Coin Miner Virus – How to Detect and Remove Them - How to, Technology and PC Security Forum |

Coin Miner Virus – How to Detect and Remove Them

malware miners imageThis article has been made in order to help you in detecting and removing the new Coin Miner malware viruses from your computer and protect it against future infections as well.

Coin Miner viruses are shaping up to be the next big trend that is not likely to dissapear anytime soon. One such malware is the latest discovered which was very similar to the Adylkuzz Trojan horse based on the code it uses. In addition to this, many new Coin Miner viruses have also appeared, using JavaScript code that is embedded on suspcious websites or in programs and this code filelessly begins to mine for cryptocurrencies, the most often targeted of which are BitCoin and Monero as well as other altcoins. The end goal is to use your GPU and CPU power to generate tokens for the cryptocurrency wallet of the cyber-criminals and the outcome of this is not good, since your PC slows down, freezes and may even crash at some point. This is why, if you believe that your computer has been infected by a Coin Miner virus, we recommend you to learn more about those viruses and how to detect and remove them, preferably by reading the following article.

Threat Summary

NameCoin Miner Viruses
TypeCryptocurrency Token Miner / Trojan
Short DescriptionAims to affect your computer system and use it’s CPU and GPU resources in order to mine for the cryptocurrency tokens.
SymptomsHigh CPU and GPU utilization plus your PC may overheat, slow down and even break down.
Distribution MethodVia fake installers, fraudulent processes as well as malicious sites and e-mail attachments.
Detection Tool See If Your System Has Been Affected by Coin Miner Viruses


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Coin Miner Viruses.

Coin Miner Viruses – Update April 2018

Miner viruses have continued to evolve adding new technologies to them that enable them to not only act as a Worm to infect as many computers as possible, but also to use the infected machine to it’s full extent and clear example for that is the WannaMine Cryptoworm infection, imitating the notorious WannaCry ransomware. Besides this the usage of JavaScript has further evolved and become more sophisticated with RAT features in some viruses, like the JavaScript miner. In addition to this, viruses have begin to imimtate system processes very well.

How Do Coin Miner Viruses Infect Victims

There may be more than one possible method of infecting computers with the Coin Miner viruses. The most often used methods are intermediary malware, such as Trojans, Injectors, Worms, malicious JavaScript and several others. These malicious files or code may infect a given victim PC via several different ways, the main of which often turn out to be:

  • Malicious web links that are posted as spam messages online.
  • Via web links that can exist in various different types of forms, form the likes of fake buttons, changed banners on sites or if you already have a PUP installed on your computer.
  • If you have opened a malicious e-mail attachment which contains a convincing message within it and a malicious e-mail attachment.

The infection files themselves may have embedded exploits or other methods that allow them to be activated in an obfuscated manner while being undetected on the computers of victims. Such files may also be concealed as fake setups, key generators or other types unwanted types of files that exist on the victim’s computer.

Coin Miner Viruses – More Information

Throughout the years, there have been different Coin Miner viruses out there. Most of them have resembled the code of different Trojan horses, but newer viruses emerged that also use already known cryptocurrency mining algorithms, such as Cryptonight or Coinhive miners, embedded as few lines of JavaScript code uploaded on various websites. So here are some of the most notorious Coin Miner viruses that are known out there:

Upup.exe BitCoin Miner

This malware has the one and only purpose to use the CPU and GPU resources of your computer via it’s fake Upup.exe process, which it runs as a trusted process in the background of your computer via your Windows Task Manager. The malware also aims to modify the Windows Registry Sub-keys and keys in order to automatically run, even if you stop the process and the real upup.exe process is concealed somewhere in the Windows system folder or other system directories of your OS. The miner malware was reported to even possibly have other mining capabilities, such as self-update silently to remain undetected for as long as possible on your computer and in addition to this install other malware plus miners on your infected PC. Below, you can find more information about Upup.exe.

Related Story: Upup.exe Virus – How to Detect and Remove from Your PC

Service.exe Coin Miner Malware

This malicious Windows process is of origins that are not well documented and established, but it is known for sure that the miner malware uses a fraudulent service.exe process that acts as a system process in Windows. This process has the purpose to perform it’s mining operation silently while taking a vast amount of your CPU and GPU resources. The malware was also reported to possibly be spread via multiple different channels, including large e-mail spam campaigns. Similar to the Upup.exe, it also has Trojan Horse capabilities, suggesting that the two viruses may be of the same malware family.

Related Story: Service.exe Virus Process (Coin Miner) – How to Remove It Completely

WDF.EXE Coin Miner Trojan Horse

Yet another malicious process that has recently been detected to use the WDF.EXE process after it creates a folder, named “wdf” in the %Windows% directory. The malware installs silently on the victims computers and it has also been reported to drop two other malicious processes on the computers, infected by it that are named:

  • NvProfileUpdater64.exe
  • Taskmon.exe

More information about the WDF.EXE miner can be found below:

Related Story: WDF.EXE Crypto Miner – How to Remove It

Svchost.exe.exe (SearchGo) Miner Trojan

This malware, rather recent has been reported to likely spread via a malicious e-mail attachment, which causes the initial infection via obfuscator. Then a file is created in the %Microsoft% directory, named svchost.exe.exe. This file is reported to begin performing various different types of processes, such as inject a malicious script in the legitimate Svchost.exe process, whch is responsible for hosting the system services in Windows. This results in the fake file Svchost.exe.exe being launched from the SYSTEM user name, making it appear legitimate when you open Windows Task Manager, but it can be recognized by the double .exe.exe extension. Below, you can find more information plus removal for this suspicious process:

