Bitcoin Forum

How to detect it and protect it?   ::) ::)

Actually there are some software for mining that has a virus in which it will detect by your antivirus and you must need to turn off your anti virus in order to start the software but it is risky because your computer may have the virus that the anti virus has been detect so it would be better if you will ask first some friends on what they in order to install safely their mining software and what terms of agreement they have sign into.

Check your CPU & RAM access, take a look at the network activity & process that's running on your PC. That's how most diagnostics work. Other than that, use an antimalware or antivirus with the latest update to find malicious files on your computer.

Protecting yourself from viruses like that is easier said than done. But, most likely you're safe if you don't click a malicious link, download malicious website, using many flash disk/external drive that goes everywhere, etc.

step 0 is prevention:
- never download or install shady binaries that you don't know the source of and don't trust.
- always make sure you have real software by verifying their digital signature if possible
- if you have to run a shady application then use a sandbox so that in case it contained anything malicious it wouldn't infect your computer.
- never visit shady website
- and as the last line of defense if you are on a closed source OS such as Windows or Mac you can install a good anti virus.

if you are already infected
best solution would be formatting the hard disk and reinstalling the OS but since that is hard you can install a good anti virus or use a rescue disk to scan and try to remove it.
detecting this type of malware is easy since they have to use excessive amount of computing power so the symptoms are obviously increased CPU or GPU usage, hearing the fan sound (if your fan speed is adjusted according to usage),...

Pretty easy to detect to be honest. Just doing some casual browsing on a few non resource heavy websites and suddenly your computer/laptop's fan is going ham like it was some helicopter or something even though you're sure that you aren't installing/updating something, then there's chance that your device is infected.

As for protection, well, in summary just don't be stupid or careless. That's pretty much it. Also, update your OS to get the security updates.

How to detect:
1. Check resource allocation using task manager. Identify any unknown program using high resources. It's a manual process.
2. Buy a licensed version of nternet security package which contains anti virus, anti malware/spyware and live internet usage. It's automated and easy. Don't rely on free to download antivirus softwares

How to protect:
1. Check point no 2 above.
2. Don't download random softwares from the web.
3. Strictly don't use any torrent related websites

I think you will do just great if you follow these instructions.

It is very difficult to detect the virus especially if it was being hidden by the mining software that you have downloaded. Antivirus is your only option to detect them so it will be best if you will install the top ranking antivirus in order to lessen the chance of any virus to bypass it.

Aside from it, it will be best also if you will download the mining software that were being used by many so you can assure that it was tested already and there are no virus inside your download.

Mining Bitcoins with a PC is absurd.You will get a few cents,if you are mining 365 days 24/7 (if electricity costs are zero).Do you mean the ransomeware virus that blocks your PC and asks to bitcoin payments?
The guys mentioned how to protect yourself in the previous posts,but I can share my personal experience.
I'm using Malwarebytes anti-malware software and I'm scanning my PC every once and a while.
When I'm browsing,I use a handy little software called Sandboxie to protect my PC from spreading the virus  across all system files and libraries.It keeps the malicious files inside a sandbox,so I can delete them later.

multiply that by several hundred thousand machines, and a single botnet could mine millions of dollars worth of monero. that's the usual scheme. https://www.zdnet.com/article/a-giant-botnet-is-forcing-windows-servers-to-mine-cryptocurrency/

I still remember the days where our network had trouble with internet connections. We checked our neighbor's if they had the same problem but it turned out that we were the only ones who were experiencing the problem. Our computers were not able to detect the mining virus. It was just sad to tell that if people with no technical knowledge could encounter these things, they wouldn't notice that someone is actually using their internet and computer without their permission.

The solution for this is to find the root of this scheme. The authorities must find the person or group who operates these kinds of software and take them to jail. As a miner, you should always have virus protection software. Anyway, I have found an interesting online article that relates to How to Detect and Remove the BitCoin Miner Virus (https://antivirus.comodo.com/blog/comodo-news/detect-remove-bitcoin-miner-virus/), read the content it is knowledgeable to know.

It is, actually. Remember that we're specifically talking about mining here. It's easily easily noticeable if your device is unusually using up too much unnecessary power especially if you aren't even doing anything that resource-heavy.

It would surely use more than 70% of your CPU's power and graphic cards power because the virus is taking your computer's resources for themselves this kind of problem is a common issue regarding what does the virus does to your computer, and surely prevention is better than cure but what if it bypasses that prevention most of us are talking about, I think this kind of Virus can be removed by Malwarebytes, you can surely double-check it just to be sure and you can even reset your browser in a default settings as well.

Dont wait for you to get infected with any other viruses or malwares on your pc.All things would depend on how you do prevent it on the first place.
Dont click any links or download without knowing its source.

How to detect it? Usually your AV would able to detect such thing but we know that there were viruses/malwares which cant be detected.
Take that advise given by Omega above when it comes on network activity and processes yet you would able to detect it out if something is suspicious.

