close the Registry Editor and empty your Recycle Bin.
Once you got rid of Wise XMRig from your PC, follow the advanced guide below to get rid of it’s the files it has created.
Perform a full system scan using SpyRemover Pro. To do so, follow these steps:

Turn on your computer. If it’s already on, you have to reboot
After that, the BIOSscreen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Optionuse the arrow keys and select Safe Mode with Networking then hit
Windows will now load the SafeMode with Networking.
Press and hold both R key and Windows key.

If done correctly, the Windows Run Boxwill show up.
Type in explorer http://www.fixmypcfree.com/install/spyremoverpro

A single space must be in between explorer and http. Click OK.

A dialog box will be displayed by Internet Explorer. Click Run to begin downloading the program. Installation will start automatically once download is done.