What are his dev mining addresses again? I am too lazy to start the miner and fetch them. From what I remember he used something like a Coinbase address for his fees so impossible to tell if he hodl'd the coins or sold them immediately.
I guess it is
0xd69af2a796a737a103f12d2f0bcc563a13900e6f which can found on the first post of this thread sixteen times.
Virus Trojan?
Yes, do not download anything from EthereumPill github