Bitcoin Forum
April 25, 2024, 12:29:48 PM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: Mining viruses  (Read 234 times)
hugeblack (OP)
Legendary
*
Offline Offline

Activity: 2492
Merit: 3597


Buy/Sell crypto at BestChange


View Profile WWW
April 13, 2019, 06:22:30 AM
 #1

I use this laptop "Windows 8.1" to participate in this forum in addition to browsing news from official sites and some famous platforms.
Most programs that are installed are either open source or popular.

Two days ago I noticed strange sounds from the fan, these sounds disappear after two minutes plus slow internet browsing.
I checked the fan and all programs installed/running without any problems or any strange applications.
What makes me worry is that the computer works normally in the safe mode.
How can I check the mining viruses? Do I need to restore factory settings? Especially since I use some wallets?

.BEST..CHANGE.███████████████
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
███████████████
..BUY/ SELL CRYPTO..
"With e-currency based on cryptographic proof, without the need to trust a third party middleman, money can be secure and transactions effortless." -- Satoshi
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
1714048188
Hero Member
*
Offline Offline

Posts: 1714048188

View Profile Personal Message (Offline)

Ignore
1714048188
Reply with quote  #2

1714048188
Report to moderator
1714048188
Hero Member
*
Offline Offline

Posts: 1714048188

View Profile Personal Message (Offline)

Ignore
1714048188
Reply with quote  #2

1714048188
Report to moderator
Bitcoin_Arena
Copper Member
Legendary
*
Offline Offline

Activity: 2016
Merit: 1781


฿itcoin for all, All for ฿itcoin.


View Profile
April 13, 2019, 06:44:53 AM
Merited by OgNasty (1)
 #2

-Snip-

Writing content without mentioning the source or linking the source is plagiarism and it could give you a permanent ban in this forum.

I told you to read the rules earlier on but it looks like you just under looked my advice.
You copied this article: https://antivirus.comodo.com/blog/comodo-news/detect-remove-bitcoin-miner-virus/ and never included any source link.

Now I am not that kind of person with a very cold heart to report a seemingly genuine newbie on the first day in the forum but someone else will if you don't correct yourself.
For the last time, Please take advice and read the rules or i will have a change of heart too.

.BEST..CHANGE.███████████████
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
███████████████
..BUY/ SELL CRYPTO..
whotookmycrypto
Full Member
***
Offline Offline

Activity: 168
Merit: 214


WhoTookMyCrypto.com


View Profile WWW
April 13, 2019, 07:45:46 AM
Last edit: April 13, 2019, 08:14:20 AM by whotookmycrypto
 #3

I use this laptop "Windows 8.1" to participate in this forum in addition to browsing news from official sites and some famous platforms.
Most programs that are installed are either open source or popular.

Two days ago I noticed strange sounds from the fan, these sounds disappear after two minutes plus slow internet browsing.
I checked the fan and all programs installed/running without any problems or any strange applications.
What makes me worry is that the computer works normally in the safe mode.
How can I check the mining viruses? Do I need to restore factory settings? Especially since I use some wallets?

Given that you mentioned that your internet slows down, can you check out your browser on this site? https://cryptojackingtest.com/

Also, when you said you checked all programs, did you view them on the task manager (Windows) or activity monitor (Mac) to see which programs have unusually high CPU usage? Then by a process of elimination end each non-essential program that is running, one by one, to see if it makes the sound disappear.

These can help you narrow down on the source of the problem.

NeuroticFish
Legendary
*
Offline Offline

Activity: 3654
Merit: 6365


Looking for campaign manager? Contact icopress!


View Profile
April 13, 2019, 09:19:01 AM
 #4

I checked the fan and all programs installed/running without any problems or any strange applications.
What makes me worry is that the computer works normally in the safe mode.
How can I check the mining viruses?

First of all you should check if this problem also occurs if none of your wallets is running. I write this because in some wallets you can set (and forget?) to mine while running. Or maybe it can come set by default?
Also keep in mind that some websites or browser plugins also can mine.

Second, I suggest you run Process Explorer: https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer   It's made by a subsidiary of Microsoft.
If you leave it running, you'll see in the tray icon the CPU usage. And if it's on continuous high usage you can click and find the process that's using your CPU so heavily. And then you can research more about it.
Lately Windows Task Manager got better, but I use this program since the days TaskMan was not helpful at all.

