This article has been made in order to help you in detecting and removing the new Coin Miner malware viruses from your computer and protect it against future infections as well.
Coin Miner viruses are shaping up to be the next big trend that is not likely to dissapear anytime soon. One such malware is the latest discovered BitCoinminer.sx which was very similar to the Adylkuzz Trojan horse based on the code it uses. In addition to this, many new Coin Miner viruses have also appeared, using JavaScript code that is embedded on suspcious websites or in programs and this code filelessly begins to mine for cryptocurrencies, the most often targeted of which are BitCoin and Monero as well as other altcoins. The end goal is to use your GPU and CPU power to generate tokens for the cryptocurrency wallet of the cyber-criminals and the outcome of this is not good, since your PC slows down, freezes and may even crash at some point. This is why, if you believe that your computer has been infected by a Coin Miner virus, we recommend you to learn more about those viruses and how to detect and remove them, preferably by reading the following article.
Threat Summary
| Name | Coin Miner Viruses |
| Type | Cryptocurrency Token Miner / Trojan |
| Short Description | Aims to affect your computer system and use it’s CPU and GPU resources in order to mine for the cryptocurrency tokens. |
| Symptoms | High CPU and GPU utilization plus your PC may overheat, slow down and even break down. |
| Distribution Method | Via fake installers, fraudulent processes as well as malicious sites and e-mail attachments. |
| Detection Tool | See If Your System Has Been Affected by Coin Miner Viruses Download Malware Removal Tool | User Experience | Join Our Forum to Discuss Coin Miner Viruses. |
Coin Miner Viruses – Update April 2018
Miner viruses have continued to evolve adding new technologies to them that enable them to not only act as a Worm to infect as many computers as possible, but also to use the infected machine to it’s full extent and clear example for that is the WannaMine Cryptoworm infection, imitating the notorious WannaCry ransomware. Besides this the usage of JavaScript has further evolved and become more sophisticated with RAT features in some viruses, like the Webmine.pro JavaScript miner. In addition to this, viruses have begin to imimtate system processes very well.
How Do Coin Miner Viruses Infect Victims
There may be more than one possible method of infecting computers with the Coin Miner viruses. The most often used methods are intermediary malware, such as Trojans, Injectors, Worms, malicious JavaScript and several others. These malicious files or code may infect a given victim PC via several different ways, the main of which often turn out to be:
- Malicious web links that are posted as spam messages online.
- Via web links that can exist in various different types of forms, form the likes of fake buttons, changed banners on sites or if you already have a PUP installed on your computer.
- If you have opened a malicious e-mail attachment which contains a convincing message within it and a malicious e-mail attachment.
The infection files themselves may have embedded exploits or other methods that allow them to be activated in an obfuscated manner while being undetected on the computers of victims. Such files may also be concealed as fake setups, key generators or other types unwanted types of files that exist on the victim’s computer.
Coin Miner Viruses – More Information
Throughout the years, there have been different Coin Miner viruses out there. Most of them have resembled the code of different Trojan horses, but newer viruses emerged that also use already known cryptocurrency mining algorithms, such as Cryptonight or Coinhive miners, embedded as few lines of JavaScript code uploaded on various websites. So here are some of the most notorious Coin Miner viruses that are known out there:
Upup.exe BitCoin Miner
This malware has the one and only purpose to use the CPU and GPU resources of your computer via it’s fake Upup.exe process, which it runs as a trusted process in the background of your computer via your Windows Task Manager. The malware also aims to modify the Windows Registry Sub-keys and keys in order to automatically run, even if you stop the process and the real upup.exe process is concealed somewhere in the Windows system folder or other system directories of your OS. The miner malware was reported to even possibly have other mining capabilities, such as self-update silently to remain undetected for as long as possible on your computer and in addition to this install other malware plus miners on your infected PC. Below, you can find more information about Upup.exe.
Service.exe Coin Miner Malware
This malicious Windows process is of origins that are not well documented and established, but it is known for sure that the miner malware uses a fraudulent service.exe process that acts as a system process in Windows. This process has the purpose to perform it’s mining operation silently while taking a vast amount of your CPU and GPU resources. The malware was also reported to possibly be spread via multiple different channels, including large e-mail spam campaigns. Similar to the Upup.exe, it also has Trojan Horse capabilities, suggesting that the two viruses may be of the same malware family.
