Coin Miner Virus – How to Detect and Remove Them

This article has been made in order to help you in detecting and removing the new Coin Miner malware viruses from your computer and protect it against future infections as well.

Coin Miner viruses are shaping up to be the next big trend that is not likely to dissapear anytime soon. One such malware is the latest discovered BitCoinminer.sx which was very similar to the Adylkuzz Trojan horse based on the code it uses. In addition to this, many new Coin Miner viruses have also appeared, using JavaScript code that is embedded on suspcious websites or in programs and this code filelessly begins to mine for cryptocurrencies, the most often targeted of which are BitCoin and Monero as well as other altcoins. The end goal is to use your GPU and CPU power to generate tokens for the cryptocurrency wallet of the cyber-criminals and the outcome of this is not good, since your PC slows down, freezes and may even crash at some point. This is why, if you believe that your computer has been infected by a Coin Miner virus, we recommend you to learn more about those viruses and how to detect and remove them, preferably by reading the following article.

Threat Summary

Name	Coin Miner Viruses
Type	Cryptocurrency Token Miner / Trojan
Short Description	Aims to affect your computer system and use it’s CPU and GPU resources in order to mine for the cryptocurrency tokens.
Symptoms	High CPU and GPU utilization plus your PC may overheat, slow down and even break down.
Distribution Method	Via fake installers, fraudulent processes as well as malicious sites and e-mail attachments.
Detection Tool	See If Your System Has Been Affected by Coin Miner Viruses Download Malware Removal Tool
User Experience	Join Our Forum to Discuss Coin Miner Viruses.

Coin Miner Viruses – Update April 2018

Miner viruses have continued to evolve adding new technologies to them that enable them to not only act as a Worm to infect as many computers as possible, but also to use the infected machine to it’s full extent and clear example for that is the WannaMine Cryptoworm infection, imitating the notorious WannaCry ransomware. Besides this the usage of JavaScript has further evolved and become more sophisticated with RAT features in some viruses, like the Webmine.pro JavaScript miner. In addition to this, viruses have begin to imimtate system processes very well.

How Do Coin Miner Viruses Infect Victims

There may be more than one possible method of infecting computers with the Coin Miner viruses. The most often used methods are intermediary malware, such as Trojans, Injectors, Worms, malicious JavaScript and several others. These malicious files or code may infect a given victim PC via several different ways, the main of which often turn out to be:

• Malicious web links that are posted as spam messages online.
• Via web links that can exist in various different types of forms, form the likes of fake buttons, changed banners on sites or if you already have a PUP installed on your computer.
• If you have opened a malicious e-mail attachment which contains a convincing message within it and a malicious e-mail attachment.

The infection files themselves may have embedded exploits or other methods that allow them to be activated in an obfuscated manner while being undetected on the computers of victims. Such files may also be concealed as fake setups, key generators or other types unwanted types of files that exist on the victim’s computer.

Coin Miner Viruses – More Information

Throughout the years, there have been different Coin Miner viruses out there. Most of them have resembled the code of different Trojan horses, but newer viruses emerged that also use already known cryptocurrency mining algorithms, such as Cryptonight or Coinhive miners, embedded as few lines of JavaScript code uploaded on various websites. So here are some of the most notorious Coin Miner viruses that are known out there:

Upup.exe BitCoin Miner

This malware has the one and only purpose to use the CPU and GPU resources of your computer via it’s fake Upup.exe process, which it runs as a trusted process in the background of your computer via your Windows Task Manager. The malware also aims to modify the Windows Registry Sub-keys and keys in order to automatically run, even if you stop the process and the real upup.exe process is concealed somewhere in the Windows system folder or other system directories of your OS. The miner malware was reported to even possibly have other mining capabilities, such as self-update silently to remain undetected for as long as possible on your computer and in addition to this install other malware plus miners on your infected PC. Below, you can find more information about Upup.exe.