Yeap. Mining is pretty much easily noticeable probably besides rare cases when the hacker uses only like 10% which is unlikely I think. As for such viruses being easily removed through software like Malwarebytes, sure it can. But I'm more of a reinstall-the-OS-instead guy, just to be completely sure. :P

Also dudes and dudettes, Linux!

Yes! that is also a pretty sure thing to really do, to simply be just in the safe side of things, Maybe formatting and reinstalling all programs and algorithm that will be needed in the mining process, and just like Pooya87 have said


Always thing first that prevention is better, and be careful in using it again in the same way you did back then.

The best thing to do is to just update your OS regularly and your windows defender and also include your anti virus for your laptop or computer's safety measures. If you are careful on browsing different sites and downloading different files in the internet you will not be able to have any virus on your laptop or computer so just be careful on accessing different platforms in order to avoid viruses. Just like what I have been said the most and prettiest thing to do is to always keep updated your OS and anti virus.

It is difficult to detect the crypto mining virus because it might be hiding themselves. But the best way to prevent ourselves on from the mining virus. I would like to share my knowledge on how we prevent crypto virus. The first thing that we need to do is to install and always check update for the security like an antivirus software, regularly check your programs every time if there's an suspicious virus. Second is keep the OS is up to date, because it always a new feature to defend antivirus. That's the basic step that I shared on how to prevent mining virus.

it could be hard to identify this malware by the resources because when we configure cpuminer (the software for mining used as malware) we can select the % of the CPU to use, so, if the marlware only use 10% of our CPU then we will not see a big change in the system resources.

The best option is to backup and format. But i was thinking we could block some ports in the firewall to avoid the connections to mining pools. I'm not sure if this would really work but at least the hacker will not get a recompense this way.

Tbh you don't even need to install any other 3rd party antivirus software. Windows defender should be enough. Personally had a Windows device for a decade without any other active antivirus/antimalware software(besides Malwarebytes for my weekly scan), without a single problem. Probably 90% of the time, the security depends on the user not on the device itself.

I'm not sure why no one has mentioned it but:

It's not easy to actually detect mining virus. Unlike the wallet stealing malware which specifically actively looks out for any suspicious programs that seeks for wallet files, a mining virus is much harder to detect in the sense that they can attempt to conceal their activities within a legitimate program. For example, they can spawn a process that uses a high CPU resource and it still wouldn't be that suspicious since many programs has a high CPU utilisation.

It would take a reverse engineering of the program to determine if its a false positive or not.

I haven'r encountered one personally, and if you do not eat codes for breakfast, you won't know that an application has a mining software embedded within it beforehand.

You will see that your CPU usage on your machine would be absurdly high, and you would check the processes and everything to no avail. The only way you know that the application you downloaded is a malware is when you are already infected, and removing is the only way to go clean again.

As a rule of thumb, no one should ever download software from unknown sites, let alone shady ones offering free stuff or cracked premium software. This is where most nefarious people embed their nefarious creations, so it's better to avoid them all.

It could surely trick a complete computer-illiterate person but if you're at the very least decent with computers, I don't think it should be that hard.

"huh, X process is running at full throttle, why is it running though? I didn't even run it in the first place. Weird."

Shouldn't be difficult I think. Especially if the mining virus is masquerading as a system process; it would easily be fishy to see a process just suddenly going bonkers. Or am I just underestimating these viruses?

IIRC, there was a gaming program that secretly did this without their user knowledge and everything came clean after some users tried to investigate further. Some of this virus err on the side of caution and usually only mine when they do not detect any keystroke after sometime and if the user isn't observant, they would just assume that the program naturally uses a significant part of their GPU and it isn't something to worry about.

I have experienced it before when I downloaded adcoin wallet. I could not notice it was the virus. I thought the PC I am using is having a problem because the CPU performance was very high. My battery is getting drained easily and the PC was making hovering sound. If this is what you are experiencing too. you can start the task manager, click on the processes options. In the list of the processes, you will discover an exe. extension with very high memory usage probably coming from the program that contains the virus. use the Malwarebytes to remove the virus or uninstall the program

How do you think, would it better to buy a clean new processor to skip many steps and start mining using a new PC or make a cleaning?

Yep. Just with some viruses and malware in general, a significant part of it is convincing the device owner that nothing is wrong with their device hence why we have them applying sneaky maneuvers to hopefully mine a good amount of coins before the device owner finds out about the miner or until the device owner does a clean OS format.

Not sure how much mining viruses does it in sneaky manners though, as far as I know most mining viruses are still CoinHive Monero mining scripts.

And unfortunately some of the most prominent adblocks, firewalls, and antiviruses out there don't really help on preventing them or keeping these viruses at bay. At this day and age where computer viruses become more and more advanced, the antivirus programs we currently have might not be sufficient to support and fend them off. So the only feasible way to keep yourself from being a victim is to become more keen and observant. Investigate if you feel like there's something wrong going on with your computer, and before anything else, always do some vouching and background check to the rig seller you're transacting with. That helps a lot.