WDF.EXE Coin Miner Trojan Horse
Yet another malicious process that has recently been detected to use the WDF.EXE process after it creates a folder, named “wdf” in the %Windows% directory. The malware installs silently on the victims computers and it has also been reported to drop two other malicious processes on the computers, infected by it that are named:
- NvProfileUpdater64.exe
- Taskmon.exe
More information about the WDF.EXE miner can be found below:
Svchost.exe.exe (SearchGo) Miner Trojan
This malware, rather recent has been reported to likely spread via a malicious e-mail attachment, which causes the initial infection via obfuscator. Then a file is created in the %Microsoft% directory, named svchost.exe.exe. This file is reported to begin performing various different types of processes, such as inject a malicious script in the legitimate Svchost.exe process, whch is responsible for hosting the system services in Windows. This results in the fake file Svchost.exe.exe being launched from the SYSTEM user name, making it appear legitimate when you open Windows Task Manager, but it can be recognized by the double .exe.exe extension. Below, you can find more information plus removal for this suspicious process:
Wuapp.exe Monero Coin Miner Malware
This malware was detected back in the middle of December 2017 and it’s primary goal on the victim computers was to drop multiple executable files of various processes, then modify the Windows Registry Editor, which results in a the legitimate process Windows Update Service (wuapp.exe) to run in the background of the infected computer. The process does not just run however. It is embedded with the following script:
→ wuapp.exe –o pool.minexmr.com:4444 –u {wallet of the hacker} –p x –v 0 –t 2
The script itself makes it possible for the malware to to begin performing various different activities on the victim’s computer, including the begging of a mining operation via the port 4444 on the victim’s PC and this results in heavy loading of the CPU and GPU on the victim’s PC, primarily the GPU usage. More information is available on the related link below:
Android Coin Miner Virus
What appears to be the first miner malware that is oriented towards Android devices is already a fact. The virus has 3 different variations and it spreads via fake apps, like the Recitamo Santo Rosario app or the SafetyNet Wireless App. Those apps, contain a Coinhive JavaScript code which links your accunt to a Coinhive wallet and your smartphone begins to mine for different easily mineable cryptocurrencies. The ones which were mined were reportedly the following:
- Magicoin
- Feathercoin
- VertCoin
- MiriyadCoin
- Unitus
More information plus removal instructions for the Android Miner can be located on the related web link below:
qc64.exe Coin Miner Trojan
Similar to the other miners, using executables to run on the computer of the victim, the qc64.exe’s infection file may pretend to be an Invoice, a purchase receipt, order confirmation and other type of seemingly legitimate file that is usually sent to you via e-mail. Then, the qc64.exe Coin Miner may drop it’s malicious files in the system folders of Windows. Since the malware also has Trojan capabilities, it may also perform other activities of an unwanted character on your computer, like steal files, copy your passwords and logins, obtain network information form your computer and even infect it with more malware.
You can read more information about the qc64.exe miner malware from the article below:
Trojan:HTML/Brocoiner Coin Miner Virus
This JavaScript browser miner has been reported to inject a malicious JavaScript onto the computers of it’s victims and this results in the victim’s computer to connect to the Coinhive mining servcie and mine for the cryptocurrency Monero by overloading your CPU and GPU power. What is interesting about the Brocoiner Coin Miner is that it uses fake websites of video games to spread, like the old site of the game Titan Quest. Below, you can find more info about the Brocoiner malware:
JS:Cryptonight Miner Virus
This is probably one of the most notorious cryptocurrency miners out there for web browsers, primarily because it uses the Cryptonight mining algorithm to generate Monero tokens at the expense of your Graphics Processor (Video Card). And the worst thing about it is that it is very difficult to notice it, primarily because the JS:Cryptonight Miner aims to perform various different tasks to hide itself and the only way to spot is if you see that the temperature of your GPU has gone way above the average one or if you have an advanced anti-malware protection enabled. More information about the JS:Cryptonight Miner can be found below:
Service.exe and Webservice.exe Virus Processes Coin Miner
Similar to other cryptocurrency miners, using executable files to run while resembling legitimate Windows processes, the service.exe and webservice.exe files also attack the resources of your computer and it may have Trojan Horse capabilities, meaning that the viruses may create various different types of files on your computer that may link it’s IP address to a mining pool and in addition to this steal information from it. More information about the full dangers of having the service.exe and webservice.exe miners on your PC can be seen on the related article below:
“Mercury Text Not Found” Message Coin Miner
Thhis malware, runs primarily on web browsers, like Mozilla Firefox and Google Chrome and it takes advantage of a fake web page, that displays the following message:
In reality, the website embeds a JavaScript code which results in a file, named winhost.exe being drooped and ran actively on your computer. This file uses your system resources and may suddely slow down your computer plus make it freeze and some victims even report seeing BSOD (Blue Screen of Death) type of errors.
Bitcoinminer.sx Miner Malware
This Trojan has been reported to be very similar to the Adylkuzz Trojan horse which had various data stealing capabilities plus to min different types of cryptocurrencies, accoridng to what are the strong components of your computer (CPU or GPU stronger).
More information about it can be found from the related link below:
How to Detect and Remove Coin Miner Viruses Plus Protection Tips
The Coin Miner viruses have multiple different methods by which they are slithered on your computer. Some of them mine while remain filelessly on your PC, and some of them run suspicious executable processes as a system task in the background. One thing is clear though – if you have a high usage of your PC’s GPU or CPU components, recommendations are to immediately follow the removal instructions below to detect and remove such viruses, after which change all of your credentials as well (passwords, account names, e-mails, etc.).
Be advised that although you can follow many guidelines and protection tips, like the ones we have linked below, the best method to remove Coin Miner viruses and to detect them before they have even been activated is to use and advanced anti-malware protection. Such software will help you automatically remove any Coin Miner virus by scanning your PC for it’s definitions and your PC immediately becomes protected against being infected by such malware in the future as well.
To remove Coin Miner Viruses follow these steps:
1. For Windows XP, Vista and 7.
2. For Windows 8, 8.1 and 10.
Fix registry entries created by malware and PUPs on your PC.
Use SpyHunter to scan for malware and unwanted programs
1. Install SpyHunter to scan for Coin Miner Viruses and remove them.
Back up your data to secure it from malware in the future.
