7

My Kaspersky Internet Security said it detects a trojan at (do not go to the link below, my KIS said it's trojan): 

https:// coinhive.com/lib/coinhive.min.js

The Trojan name is Trojan.JS.Miner.d.

When I see this trojan, I have to monkey around with KIS so I'm so scared that this Trojan may infect my PC now. I want to know what is this trojan, and can I check if my PC is infected with this trojan or not?

Improve this question
1
  • KIS is more like a trojan once you've full discovered what it can do.
    – Sajuuk
    Mar 21, 2018 at 8:55

3 Answers 3

Reset to default
16

This is neither a virus nor a trojan, and it does not make the site unsafe to visit in any way whatsoever. Your antivirus package is crying wolf.

Coinhive is a Javascript plugin which implements a cryptocurrency miner. While you view a web site which uses this script, your browser will perform calculations to mine cryptocurrency for the owner of the web site.

Some users find this script annoying and inappropriate, as it will increase CPU usage (and, hence, power consumption) on your web browser while you have the web site open. However, this will end as soon as you leave the site.

Improve this answer
13
  • But what about this article: malwaretips.com/blogs/remove-coinhive-miner-virus . I can see the dangerous of this walware.
    – 123iamking
    Oct 1, 2017 at 4:22
  • And I also want to know where it store the trojan on my PC? Is it hidden somewhere on the hardisk?
    – 123iamking
    Oct 1, 2017 at 4:23
  • 2
    The point is: if the Administrator of the Site installed Coinhive on his site, its ok. If you install it on your site it's ok. If one of these two are not given, it is their problem. So in short: if you don't have installed somekind of Coinhive miner in your browser but an addon load it. You are infected. If the Website has a Miner but the Administrator didn't install it, it was hacked.
    – Serverfrog
    Oct 13, 2017 at 11:28
  • 3
    One other hint: many Antivirus Companies will show this because of two things: first it can be bad if a third party install it (it will consume your power) and the other thing is: you won't buy a antivirus solution which doesn't tell you sometimes that it found something
    – Serverfrog
    Oct 13, 2017 at 11:30
  • 4
    @Overmind Is an annoying flash animation on a website that increases my cpu usage a virus?
    – Tom K.
    Dec 8, 2017 at 12:01
5

The article is clear enough-- it is a JS library that mines Monero (cryptocurrency).

On legitimate sites, it's innocuous but annoying. But it has been bundled with (and thereby associated with) more than a few types of browser malware that force it to run on all sites and send the money back to the sole executor, which is why the AV is flagging it as bad-- thanks to AV logic, a hammer is just a tool until it's used in a murder, then going forward it assumes all hammers are murder implements.

The fact that your AV picked it up over the wire from its original source indicates this is likely a false positive. If it had found it buried in some app-data folder somewhere you should be concerned.

Improve this answer
3
  • 1
    "If all you have is a hammer, you see all problems as nails". Now it is "if you see a murderous hammer, all hammers are murderers"
    – schroeder ♦
    Dec 8, 2017 at 10:47
  • minor (pun intended) note: it mines monero, not bitcoin
    – not22
    Dec 8, 2017 at 17:39
  • It appears in my Safari cache. Does this mean that it's been running in the browser continuously?
    – aris
    Feb 1, 2018 at 22:25
1

There are many articles that talk about javascript miners, i.e. monero coin-hive.

All cryptocurrency miners are harmless UNLESS it is NOT running with user consent.

There are countless malware out there packed with legitimate miners, so for any antivirus, it is common sense to flag them, since users will complain that the AV is "not doing its job" when the system slows down or overheats!

(update) By the way, I don't think any organisation wants a lurking miner in their network. Well, unless their sole business is mining cryptocurrency blockchain.

Improve this answer
1
  • They all run without user consent. I have rarely seen sites that notify you of a coin miner. Yet they're harmless (regular sites with a coinminer).
    – EpicKip
    Dec 8, 2017 at 12:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.