Service.exe Coin Miner Malware

This malicious Windows process is of origins that are not well documented and established, but it is known for sure that the miner malware uses a fraudulent service.exe process that acts as a system process in Windows. This process has the purpose to perform it’s mining operation silently while taking a vast amount of your CPU and GPU resources. The malware was also reported to possibly be spread via multiple different channels, including large e-mail spam campaigns. Similar to the Upup.exe, it also has Trojan Horse capabilities, suggesting that the two viruses may be of the same malware family.

WDF.EXE Coin Miner Trojan Horse

Yet another malicious process that has recently been detected to use the WDF.EXE process after it creates a folder, named “wdf” in the %Windows% directory. The malware installs silently on the victims computers and it has also been reported to drop two other malicious processes on the computers, infected by it that are named:

• NvProfileUpdater64.exe
• Taskmon.exe

More information about the WDF.EXE miner can be found below:

Svchost.exe.exe (SearchGo) Miner Trojan

This malware, rather recent has been reported to likely spread via a malicious e-mail attachment, which causes the initial infection via obfuscator. Then a file is created in the %Microsoft% directory, named svchost.exe.exe. This file is reported to begin performing various different types of processes, such as inject a malicious script in the legitimate Svchost.exe process, whch is responsible for hosting the system services in Windows. This results in the fake file Svchost.exe.exe being launched from the SYSTEM user name, making it appear legitimate when you open Windows Task Manager, but it can be recognized by the double .exe.exe extension. Below, you can find more information plus removal for this suspicious process:

Wuapp.exe Monero Coin Miner Malware

This malware was detected back in the middle of December 2017 and it’s primary goal on the victim computers was to drop multiple executable files of various processes, then modify the Windows Registry Editor, which results in a the legitimate process Windows Update Service (wuapp.exe) to run in the background of the infected computer. The process does not just run however. It is embedded with the following script:

→ wuapp.exe –o pool.minexmr.com:4444 –u {wallet of the hacker} –p x –v 0 –t 2

The script itself makes it possible for the malware to to begin performing various different activities on the victim’s computer, including the begging of a mining operation via the port 4444 on the victim’s PC and this results in heavy loading of the CPU and GPU on the victim’s PC, primarily the GPU usage. More information is available on the related link below:

Android Coin Miner Virus

What appears to be the first miner malware that is oriented towards Android devices is already a fact. The virus has 3 different variations and it spreads via fake apps, like the Recitamo Santo Rosario app or the SafetyNet Wireless App. Those apps, contain a Coinhive JavaScript code which links your accunt to a Coinhive wallet and your smartphone begins to mine for different easily mineable cryptocurrencies. The ones which were mined were reportedly the following:

• Magicoin
• Feathercoin
• VertCoin
• MiriyadCoin
• Unitus

More information plus removal instructions for the Android Miner can be located on the related web link below:

qc64.exe Coin Miner Trojan

Similar to the other miners, using executables to run on the computer of the victim, the qc64.exe’s infection file may pretend to be an Invoice, a purchase receipt, order confirmation and other type of seemingly legitimate file that is usually sent to you via e-mail. Then, the qc64.exe Coin Miner may drop it’s malicious files in the system folders of Windows. Since the malware also has Trojan capabilities, it may also perform other activities of an unwanted character on your computer, like steal files, copy your passwords and logins, obtain network information form your computer and even infect it with more malware.

You can read more information about the qc64.exe miner malware from the article below:

Trojan:HTML/Brocoiner Coin Miner Virus

This JavaScript browser miner has been reported to inject a malicious JavaScript onto the computers of it’s victims and this results in the victim’s computer to connect to the Coinhive mining servcie and mine for the cryptocurrency Monero by overloading your CPU and GPU power. What is interesting about the Brocoiner Coin Miner is that it uses fake websites of video games to spread, like the old site of the game Titan Quest. Below, you can find more info about the Brocoiner malware:

JS:Cryptonight Miner Virus

This is probably one of the most notorious cryptocurrency miners out there for web browsers, primarily because it uses the Cryptonight mining algorithm to generate Monero tokens at the expense of your Graphics Processor (Video Card). And the worst thing about it is that it is very difficult to notice it, primarily because the JS:Cryptonight Miner aims to perform various different tasks to hide itself and the only way to spot is if you see that the temperature of your GPU has gone way above the average one or if you have an advanced anti-malware protection enabled. More information about the JS:Cryptonight Miner can be found below:

