mssvc.exe

Krag

There's an executable called mssvc.exe in AppData\Roaming\Qt\MSSvc
It starts by itself and uses around 15 % of my CPU. What is it? Should I delete it?

mrjj

Hi
its seems a bit suspicious. Checked on 2 win 7 machines and i don't have it.
And no idea why it would live in qt roaming profile if it belonged to a program you have installed.
Maybe try to scan with or other malware scanner you prefer.
https://www.malwarebytes.org/downloads/
(just select free)

Krag

@mrjj it was a BitCoin miner. I have no idea how that got in there. Does Qt even have a Qt folder in AppData\Roaming or should I remove the the whole folder with all its contents?

Chris Kawa

Outside of installation directory Qt usually puts stuff in "QtProject" folders or registry keys. Whatever that thing you have is it's not placed there by Qt.
The name is suspicious as well, as "mssvc" is a windows service name, but located in the System32 directory, so this thing tries to be sneaky for whatever reason.

It might be that your computer became someone's botnet zombie and mines bitcoins for him.

Krag

@Chris-Kawa I deleted the MSSvc folder but there is a legit looking file in the Qt folder. It's called qtaccount.ini
It contains my email address and some encrypted tokens. Does it belong to Qt?

Chris Kawa

Ah, yes, this seems to be a file used by the Qt's MaintenanceTool to store the credentials.
I guess I was just right about the "usually" part ;)

Krag

I see. Thanks :)