Unfortunately if the bad program is GPU mining, this strategy will not find it. But you could tell what GPU you have, since there's a good chance you don't have a GPU that can mine...


Reset to factory is a bit extreme imho, also antiviruses may give you a lot of false positives (wallets too), but if nothing else works, ... it can be an option.
Most known antiviruses can be downloaded as CD/DVD image you burn and run from it so it can catch even the nastier viruses without the necessity to reset to factory. Just, again, beware of false positives.

I also recommend you backup all the wallets to make sure you don't lose your coins while trying out various things.

.
.HUGE.
▄██████████▄▄
▄█████████████████▄
▄█████████████████████▄
▄███████████████████████▄
▄█████████████████████████▄
███████▌██▌▐██▐██▐████▄███
████▐██▐████▌██▌██▌██▌██
█████▀███▀███▀▐██▐██▐█████

▀█████████████████████████▀

▀███████████████████████▀

▀█████████████████████▀

▀█████████████████▀

▀██████████▀▀
█▀▀▀▀











█▄▄▄▄
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
.
CASINSPORTSBOOK
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▀▀▀▀█











▄▄▄▄█
Lucius
Legendary
*
Offline Offline

Activity: 3220
Merit: 5628


Blackjack.fun-Free Raffle-Join&Win $50🎲


View Profile WWW
April 13, 2019, 09:31:41 AM
Merited by ABCbits (1), logfiles (1)
 #5

hugeblack, you should know that there are two types of hidden mining on users device. First is browser mining, which happens only when you visit the website which then initiates the script which use your CPU for mining (in most cases Monero). The moment you leave the site mining is stop.

Second type of mining is much more dangerous, it is about malware which user download on device, often hidden in a legitimate software. Such program is mining all time, and it causes computer slowdown in general.

By what you describe you probably visited the site which is using browser mining script, but to make sure that the device is not infected with some virus / malware I suggest you to download free version of Malwarebytes and to make full scan (even better if you do that in safe mode). You can also scan your device with antivirus, and there is small tool for checking browser from Malwarebytes named AdwCleaner.

In any case you should use good proactive protection which is blocking the majority of Internet threats., For instance, my AV is always block any attempt of browser mining script, and there is also some browser coin mining blockers which you can download for your browser.

https://www.malwarebytes.com/
https://www.malwarebytes.com/adwcleaner/



.
.BLACKJACK ♠ FUN.
█████████
██████████████
████████████
█████████████████
████████████████▄▄
░█████████████▀░▀▀
██████████████████
░██████████████
████████████████
░██████████████
████████████
███████████████░██
██████████
CRYPTO CASINO &
SPORTS BETTING
▄▄███████▄▄
▄███████████████▄
███████████████████
█████████████████████
███████████████████████
█████████████████████████
█████████████████████████
█████████████████████████
███████████████████████
█████████████████████
███████████████████
▀███████████████▀
█████████
.
boyptc
Hero Member
*****
Offline Offline

Activity: 2982
Merit: 678


★Bitvest.io★ Play Plinko or Invest!


View Profile
April 13, 2019, 11:59:40 AM
 #6

Seems that most ideas were given.

Check if the CPU process is fully loaded even though you do nothing. And if there's a big percentage on use, bingo your laptop is used for CPU mining.

Before restoring factory settings, please do back up all of the wallets that contains your funds.



.
.BIG WINNER!.
[15.00000000 BTC]


▄████████████████████▄
██████████████████████
██████████▀▀██████████
█████████░░░░█████████
██████████▄▄██████████
███████▀▀████▀▀███████
██████░░░░██░░░░██████
███████▄▄████▄▄███████
████▀▀████▀▀████▀▀████
███░░░░██░░░░██░░░░███
████▄▄████▄▄████▄▄████
██████████████████████

▀████████████████████▀
▄████████████████████▄
██████████████████████
█████▀▀█▀▀▀▀▀▀██▀▀████
█████░░░░░░░░░░░░░████
█████░░░░░░░░░░░░▄████
█████░░▄███▄░░░░██████
█████▄▄███▀░░░░▄██████
█████████░░░░░░███████
████████░░░░░░░███████
███████░░░░░░░░███████
███████▄▄▄▄▄▄▄▄███████

