DOCSEARCHbyAlgolia
Submit Docs

Miner Search Documentation

repository·master·Indexed 23 days ago

https://github.com/blendlog/minersearch

A specialized auxiliary scanning utility designed to detect and remove hidden cryptominers from a system by searching for suspicious files, directories, and processes. It is not a full-scale antivirus. The tool requires .NET Framework 4.8 and supports various command-line arguments for console mode, silent scanning, and quarantine management, as well as customizable interface languages (English and Russian).

Tokens
2.7K
Snippets
2
Records
11
Agent score
78%

What's inside Miner Search

  1. Install and run Miner Search

    master

    Miner Search is a tool designed to find and destroy hidden miners. It is a helper tool for finding suspicious files, directories, and processes, but it is not an antivirus.

    Requirements

    • .NET Framework 4.8 is required.
    • Windows 7 is no longer supported; development for this OS has ceased.

    Basic Usage

    1. Fully unpack the downloaded archive into a separate folder.
    2. Run the application.
    3. Wait for the scan to complete.
    4. On first use, you may be asked to send scan results to the author (optional).
    5. After scanning, a summary report of threats will be shown. You can view a detailed report by clicking "Открыть отчёт" (Open report).
    6. To manage threats, click "Карантин" (Quarantine) to open the Quarantine Manager, where you can either delete or restore files.

  2. Use Miner Search CLI arguments

    master

    Miner Search supports command-line arguments for advanced usage. To use them:

    1. Open a Command Prompt (cmd) as an Administrator.
    2. Hold Shift and right-click the application to select "Copy as path".
    3. Paste the path into the command prompt and append the desired parameters separated by spaces.

    Note: Parameters are not required to be in a strict order.

  3. How to use Miner Search

    master

    Miner Search is an auxiliary tool designed to find and destroy hidden mining programs by searching for suspicious files, directories, and processes. Note: It is not an antivirus software.

    Basic Workflow

    1. Setup: Fully extract the program archive into a standalone folder.
    2. Run: Execute the application and wait for the scan to complete.
    3. Reporting: On first use, you may optionally report scan results to the author.
    4. Review Results: After scanning, a window will appear with a brief report of eliminated threats. Click "Open Report" (打开报告) for details.
    5. Manage Files: Click the "Quarantine" (隔离区) button to open the Quarantine Manager, where you can either permanently delete files or restore them.

  4. Switch the application language

    master

    To change the interface language between English (EN) and Russian (RU):

    1. Create a file named language.cfg in the application folder if it does not already exist.
    2. Open language.cfg with any text editor.
    3. Set the content to either RU or EN and save the file.

  5. Run Miner Search with command-line arguments

    master

    To use additional startup parameters, you must run the command line (cmd) as an Administrator.

    Steps to execute with arguments:

    1. Open a command prompt as Administrator.
    2. Hold Shift and right-click the application executable, then select "Copy as path".
    3. Paste the path into the command prompt.
    4. Add your desired arguments after a space.

    Note: Arguments do not need to be in a specific order.

  6. Change the application language

    master

    To switch the language in Miner Search, follow these steps:

    1. Create a file named language.cfg in the application folder (if it does not already exist).
    2. Open the file with any text editor.
    3. Set the preferred language to either RU or EN.
    RU

  7. Reference: Miner Search CLI flags

    master

    The following command-line arguments are available for Miner Search:

    ShortLongDescription
    -h--helpShow help
    -a--accept-eulaAccept the license agreement
    -nl--no-logsDo not write logs to a file
    -nstm--no-scantimeScan processes only
    -nwmi--no-scan-wmiDo not check WMI integrity or event subscriptions
    -nr--no-runtimeDo not scan processes (scan only directories, files, registry keys, etc.)
    -nse--no-servicesSkip scanning services
    -nst--no-scan-tasksSkip scanning scheduled tasks
    -nsu--no-scan-usersSkip scanning user profiles
    -nss--no-signature-scanSkip signature scanning of files
    -nsr--no-scan-registrySkip scanning the system registry
    -nrc--no-rootkit-checkDo not check for rootkits
    -nch--no-check-hostsSkip checking the hosts file
    -nfw--no-firewallSkip scanning firewall rules
    -cm--console-modeActivate console mode without dialog windows
    -p--pausePause before cleaning
    -ret--remove-empty-tasksDelete a task from Task Scheduler if the application file no longer exists
    -so--scan-onlyDisplay malicious or suspicious objects but do not perform treatment
    -fs--full-scanAdd other local drives for signature scanning
    -f--forceSuppress confirmation requests for potentially dangerous functions
    -s--selectScan only the selected directory, including subdirectories
    -s=--select= <path>Same as --select, specify the path to the directory
    -si--silentEnable silent (background) mode without dialogs. Logs are still recorded. Incompatible with --select or --winpemode
    -d=--depth=<num>Maximum search depth. Example: -d=5 (default is 8)
    -v--verboseOutput detailed process info to console and disable file filtering. Increases log size
    -w--winpemodeRun in WinPE mode (skips processes, registry, firewall, services, and scheduled tasks)
    -q--open-quarantineOpen the quarantine manager
    -res--restore= <list>Restore files from quarantine in console mode (e.g., 1,2,3). Use -q -cm to view list
    -del--delete= <list>Delete files from quarantine in console mode (e.g., 1,2,3). Use -q -cm to view list