Service.exe and Webservice.exe Virus Processes Coin Miner

Similar to other cryptocurrency miners, using executable files to run while resembling legitimate Windows processes, the service.exe and webservice.exe files also attack the resources of your computer and it may have Trojan Horse capabilities, meaning that the viruses may create various different types of files on your computer that may link it’s IP address to a mining pool and in addition to this steal information from it. More information about the full dangers of having the service.exe and webservice.exe miners on your PC can be seen on the related article below:

“Mercury Text Not Found” Message Coin Miner

Thhis malware, runs primarily on web browsers, like Mozilla Firefox and Google Chrome and it takes advantage of a fake web page, that displays the following message:

In reality, the website embeds a JavaScript code which results in a file, named winhost.exe being drooped and ran actively on your computer. This file uses your system resources and may suddely slow down your computer plus make it freeze and some victims even report seeing BSOD (Blue Screen of Death) type of errors.

Bitcoinminer.sx Miner Malware

This Trojan has been reported to be very similar to the Adylkuzz Trojan horse which had various data stealing capabilities plus to min different types of cryptocurrencies, accoridng to what are the strong components of your computer (CPU or GPU stronger).

More information about it can be found from the related link below:

How to Detect and Remove Coin Miner Viruses Plus Protection Tips

The Coin Miner viruses have multiple different methods by which they are slithered on your computer. Some of them mine while remain filelessly on your PC, and some of them run suspicious executable processes as a system task in the background. One thing is clear though – if you have a high usage of your PC’s GPU or CPU components, recommendations are to immediately follow the removal instructions below to detect and remove such viruses, after which change all of your credentials as well (passwords, account names, e-mails, etc.).

Be advised that although you can follow many guidelines and protection tips, like the ones we have linked below, the best method to remove Coin Miner viruses and to detect them before they have even been activated is to use and advanced anti-malware protection. Such software will help you automatically remove any Coin Miner virus by scanning your PC for it’s definitions and your PC immediately becomes protected against being infected by such malware in the future as well.

Manually delete Coin Miner Viruses from your computer

Note! Substantial notification about the Coin Miner Viruses threat: Manual removal of Coin Miner Viruses requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove Coin Miner Viruses files and objects

Boot Your PC Into Safe Mode

1. For Windows 7,XP and Vista. 2. For Windows 8, 8.1 and 10. Fix registry entries created by Coin Miner Viruses on your PC.

For Windows XP, Vista, 7 systems:

1. Remove all CDs and DVDs, and then Restart your PC from the “Start” menu.
2. Select one of the two options provided below:

– For PCs with a single operating system: Press “F8” repeatedly after the first boot screen shows up during the restart of your computer. In case the Windows logo appears on the screen, you have to repeat the same task again.

– For PCs with multiple operating systems: Тhe arrow keys will help you select the operating system you prefer to start in Safe Mode. Press “F8” just as described for a single operating system.

3. As the “Advanced Boot Options” screen appears, select the Safe Mode option you want using the arrow keys. As you make your selection, press “Enter“.

4. Log on to your computer using your administrator account

While your computer is in Safe Mode, the words “Safe Mode” will appear in all four corners of your screen.

Step 1: Open the Start Menu

Step 2: Whilst holding down Shift button, click on Power and then click on Restart.
Step 3: After reboot, the aftermentioned menu will appear. From there you should choose Troubleshoot.

Step 4: You will see the Troubleshoot menu. From this menu you can choose Advanced Options.

Step 5: After the Advanced Options menu appears, click on Startup Settings.

Step 6: Click on Restart.

Step 7: A menu will appear upon reboot. You should choose Safe Mode by pressing its corresponding number and the machine will restart.

Some malicious scripts may modify the registry entries of your computer to change different settings. This is why manual clean up of your Windows Registry Database is strongly recommended. Since the tutorial on how to do this is a bit lenghty, we recommend following our instructive article about fixing registry entries.

