1

I noticed that a process named 'mono' was running with high CPU usage. The thing is, I have never installed mono, nor can I find it anywhere on my disk.

The only program that I have installed that might use mono is powershell, but I couldn't find any information on whether this makes use of mono. I also wasn't running powershell at the time when I noticed the high CPU usage.

I have found some articles mentioning that mono is used on macOS in some malware, but those articles are old and the vulnerability seems to have been fixed by Apple. Still might it be reason for concern that mono is running on my system?

Improve this question

2 Answers 2

Reset to default
3

I assume you've used Activity Monitor to find the process. There you can just double-click the process in order to get more information about it - such as for example which program started it. That should hopefully make it possible for you to figure out, which program you're using that has started mono.

PowerShell is a .NET program that runs on .NET (Core). Today, .NET Core and Mono have merged and it is the same program. So it does sound likely that this process was started due to you using PowerShell. You can use the above mentioned method to find out - or you could simply kill mono using Activity Monitor and then start up PowerShell and see if you get a new mono process.

No, there's as such nothing about having mono running that would directly lead you to suspect having malware. The old articles you have found definitely are no cause of concern at all. They actually describe the opposite of what you think. I.e. the malware does not install mono, rather it preys on users that already have mono installed. So there's nothing that indicates that having mono running means that it was put there by malware.

Improve this answer
2

If you are running VS code and have the C# for Visual Studio Code (powered by OmniSharp) extension installed then it is likely that mono is from that extension. I disabled the extension, exited VS code, killed the mono process(es) and restarted VS code and mono was gone.

Looks like mono will be removed from this extension at some point. https://github.com/OmniSharp/omnisharp-vscode/issues/5120

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .