Bitcoin and cryptocurrency mining virus

[dothebeats]

I haven'r encountered one personally, and if you do not eat codes for breakfast, you won't know that an application has a mining software embedded within it beforehand.

You will see that your CPU usage on your machine would be absurdly high, and you would check the processes and everything to no avail. The only way you know that the application you downloaded is a malware is when you are already infected, and removing is the only way to go clean again.

As a rule of thumb, no one should ever download software from unknown sites, let alone shady ones offering free stuff or cracked premium software. This is where most nefarious people embed their nefarious creations, so it's better to avoid them all.

[1714156268]

1714156268

[1714156268]

1714156268

[mk4]

I'm not sure why no one has mentioned it but:

It's not easy to actually detect mining virus. Unlike the wallet stealing malware which specifically actively looks out for any suspicious programs that seeks for wallet files, a mining virus is much harder to detect in the sense that they can attempt to conceal their activities within a legitimate program. For example, they can spawn a process that uses a high CPU resource and it still wouldn't be that suspicious since many programs has a high CPU utilisation.

It would take a reverse engineering of the program to determine if its a false positive or not.

It could surely trick a complete computer-illiterate person but if you're at the very least decent with computers, I don't think it should be that hard.

"huh, X process is running at full throttle, why is it running though? I didn't even run it in the first place. Weird."

Shouldn't be difficult I think. Especially if the mining virus is masquerading as a system process; it would easily be fishy to see a process just suddenly going bonkers. Or am I just underestimating these viruses?

[ranochigo]

"huh, X process is running at full throttle, why is it running though? I didn't even run it in the first place. Weird."

Shouldn't be difficult I think. Especially if the mining virus is masquerading as a system process; it would easily be fishy to see a process just suddenly going bonkers. Or am I just underestimating these viruses?

IIRC, there was a gaming program that secretly did this without their user knowledge and everything came clean after some users tried to investigate further. Some of this virus err on the side of caution and usually only mine when they do not detect any keystroke after sometime and if the user isn't observant, they would just assume that the program naturally uses a significant part of their GPU and it isn't something to worry about.

[thesmallgod]

I have experienced it before when I downloaded adcoin wallet. I could not notice it was the virus. I thought the PC I am using is having a problem because the CPU performance was very high. My battery is getting drained easily and the PC was making hovering sound. If this is what you are experiencing too. you can start the task manager, click on the processes options. In the list of the processes, you will discover an exe. extension with very high memory usage probably coming from the program that contains the virus. use the Malwarebytes to remove the virus or uninstall the program

[putukin]

step 0 is prevention:
- never download or install shady binaries that you don't know the source of and don't trust.
- always make sure you have real software by verifying their digital signature if possible
- if you have to run a shady application then use a sandbox so that in case it contained anything malicious it wouldn't infect your computer.
- never visit shady website
- and as the last line of defense if you are on a closed source OS such as Windows or Mac you can install a good anti virus.

if you are already infected
best solution would be formatting the hard disk and reinstalling the OS but since that is hard you can install a good anti virus or use a rescue disk to scan and try to remove it.
detecting this type of malware is easy since they have to use excessive amount of computing power so the symptoms are obviously increased CPU or GPU usage, hearing the fan sound (if your fan speed is adjusted according to usage),...

How do you think, would it better to buy a clean new processor to skip many steps and start mining using a new PC or make a cleaning?

[mk4]

IIRC, there was a gaming program that secretly did this without their user knowledge and everything came clean after some users tried to investigate further. Some of this virus err on the side of caution and usually only mine when they do not detect any keystroke after sometime and if the user isn't observant, they would just assume that the program naturally uses a significant part of their GPU and it isn't something to worry about.

Yep. Just with some viruses and malware in general, a significant part of it is convincing the device owner that nothing is wrong with their device hence why we have them applying sneaky maneuvers to hopefully mine a good amount of coins before the device owner finds out about the miner or until the device owner does a clean OS format.

Not sure how much mining viruses does it in sneaky manners though, as far as I know most mining viruses are still CoinHive Monero mining scripts.

[Twentyonepaylots]

IIRC, there was a gaming program that secretly did this without their user knowledge and everything came clean after some users tried to investigate further. Some of this virus err on the side of caution and usually only mine when they do not detect any keystroke after sometime and if the user isn't observant, they would just assume that the program naturally uses a significant part of their GPU and it isn't something to worry about.

Yep. Just with some viruses and malware in general, a significant part of it is convincing the device owner that nothing is wrong with their device hence why we have them applying sneaky maneuvers to hopefully mine a good amount of coins before the device owner finds out about the miner or until the device owner does a clean OS format.

Not sure how much mining viruses does it in sneaky manners though, as far as I know most mining viruses are still CoinHive Monero mining scripts.

And unfortunately some of the most prominent adblocks, firewalls, and antiviruses out there don't really help on preventing them or keeping these viruses at bay. At this day and age where computer viruses become more and more advanced, the antivirus programs we currently have might not be sufficient to support and fend them off. So the only feasible way to keep yourself from being a victim is to become more keen and observant. Investigate if you feel like there's something wrong going on with your computer, and before anything else, always do some vouching and background check to the rig seller you're transacting with. That helps a lot.

[mk4]

And unfortunately some of the most prominent adblocks, firewalls, and antiviruses out there don't really help on preventing them or keeping these viruses at bay. At this day and age where computer viruses become more and more advanced, the antivirus programs we currently have might not be sufficient to support and fend them off. So the only feasible way to keep yourself from being a victim is to become more keen and observant. Investigate if you feel like there's something wrong going on with your computer, and before anything else, always do some vouching and background check to the rig seller you're transacting with. That helps a lot.

Pretty much. While security of OS's and antimalware software improves, so does malware developers. Also not to mention that malware detection of antimalware software regardless of company has never been 100% accurate anyway. There will always be malware that will manage to sneak past your antimalware software, especially when the malware is directly targetted.

[Lucius]

Not sure how much mining viruses does it in sneaky manners though, as far as I know most mining viruses are still CoinHive Monero mining scripts.

As far as I know Coinhive was closed almost a year ago, as they say because there is no more profit (due to price od Monero and forks), but I also doubt that one of the reasons is that almost every security software has blocked their script to run on browsers.

The real threat comes from programs that are installed on computers as useful and often legitimate programs, and actually use some CPU power to mine crypto. If you rely solely on checking CPU/RAM power in some cases, you won't notice anything strange, such programs will trick you by using very small % of your PC, which is in long term better for them, but to discover and remove them.

Prevention is definitely the best solution, but also the detection of any program that is potentially malicious. Even though some live in the belief that AV/anti malware does more harm than good, I will never agree with that.

[TheBeardedBaby]

Interesting, the OP just registered to ask this question and never returned after that. Seems like the account was created with the sole purpose to make thread for generating posts.
Don't you guys ever check how legit is the OP when you posts comments?? It's very fishy.

[Artemis3]

step 0 is prevention:
- never download or install shady binaries that you don't know the source of and don't trust.
- always make sure you have real software by verifying their digital signature if possible
- if you have to run a shady application then use a sandbox so that in case it contained anything malicious it wouldn't infect your computer.
- never visit shady website
- and as the last line of defense if you are on a closed source OS such as Windows or Mac you can install a good anti virus.

if you are already infected
best solution would be formatting the hard disk and reinstalling the OS but since that is hard you can install a good anti virus or use a rescue disk to scan and try to remove it.
detecting this type of malware is easy since they have to use excessive amount of computing power so the symptoms are obviously increased CPU or GPU usage, hearing the fan sound (if your fan speed is adjusted according to usage),...

I would add script blocking, personally i use uMatrix (from the maker of uBlock origin) which is far better than noscript.

Don't let web sites run code without your explicit permission, one of such codes is for mining monero or similar cpu/gpu mining friendly altcoin while you are viewing a page. Yes, there are a few browser addons that are explicitly anti web-miners, but i think whitelisting sites is far safer than hoping the addon (or antivirus) is updated.

Big problem with malware is that on zero day, no one can detect it...

On cpu/gpu it is always good to constantly run fan/temperature monitors, i have these values shown realtime in my panel, along with ram usage etc. Any suspicious activity i immediately check running processes. I also catch misbehaving programs.

And if you are in a laptop or portable, blocking scripts happen to save battery too...

[imstillthebest]

Actually there are some software for mining that has a virus in which it will detect by your antivirus and you must need to turn off your anti virus in order to start the software but it is risky because your computer may have the virus that the anti virus has been detect so it would be better if you will ask first some friends on what they in order to install safely their mining software and what terms of agreement they have sign into.

if you know that it has a virus and its detected by your anti virus then why the heck your still going to install it ? thats a dumb move to do  . there are legit mining software out there that you can try if you really wanted to try mining but mining using a standard pc isnt really that profitable though  . there are also software that wont install unless you turn off your antivirus but this does not mean that they have a virus  . you still need to read the feedback and the repuation of the sharer though   .

