trojan.bitcoin.miner help needed.

[Minjon]

So i installed open office like 2 weeks ago, 1 week ago i started getting o.exe has stopped working while mostly watching youtube videos i tried to find what it was to no avail so i thought it must have been flash player since i scanned both with MSE and Malwarebytes and it showed no threats.

The other day friend told me openoffice is now libre office so i downloaded that and deleted openoffice first everything seemed fine until today i came and booted my machine, malwarebytes instantly reported i have trojan.bitcoin.miner o.exe and openoffice.exe so it quarantined them immediately, and it showed it was in appdata/roaming/miner folder, after that i did some research about this malware and i never saw the processes they listed miner.exe btc.exe and i go frequently in taskbar menager daily . i never saw fans going up or temperature since i have msi afterburner when im standby mode and i only found one registry about windows/run/openoffice.exe which i removed.

After that i did full scan with malwarebytes:

Files Detected: 2

C:\Users\David\AppData\Roaming\Miner\c.exe (Trojan.BitcoinMiner) -> Quarantined and deleted successfully.

C:\Users\David\AppData\Roaming\Miner\gc.exe (Trojan.BitcoinMiner) -> Quarantined and deleted successfully.

(end)

Then i did a full scan with MSE and it found nothing.

Then i used combofix and it deleted 1 file:

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\SysWow64\d2d1debug1.dll

But i still do not know do i delete this folder

and i have no idea if i removed the malware fully :(

[Ssoele]

Yes, delete that folder, just to be sure.

Second, if you downloaded OpenOffice from the official website, then the chances of that being a virus are very very small.

(However, if that was the problem, then you have a much bigger problem. Then someone could be spoofing your DNS or something like that.)

[Minjon]

Deleted last night and booted computer today and no sign of folder /miner, i think il run another full scan with malwarebytes just to be sure, i got openoffice from my brothers usb ( maybe infected?) like 2 3 weeks ago so i do not know where he got it from. I also uninstalled java since i found on malwarebytes forum one guy got this virus through java.