Pretty much. While security of OS's and antimalware software improves, so does malware developers. Also not to mention that malware detection of antimalware software regardless of company has never been 100% accurate anyway. There will always be malware that will manage to sneak past your antimalware software, especially when the malware is directly targetted.

As far as I know Coinhive (https://www.theverge.com/2019/2/28/18244636/coinhive-cryptojacking-cryptocurrency-mining-shut-down-monero-date) was closed almost a year ago, as they say because there is no more profit (due to price od Monero and forks), but I also doubt that one of the reasons is that almost every security software has blocked their script to run on browsers.

The real threat comes from programs that are installed on computers as useful and often legitimate programs, and actually use some CPU power to mine crypto. If you rely solely on checking CPU/RAM power in some cases, you won't notice anything strange, such programs will trick you by using very small % of your PC, which is in long term better for them, but to discover and remove them.

Prevention is definitely the best solution, but also the detection of any program that is potentially malicious. Even though some live in the belief that AV/anti malware does more harm than good, I will never agree with that.

Interesting, the OP just registered to ask this question and never returned after that. Seems like the account was created with the sole purpose to make thread for generating posts.
Don't you guys ever check how legit is the OP when you posts comments?? It's very fishy.

I would add script blocking, personally i use uMatrix (https://github.com/gorhill/uMatrix) (from the maker of uBlock origin (https://github.com/gorhill/uBlock)) which is far better than noscript.

Don't let web sites run code without your explicit permission, one of such codes is for mining monero or similar cpu/gpu mining friendly altcoin while you are viewing a page. Yes, there are a few browser addons that are explicitly anti web-miners, but i think whitelisting sites is far safer than hoping the addon (or antivirus) is updated.

Big problem with malware is that on zero day, no one can detect it...

On cpu/gpu it is always good to constantly run fan/temperature monitors, i have these values shown realtime in my panel, along with ram usage etc. Any suspicious activity i immediately check running processes. I also catch misbehaving programs.

And if you are in a laptop or portable, blocking scripts happen to save battery too...

if you know that it has a virus and its detected by your anti virus then why the heck your still going to install it ? thats a dumb move to do  . there are legit mining software out there that you can try if you really wanted to try mining but mining using a standard pc isnt really that profitable though  . there are also software that wont install unless you turn off your antivirus but this does not mean that they have a virus  . you still need to read the feedback and the repuation of the sharer though   .

It's a common-sense that you should not install something when a virus is detected by an antivirus especially that you are installing software for mining, so the creator of the virus is fully aware that you are using crypto and it is a great danger for your assets. Reading feedbacks on software that won't install when an anti-virus is enabled is a must. There are many viruses out there that are waiting to be installed. Reading and staying safe is a good way to avoid such danger.

Yea, it just really depends on what specific software you're using. Remember, we have "anti malware" software like the McAfee AntiVirus out there..

Right. I guess in this case at least it isn't the typical "will bitcoin go up or down" or the typical price prediction topic so I guess at the very least we have something slightly more interesting to discuss about regardless of OP's intention.

Cleaning will always be needed, even if we buy a good processor there will still be cleaning that must be done at least once every 2 weeks or once a month, this is also to maintain the quality of the processor and things that can worsen the work of the processor if we do not do cleaning or maintanance.

Because an electronics will also always have a time to rest

I think its hard to detect one but anti virus will definitely detect those usual virus we have today. I guess preventing is much better like only use a computer for mining only and not the one you are using for personal reasons.

It is possible that OP is actually alt account, it must be acknowledged that this is one of the methods used for signature spam. But how to distinguish a real beginner from an alt account created for the above reason?

I don't think ordinary users can know what the intentions of the person who started this topic really were, and maybe only those who can check the IP could find out that someone created an alt account and then answer the question using their main account or maybe more of them.

Alternatively, maybe we should refrain from participating in a topic like this assuming it is not a matter of real intent, but only topic created for signature spam.

Mining viruses exist, but now they just load the processor, and give minimal profit to the creator.

You need to constantly update your OS so that the protection is updated. In General, it is very easy to detect the virus, because you will hear the noise of your block.

Most mining Softwares are detected by the computers as viruses or malwares so it is very normal but you have to be very careful
Do not install softwares from unknown sources
Always ask people who are more experienced that will recommend to you softwares and from where to download them

I think the reason why some antivirus or systems detects mining software as viruses is because it manages the performance of the hardware, specifically, the graphics card or video card needs to function too much in order to mine cryptocurrency. So the best way to just shut the warning off is to turn off the protection when you are running the mining software.

But make sure that you have the proper hardware to mine cryptocurrency, because most of the time before, many just surf the hype of bitcoin mining, they have converted desktop pc's to mining rigs which isn't the proper way to mine, as it consumes more energy/power, in the end, instead of gaining profits, you lose because of the electricity bill.