I use Autoruns from Microsoft.
I found that dllhost.exe was being used to piggy-back a file called MicrosoftRuntimeUpdate.vbe ,
This file was the guilty crypto mining trojan.
My Solution was to end the task running.
Open the .vbe file in notepad
Added a few digits and letters in the code to...