[abel1337]

Actually there are some software for mining that has a virus in which it will detect by your antivirus and you must need to turn off your anti virus in order to start the software but it is risky because your computer may have the virus that the anti virus has been detect so it would be better if you will ask first some friends on what they in order to install safely their mining software and what terms of agreement they have sign into.

if you know that it has a virus and its detected by your anti virus then why the heck your still going to install it ? thats a dumb move to do  . there are legit mining software out there that you can try if you really wanted to try mining but mining using a standard pc isnt really that profitable though  . there are also software that wont install unless you turn off your antivirus but this does not mean that they have a virus  . you still need to read the feedback and the repuation of the sharer though   .

It's a common-sense that you should not install something when a virus is detected by an antivirus especially that you are installing software for mining, so the creator of the virus is fully aware that you are using crypto and it is a great danger for your assets. Reading feedbacks on software that won't install when an anti-virus is enabled is a must. There are many viruses out there that are waiting to be installed. Reading and staying safe is a good way to avoid such danger.

[mk4]

Even though some live in the belief that AV/anti malware does more harm than good, I will never agree with that.

Yea, it just really depends on what specific software you're using. Remember, we have "anti malware" software like the McAfee AntiVirus out there..

Interesting, the OP just registered to ask this question and never returned after that. Seems like the account was created with the sole purpose to make thread for generating posts.
Don't you guys ever check how legit is the OP when you posts comments?? It's very fishy.

Right. I guess in this case at least it isn't the typical "will bitcoin go up or down" or the typical price prediction topic so I guess at the very least we have something slightly more interesting to discuss about regardless of OP's intention.

[Denongels]

step 0 is prevention:
- never download or install shady binaries that you don't know the source of and don't trust.
- always make sure you have real software by verifying their digital signature if possible
- if you have to run a shady application then use a sandbox so that in case it contained anything malicious it wouldn't infect your computer.
- never visit shady website
- and as the last line of defense if you are on a closed source OS such as Windows or Mac you can install a good anti virus.

if you are already infected
best solution would be formatting the hard disk and reinstalling the OS but since that is hard you can install a good anti virus or use a rescue disk to scan and try to remove it.
detecting this type of malware is easy since they have to use excessive amount of computing power so the symptoms are obviously increased CPU or GPU usage, hearing the fan sound (if your fan speed is adjusted according to usage),...

How do you think, would it better to buy a clean new processor to skip many steps and start mining using a new PC or make a cleaning?

Cleaning will always be needed, even if we buy a good processor there will still be cleaning that must be done at least once every 2 weeks or once a month, this is also to maintain the quality of the processor and things that can worsen the work of the processor if we do not do cleaning or maintanance.

Because an electronics will also always have a time to rest

[TwoSides]

I think its hard to detect one but anti virus will definitely detect those usual virus we have today. I guess preventing is much better like only use a computer for mining only and not the one you are using for personal reasons.

[Lucius]

Interesting, the OP just registered to ask this question and never returned after that. Seems like the account was created with the sole purpose to make thread for generating posts.
Don't you guys ever check how legit is the OP when you posts comments?? It's very fishy.

It is possible that OP is actually alt account, it must be acknowledged that this is one of the methods used for signature spam. But how to distinguish a real beginner from an alt account created for the above reason?

I don't think ordinary users can know what the intentions of the person who started this topic really were, and maybe only those who can check the IP could find out that someone created an alt account and then answer the question using their main account or maybe more of them.

Alternatively, maybe we should refrain from participating in a topic like this assuming it is not a matter of real intent, but only topic created for signature spam.

[icewitch0612]

Mining viruses exist, but now they just load the processor, and give minimal profit to the creator.

[mboizcunk]

How to detect it and protect it?   

You need to constantly update your OS so that the protection is updated. In General, it is very easy to detect the virus, because you will hear the noise of your block.

[Jamesdila1]

Most mining Softwares are detected by the computers as viruses or malwares so it is very normal but you have to be very careful
Do not install softwares from unknown sources
Always ask people who are more experienced that will recommend to you softwares and from where to download them