I will investigate more,  I am wondering if this virus may have created a hidden partition on boot up, I will check partition layout on good ant miner.    I have seen others post that they have installed latest firmware from bitmain and the virus comes back after a day or two.

I am wondering if this partition does not get wipe durning a firmware upgrade and when the miner is rebooted that partition boots first and then loads the miner software.

Also:  I have seen other threads showing this active connection to :  192.169.6.241,  that is a USA hosting company,  filing a complaint against that HOST.

Thoughts?