██████████████████████
▀████████████████████▀
▄████████████████████▄
███████████████▀▀▀▀▀▀▀
███████████▀▀▄▄█░░░░░█
█████████▀░░█████░░░░█
███████▀░░░░░████▀░░░▀
██████░░░░░░░░▀▄▄█████
█████░▄░░░░░▄██████▀▀█
████░████▄░███████░░░░
███░█████░█████████░░█
███░░░▀█░██████████░░█
███░░░░░░████▀▀██▀░░░░
███░░░░░░███░░░░░░░░░░

██░▄▄▄▄░████▄▄██▄░░░░
████████████▀▀▀▀▀▀▀██
█████████████░█▀▀▀█░███
██████████▀▀░█▀░░░▀█░▀▀
███████▀░▄▄█░█░░░░░█░█▄
████▀░▄▄████░▀█░░░█▀░██
███░▄████▀▀░▄░▀█░█▀░▄░▀
█▀░███▀▀▀░░███░▀█▀░███░
▀░███▀░░░░░████▄░▄████░
░███▀░░░░░░░█████████░░
░███░░░░░░░░░███████░░░
███▀░██░░░░░░▀░▄▄▄░▀░░░
███░██████▄▄░▄█████▄░▄▄

██░████████░███████░█
▄████████████████████▄
████████▀▀░░░▀▀███████
███▀▀░░░░░▄▄▄░░░░▀▀▀██
██░▀▀▄▄░░░▀▀▀░░░▄▄▀▀██
██░▄▄░░▀▀▄▄░▄▄▀▀░░░░██
██░▀▀░░░░░░█░░░░░██░██
██░░░▄▄░░░░█░██░░░░░██
██░░░▀▀░░░░█░░░░░░░░██
██░░░░░▄▄░░█░░░░░██░██
██▄░░░░▀▀░░█░██░░░░░██
█████▄▄░░░░█░░░░▄▄████
█████████▄▄█▄▄████████

▀████████████████████▀




Rainbot
Daily Quests
Faucet
mk4
Legendary
*
Offline Offline

Activity: 2744
Merit: 3830


Paldo.io 🤖


View Profile
April 13, 2019, 04:35:09 PM
Merited by OgNasty (1), ABCbits (1)
 #7

Save yourself from all the hassle and simply do a fresh reinstall of your operating system instead. I'd suggest updating it to the latest version too(probably a good idea to get Windows 10 instead for potentially better security updates). Or better, if you want to explore a bit, try Linux. Preferably, Ubuntu Linux for beginners.

█▀▀▀











█▄▄▄
▀▀▀▀▀▀▀▀▀▀▀
e
▄▄▄▄▄▄▄▄▄▄▄
█████████████
████████████▄███
██▐███████▄█████▀
█████████▄████▀
███▐████▄███▀
████▐██████▀
█████▀█████
███████████▄
████████████▄
██▄█████▀█████▄
▄█████████▀█████▀
███████████▀██▀
████▀█████████
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
c.h.
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▀▀▀█











▄▄▄█
▄██████▄▄▄
█████████████▄▄
███████████████
███████████████
███████████████
███████████████
███░░█████████
███▌▐█████████
█████████████
███████████▀
██████████▀
████████▀
▀██▀▀
logfiles
Copper Member
Legendary
*
Offline Offline

Activity: 1960
Merit: 1638


Top Crypto Casino


View Profile WWW
April 13, 2019, 06:08:29 PM
 #8

By what you describe you probably visited the site which is using browser mining script, but to make sure that the device is not infected with some virus / malware I suggest you to download free version of Malwarebytes and to make full scan (even better if you do that in safe mode). You can also scan your device with antivirus, and there is small tool for checking browser from Malwarebytes named AdwCleaner.

In any case you should use good proactive protection which is blocking the majority of Internet threats., For instance, my AV is always block any attempt of browser mining script, and there is also some browser coin mining blockers which you can download for your browser.

https://www.malwarebytes.com/
https://www.malwarebytes.com/adwcleaner/
Awesome advice Lucius.
The Noscript extension for Mozilla is also a good extension in fighting mining and malicious scripts on the browser. The power keep a website's script blocked from running or whitelisting the script is in the user's hands. Only downside about this extension is that it's currently available for only mozilla