2. Find malicious files created by Coin Miner Viruses on your PC

Find malicious files created by Coin Miner Viruses

1. For Windows 8, 8.1 and 10. 2. For Windows 7,XP and Vista.

For Newer Windows Operating Systems

Step 1:

On your keyboard press  + R and write explorer.exe in the Run text box and then click on the Ok button.

Step 2:

Click on your PC from the quick access bar. This is usually an icon with a monitor and its name is either “My Computer”, “My PC” or “This PC” or whatever you have named it.

Step 3:

Navigate to the search box in the top-right of your PC’s screen and type “fileextension:” and after which type the file extension. If you are looking for malicious executables, an example may be “fileextension:exe”. After doing that, leave a space and type the file name you believe the malware has created. Here is how it may appear if your file has been found:

N.B. We recommend to wait for the green loading bar in the navination box to fill up in case the PC is looking for the file and hasn’t found it yet.

For Older Windows Operating Systems

In older Windows OS’s the conventional approach should be the effective one:

Step 1:

Click on the Start Menu icon (usually on your bottom-left) and then choose the Search preference.

Step 2:

After the search window appears, choose More Advanced Options from the search assistant box. Another way is by clicking on All Files and Folders.

Step 3:

After that type the name of the file you are looking for and click on the Search button. This might take some time after which results will appear. If you have found the malicious file, you may copy or open its location by right-clicking on it.

Now you should be able to discover any file on Windows as long as it is on your hard drive and is not concealed via special software.

Automatically remove Coin Miner Viruses by downloading an advanced anti-malware program

1. Remove Coin Miner Viruses with SpyHunter Anti-Malware Tool

Remove Coin Miner Viruses with SpyHunter Anti-Malware Tool

1. Install SpyHunter to scan for and remove Coin Miner Viruses.2. Scan with SpyHunter to Detect and Remove Coin Miner Viruses.

Step 1:Click on the “Download” button to proceed to SpyHunter’s download page.

Download

Malware Removal Tool

It is highly recommended to run a scan before purchasing the full version of the software to make sure that the current version of the malware can be detected by SpyHunter.

Step 2: Guide yourself by the download instructions provided for each browser.
Step 3: After you have installed SpyHunter, wait for it to automatically update.

Step1: After the update process has finished, click on the ‘Scan Computer Now’ button.

Step2: After SpyHunter has finished scanning your PC for any Coin Miner Viruses files, click on the ‘Fix Threats’ button to remove them automatically and permanently.

Step3: Once the intrusions on your PC have been removed, it is highly recommended to restart it.

Optional: Using Alternative Anti-Malware Tools

Remove Coin Miner Viruses Using Other Alternative Tools

STOPZilla Anti Malware

1. Download and Install STOPZilla Anti-malware to Scan for And Remove Coin Miner Viruses.
Step 1: Download STOPZilla by clicking here.
Step 2: A pop-up window will appear. Click on the ‘Save File’ button. If it does not, click on the Download button and save it afterwards.

Step 3: After you have downloaded the setup, simply open it.
Step 4: The installer should appear. Click on the ‘Next’ button.

Step 5: Check the ‘I accept the agreement’ check circle if not checked if you accept it and click the ‘Next’ button once again.

Step 6: Review and click on the ‘Install’ button.

Step 7: After the installation process has completed click on the ‘Finish’ button.

2. Scan your PC with STOPZilla Anti Malware to remove all Coin Miner Viruses associated files completely.
Step 1: Launch STOPZilla if you haven’t launched it after install.
Step 2: Wait for the software to automatically scan and then click on the ‘Repair Now’ button. If it does not scan automatically, click on the ‘Scan Now’ button.

Step 3: After the removal of all threats and associated objects, you should Restart your PC.

Coin Miner Viruses Protection Tips

To best help you protect yourself against such malware in the future, you can follow the tips we have provided below:

• Run programs in sandbox.
• Install advanced anti-malware protection.
• Keep everything updated, especially your web browsers.
• Install ad-blocker software.
• Be very careful on how you open e-mails.
• Disable macros in Microsoft Office.
• Disable JavaScript if you are not using it.
• Keep your firewall and automatic updates on at all times.

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website