Related Story: Svchost.exe.exe (SearchGo) Monero Miner Trojan – How to Remove It

Wuapp.exe Monero Coin Miner Malware

This malware was detected back in the middle of December 2017 and it’s primary goal on the victim computers was to drop multiple executable files of various processes, then modify the Windows Registry Editor, which results in a the legitimate process Windows Update Service (wuapp.exe) to run in the background of the infected computer. The process does not just run however. It is embedded with the following script:

→ wuapp.exe –o –u {wallet of the hacker} –p x –v 0 –t 2

The script itself makes it possible for the malware to to begin performing various different activities on the victim’s computer, including the begging of a mining operation via the port 4444 on the victim’s PC and this results in heavy loading of the CPU and GPU on the victim’s PC, primarily the GPU usage. More information is available on the related link below:

Related Story: Wuapp.exe Monero Miner Virus – How to Remove It

Android Coin Miner Virus

What appears to be the first miner malware that is oriented towards Android devices is already a fact. The virus has 3 different variations and it spreads via fake apps, like the Recitamo Santo Rosario app or the SafetyNet Wireless App. Those apps, contain a Coinhive JavaScript code which links your accunt to a Coinhive wallet and your smartphone begins to mine for different easily mineable cryptocurrencies. The ones which were mined were reportedly the following:

  • Magicoin
  • Feathercoin
  • VertCoin
  • MiriyadCoin
  • Unitus

More information plus removal instructions for the Android Miner can be located on the related web link below:

Related Story: Android Miner Virus (Coin Miner) – How to Remove from Your Mobile Device

qc64.exe Coin Miner Trojan

Similar to the other miners, using executables to run on the computer of the victim, the qc64.exe’s infection file may pretend to be an Invoice, a purchase receipt, order confirmation and other type of seemingly legitimate file that is usually sent to you via e-mail. Then, the qc64.exe Coin Miner may drop it’s malicious files in the system folders of Windows. Since the malware also has Trojan capabilities, it may also perform other activities of an unwanted character on your computer, like steal files, copy your passwords and logins, obtain network information form your computer and even infect it with more malware.

You can read more information about the qc64.exe miner malware from the article below:

Related Story: How to Remove qc64.exe Miner Trojan?

Trojan:HTML/Brocoiner Coin Miner Virus

This JavaScript browser miner has been reported to inject a malicious JavaScript onto the computers of it’s victims and this results in the victim’s computer to connect to the Coinhive mining servcie and mine for the cryptocurrency Monero by overloading your CPU and GPU power. What is interesting about the Brocoiner Coin Miner is that it uses fake websites of video games to spread, like the old site of the game Titan Quest. Below, you can find more info about the Brocoiner malware:

Related Story: How to Remove Brocoiner Coinhive Monero Miner?

JS:Cryptonight Miner Virus

This is probably one of the most notorious cryptocurrency miners out there for web browsers, primarily because it uses the Cryptonight mining algorithm to generate Monero tokens at the expense of your Graphics Processor (Video Card). And the worst thing about it is that it is very difficult to notice it, primarily because the JS:Cryptonight Miner aims to perform various different tasks to hide itself and the only way to spot is if you see that the temperature of your GPU has gone way above the average one or if you have an advanced anti-malware protection enabled. More information about the JS:Cryptonight Miner can be found below:

Related Story: How to Remove JS:Cryptonight Coin Miner Virus?

Service.exe and Webservice.exe Virus Processes Coin Miner

Similar to other cryptocurrency miners, using executable files to run while resembling legitimate Windows processes, the service.exe and webservice.exe files also attack the resources of your computer and it may have Trojan Horse capabilities, meaning that the viruses may create various different types of files on your computer that may link it’s IP address to a mining pool and in addition to this steal information from it. More information about the full dangers of having the service.exe and webservice.exe miners on your PC can be seen on the related article below:

Related Story: How to Remove the Service.exe Virus Process (Crypto-Miner)
Related Story: How to Remove the WebService.exe Virus Process (Crypto-Miner)

“Mercury Text Not Found” Message Coin Miner

Thhis malware, runs primarily on web browsers, like Mozilla Firefox and Google Chrome and it takes advantage of a fake web page, that displays the following message:

In reality, the website embeds a JavaScript code which results in a file, named winhost.exe being drooped and ran actively on your computer. This file uses your system resources and may suddely slow down your computer plus make it freeze and some victims even report seeing BSOD (Blue Screen of Death) type of errors. Miner Malware

This Trojan has been reported to be very similar to the Adylkuzz Trojan horse which had various data stealing capabilities plus to min different types of cryptocurrencies, accoridng to what are the strong components of your computer (CPU or GPU stronger).

More information about it can be found from the related link below:

Related Story: How to Remove from Your Computer

How to Detect and Remove Coin Miner Viruses Plus Protection Tips

The Coin Miner viruses have multiple different methods by which they are slithered on your computer. Some of them mine while remain filelessly on your PC, and some of them run suspicious executable processes as a system task in the background. One thing is clear though – if you have a high usage of your PC’s GPU or CPU components, recommendations are to immediately follow the removal instructions below to detect and remove such viruses, after which change all of your credentials as well (passwords, account names, e-mails, etc.).

Be advised that although you can follow many guidelines and protection tips, like the ones we have linked below, the best method to remove Coin Miner viruses and to detect them before they have even been activated is to use and advanced anti-malware protection. Such software will help you automatically remove any Coin Miner virus by scanning your PC for it’s definitions and your PC immediately becomes protected against being infected by such malware in the future as well.

Related Story: How to Protect Yourself from Getting Infected With Malicious E-mails

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Follow Me:

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share