█████████████████████████
████▐██▄█████████████████
████▐██████▄▄▄███████████
████▐████▄█████▄▄████████
████▐█████▀▀▀▀▀███▄██████
████▐███▀████████████████
████▐█████████▄█████▌████
████▐██▌█████▀██████▌████
████▐██████████▀████▌████
█████▀███▄█████▄███▀█████
███████▀█████████▀███████
██████████▀███▀██████████
█████████████████████████
.
BC.GAME
▄▄░░░▄▀▀▄████████
▄▄▄
██████████████
█████░░▄▄▄▄████████
▄▄▄▄▄▄▄▄▄██▄██████▄▄▄▄████
▄███▄█▄▄██████████▄████▄████
███████████████████████████▀███
▀████▄██▄██▄░░░░▄████████████
▀▀▀█████▄▄▄███████████▀██
███████████████████▀██
███████████████████▄██
▄███████████████████▄██
█████████████████████▀██
██████████████████████▄
.
..CASINO....SPORTS....RACING..
█░░░░░░█░░░░░░█
▀███▀░░▀███▀░░▀███▀
▀░▀░░░░▀░▀░░░░▀░▀
░░░░░░░░░░░░
▀██████████
░░░░░███░░░░
░░█░░░███▄█░░░
░░██▌░░███░▀░░██▌
░█░██░░███░░░█░██
░█▀▀▀█▌░███░░█▀▀▀█▌
▄█▄░░░██▄███▄█▄░░▄██▄
▄███▄
░░░░▀██▄▀


▄▄████▄▄
▄███▀▀███▄
██████████
▀███▄░▄██▀
▄▄████▄▄░▀█▀▄██▀▄▄████▄▄
▄███▀▀▀████▄▄██▀▄███▀▀███▄
███████▄▄▀▀████▄▄▀▀███████
▀███▄▄███▀░░░▀▀████▄▄▄███▀
▀▀████▀▀████████▀▀████▀▀
Kristinnspence
Jr. Member
*
Offline Offline

Activity: 129
Merit: 1


View Profile WWW
April 13, 2019, 06:47:35 PM
 #9

By what you describe you probably visited the site which is using browser mining script, but to make sure that the device is not infected with some virus / malware I suggest you to download free version of Malwarebytes and to make full scan (even better if you do that in safe mode). You can also scan your device with antivirus, and there is small tool for checking browser from Malwarebytes named AdwCleaner.

In any case you should use good proactive protection which is blocking the majority of Internet threats., For instance, my AV is always block any attempt of browser mining script, and there is also some browser coin mining blockers which you can download for your browser.

https://www.malwarebytes.com/
https://www.malwarebytes.com/adwcleaner/
Awesome advice Lucius.
The Noscript extension for Mozilla is also a good extension in fighting mining and malicious scripts on the browser. The power keep a website's script blocked from running or whitelisting the script is in the user's hands. Only downside about this extension is that it's currently available for only mozilla

NoScript won't do much unless the virus is not installed on the computer and is running on the browser with a hidden tab
I just created a thread on how to combat malware like this
from my experence miners are often based on autoit to bypass av but most av find miners legal or not to be malware so they have to be hidden, so now most miners are built inside an exe file that is injected directly into memory etc
leowonderful
Legendary
*
Offline Offline

Activity: 1624
Merit: 1129


Bitcoin FTW!


View Profile
April 13, 2019, 06:50:14 PM
 #10

The shortcut you can use to go to the Task Manager on Windows should be CTRL+Shift+ESC, and you should be able to see CPU usage and various other things like RAM usage in there. The next time you hear the fan sounds go to the Task Manager and see if anything's taking a lot of your CPU power, if it's an application that's not a browser might be a virus (doesn't seem like it to me though).

If there's nothing too useful on the computer you're using, a reinstall of the OS should get rid of the problems if you don't want to go through the hassle of finding what the problem is. If you have any backups, restoring to one of them from before when you had the issue should work too. You should always be backing up important files if you have any to a safe place.
Harlot
Hero Member
*****
Offline Offline

Activity: 1806
Merit: 671


View Profile
April 13, 2019, 07:10:30 PM
 #11

Did you notice that your laptop is getting warm just by doing regular browser things? One thing to notice if there are any malware in your device is if it goes particularly hot even if you are only running normal task such as browsing or watching a movie. If the fan is still running after you have checked that your laptop is clean from any type of malware and have updated all the necessary drivers I guessed that the problem only lies with the hardware itself.
Artemis3
Legendary
*
Offline Offline

Activity: 2016
Merit: 1563


CLEAN non GPL infringing code made in Rust lang


View Profile WWW
April 14, 2019, 03:03:45 AM
 #12

I use this laptop "Windows 8.1" to participate in this forum in addition to browsing news from official sites and some famous platforms.
Most programs that are installed are either open source or popular.

