(Apologies to the admins - it looks like trying to include .e x e in the text of the post gets it blocked. Blunt but safe, makes sense.)

My Lenovo Tiny had its fan on full speed and cmd consuming 30% of CPU whenever Task Manager isn't running. Which tells me I've got a cryptominer that stops whenever Task Manager is launched.

What I tried so far:

(Updated list)

1) Ran Bitdefender and Malwarebytes scans. Both founds signs of something, and claimed to have remedied it. 

2) Used System Informer to generate CSV dumps of processes before and after Task Manager to see if I can identify the difference with a vlookup. No luck - everything that runs before but not after seems to be legit.

3) Ran GlaryUtilities to remove the creatively named "MicrosoftMalwareProtection" from startup sequence.

4) Blocked cmd with a new firewall rule. This stopped the damn thing, but the code is obviously still somewhere on the my system.

5) Enabled Cryptomining protection in Bitdefender. Which took over managing the firewall, and of course the Bitdefender firewall didn't have the rule to block cmd, so the miner switched back on. Added cmd rule to Bitdefender firewall - it stopped again. The Cryptomining Protection in Bitdefender didn't do anything.

6) Downloaded and ran FARBAR. No luck.

Anything else I can do here besides resetting the PC?