  8. Reference: Miner Search command-line arguments

    master

    Miner Search supports various flags to modify scanning behavior, modes, and quarantine management. Use -h or --help to display this information.

    | 短选项 | 长选项 | 描述 |
|:---|:---|:---|
| `-h` | `--help` | 显示此帮助信息 |
| `-a` | `--accept-eula` | 接受用户许可协议（EULA） |
| `-nl` | `--no-logs` | 不将日志写入文件 |
| `-nstm` | `--no-scantime` | 仅扫描进程 |
| `-nwmi` | `--no-scan-wmi` | 不检查 WMI 完整性及/或事件订阅 |
| `-nr` | `--no-runtime` | 不扫描进程（仅目录、文件、注册表键等） |
| `-nse` | `--no-services` | 跳过扫描服务 |
| `-nst` | `--no-scan-tasks` | 跳过扫描计划任务 |
| `-nsu` | `--no-scan-users` | 跳过扫描用户配置文件 |
| `-nss` | `--no-signature-scan` | 跳过文件签名扫描 |
| `-nsr` | `--no-scan-registry` | 跳过扫描系统注册表 |
| `-nrc` | `--no-rootkit-check` | 不检查 rootkit 存在 |
| `-nch` | `--no-check-hosts` | 跳过检查 hosts 文件 |
| `-nfw` | `--no-firewall` | 跳过扫描防火墙规则 |
| `-cm` | `--console-mode` | 启用无对话框的控制台模式 |
| `-p` | `--pause` | 清理前暂停 |
| `-ret` | `--remove-empty-tasks` | 如果应用程序文件不存在，则从任务计划程序中删除任务 |
| `-so` | `--scan-only` | 仅显示恶意或可疑对象，不执行处理 |
| `-fs` | `--full-scan` | 将所有其他本地驱动器加入签名扫描 |
| `-f` | `--force` | 用于抑制潜在危险功能的确认提示 |
| `-s` | `--select` | 仅扫描选定的目录，包括子目录 |
| `-s=` | `--select= <路径>` | 同 `--select (-s)`。其中 `<路径>` 指定要扫描的目录路径 |
| `-si` | `--silent` | 启用无声（后台）模式，无对话框。应用程序进入后台模式，不显示消息，但仍写入日志。与 `--select` 或 `--winpemode` 参数不兼容。 |
| `-d=` | `--depth=<num>` | 其中 `<num>` 为最大搜索深度级别。用法示例：`-d=5`（默认为 8） |
| `-v` | `--verbose` | 向控制台输出进程的详细信息并禁用对未被识别为恶意的文件的过滤。 |
| `-w` | `--winpemode` | 以 WinPE 模式启动扫描（不扫描进程、注册表、防火墙规则、服务、计划任务） |
| `-q` | `--open-quarantine` | 打开隔离区管理器 |
| `-res` | `--restore= <列表>` | 在控制台模式下从隔离区恢复文件（例如 `1,2,3`）。输入 `-q -cm` 查看列表。 |
| `-del` | `--delete= <列表>` | 在控制台模式下从隔离区删除文件（例如 `1,2,3`）。输入 `-q -cm` 查看列表。 |

  9. Interpret Miner Search log symbols

    master

    The following symbols are used in the logs to indicate the status or severity of events:

    SymbolDescription
    [!]Minor warning
    [!!]Notable warning
    [!!!]Threat detected
    [!!!!]Rootkit detected
    [Reg]Scanning registry item
    [+]Operation successfully completed (processing, deletion, etc.)
    [x]Error
    [xxx]Severe error (e.g., running in a sandbox)
    [#]Status
    [.]Description
    [_]Unlocking directory and deleting if empty
    [i]Information
    [$]Scan duration

  10. Understand Miner Search log symbols

    master

    The application uses specific symbols in its logs to indicate the status and severity of findings:

    SymbolDescription
    [!]Minor warning
    [!!]Warning worth paying attention to
    [!!!]Threat detected
    [!!!!]Rootkit detected
    [Reg]Scanning registry key(s)
    [+]Successful completion of action (treatment, removal, etc.)
    [x]Error
    [xxx]Critical error (e.g., running in a sandbox)
    [#]Status
    [.]Description
    [_]Unblocking directory and deleting if empty
    [i]Info
    [$]Scan elapsed time

  11. Use Miner Search launch parameters

    master

    You can customize the scan behavior using command-line arguments. To use them:

    1. Run the Command Prompt (cmd) as Administrator.
    2. Hold Shift and right-click the application executable, then select "Copy as path".
    3. Paste the path into the command line and append the desired parameters after a space.

    Common Parameters

    ShortLongDescription
    -h--helpShow help message
    -a--accept-eulaAccept the EULA
    -cm--console-modeActivate console mode without dialog boxes
    -si--silentEnables silent (background) mode. Incompatible with --select or --winpemode.
    -so--scan-onlyDisplay suspicious objects but do not perform treatment
    -fs--full-scanAdd all other local drives for signature scanning
    -s=--select=<path>Scan only the specified directory and its subdirectories
    -d=--depth=<num>Set maximum search depth (e.g., -d=5). Default is 8.
    -q--open-quarantineOpen the quarantine manager
    -res=--restore=<list>Restore files from quarantine in console mode (e.g., 1,2,3)
    -del=--delete=<list>Delete files from quarantine in console mode (e.g., 1,2,3)