Two days ago I noticed strange sounds from the fan, these sounds disappear after two minutes plus slow internet browsing.
I checked the fan and all programs installed/running without any problems or any strange applications.
What makes me worry is that the computer works normally in the safe mode.
How can I check the mining viruses? Do I need to restore factory settings? Especially since I use some wallets?

Since you like open source, shouldn't you start replacing windows as well? In the meantime, you can always use a live linux iso to boot from an usb thumbdrive and see if things go back to normal. You could spend countless hours to repair windows (again), but if you have backups and are already considering a wipe and reinstall, it is the perfect chance to move yourself to a secure os.

██████
███████
███████
████████
BRAIINS OS+|AUTOTUNING
MINING FIRMWARE
|
Increase hashrate on your Bitcoin ASICs,
improve efficiency as much as 25%, and
get 0% pool fees on Braiins Pool
Lucius
Legendary
*
Offline Offline

Activity: 3220
Merit: 5628


Blackjack.fun-Free Raffle-Join&Win $50🎲


View Profile WWW
April 14, 2019, 10:30:35 AM
 #13

Awesome advice Lucius.
The Noscript extension for Mozilla is also a good extension in fighting mining and malicious scripts on the browser. The power keep a website's script blocked from running or whitelisting the script is in the user's hands. Only downside about this extension is that it's currently available for only mozilla

Thank you logfiles Smiley
I hope some of the advices will help OP to solve his problem. I also have good news for you and Chrome users, NoScript extension is now available for Chrome browser. This extension is good for browser protection, it can block all executable content from web sites, so users can allow such content only from trusted sites.

https://chrome.google.com/webstore/detail/noscript/doojmbjmlfjjnbmnoijecmcbfeoakpjm
https://www.zdnet.com/article/noscript-extension-officially-released-for-google-chrome/

.
.BLACKJACK ♠ FUN.
█████████
██████████████
████████████
█████████████████
████████████████▄▄
░█████████████▀░▀▀
██████████████████
░██████████████
████████████████
░██████████████
████████████
███████████████░██
██████████
CRYPTO CASINO &
SPORTS BETTING
▄▄███████▄▄
▄███████████████▄
███████████████████
█████████████████████
███████████████████████
█████████████████████████
█████████████████████████
█████████████████████████
███████████████████████
█████████████████████
███████████████████
▀███████████████▀
█████████
.
mikeywith
Legendary
*
Offline Offline

Activity: 2212
Merit: 6359


be constructive or S.T.F.U


View Profile
April 14, 2019, 12:31:24 PM
 #14

Just remember that some viruses consume your pc resources for the sake of it and not importantly for mining. You can download a netowrork monitoring software and see if there is any particular upload going to a certain mining websites's port

There are a few ways to go about this depending on the capabilities you have.

The easiest approach would be getting a good antivirus that
 provides both internal and over the internet (browsing) security.

most of those viruses will be removed using an up to date security program.

And it can also be a browser extension like others have mentioned.

And most importantly you need to consider the fact that it could be a hardware problem after all, the noise from the fan could mean a falling bearing or bad thermal paste , just because it runs fine on safe mode it does not mean much, in safe mode most services are disabled and cpu consumption is close to nothing thus fan rpm are pretty low.


█▀▀▀











█▄▄▄
▀▀▀▀▀▀▀▀▀▀▀
e
▄▄▄▄▄▄▄▄▄▄▄
█████████████
████████████▄███
██▐███████▄█████▀
█████████▄████▀
███▐████▄███▀
████▐██████▀
█████▀█████
███████████▄
████████████▄
██▄█████▀█████▄
▄█████████▀█████▀
███████████▀██▀
████▀█████████
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
c.h.
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▀▀▀█











▄▄▄█
▄██████▄▄▄
█████████████▄▄
███████████████
███████████████
███████████████
███████████████
███░░█████████
███▌▐█████████
█████████████
███████████▀
██████████▀
████████▀
▀██▀▀
Adriano2010
Hero Member
*****
Offline Offline

Activity: 1414
Merit: 516


View Profile WWW
April 15, 2019, 01:16:15 AM
 #15

Well you need first time to install antivirus and check your computer for viruses, and also you should have a firewall, but please note that not all antivirus can find viruses if is a new version. You not install any program and after your pc start make that sound?
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!