7

My Kaspersky Internet Security said it detects a trojan at (do not go to the link below, my KIS said it's trojan):

https:// coinhive.com/lib/coinhive.min.js

The Trojan name is Trojan.JS.Miner.d.

When I see this trojan, I have to monkey around with KIS so I'm so scared that this Trojan may infect my PC now. I want to know what is this trojan, and can I check if my PC is infected with this trojan or not?

  • KIS is more like a trojan once you've full discovered what it can do. – Sajuuk Mar 21 '18 at 8:55
16

This is neither a virus nor a trojan, and it does not make the site unsafe to visit in any way whatsoever. Your antivirus package is crying wolf.

Coinhive is a Javascript plugin which implements a cryptocurrency miner. While you view a web site which uses this script, your browser will perform calculations to mine cryptocurrency for the owner of the web site.

Some users find this script annoying and inappropriate, as it will increase CPU usage (and, hence, power consumption) on your web browser while you have the web site open. However, this will end as soon as you leave the site.

  • But what about this article: malwaretips.com/blogs/remove-coinhive-miner-virus . I can see the dangerous of this walware. – 123iamking Oct 1 '17 at 4:22
  • And I also want to know where it store the trojan on my PC? Is it hidden somewhere on the hardisk? – 123iamking Oct 1 '17 at 4:23
  • 2
    The point is: if the Administrator of the Site installed Coinhive on his site, its ok. If you install it on your site it's ok. If one of these two are not given, it is their problem. So in short: if you don't have installed somekind of Coinhive miner in your browser but an addon load it. You are infected. If the Website has a Miner but the Administrator didn't install it, it was hacked. – Serverfrog Oct 13 '17 at 11:28
  • 3
    One other hint: many Antivirus Companies will show this because of two things: first it can be bad if a third party install it (it will consume your power) and the other thing is: you won't buy a antivirus solution which doesn't tell you sometimes that it found something – Serverfrog Oct 13 '17 at 11:30
  • 4
    @Overmind Is an annoying flash animation on a website that increases my cpu usage a virus? – Tom K. Dec 8 '17 at 12:01
5

The article is clear enough-- it is a JS library that mines Monero (cryptocurrency).

On legitimate sites, it's innocuous but annoying. But it has been bundled with (and thereby associated with) more than a few types of browser malware that force it to run on all sites and send the money back to the sole executor, which is why the AV is flagging it as bad-- thanks to AV logic, a hammer is just a tool until it's used in a murder, then going forward it assumes all hammers are murder implements.

The fact that your AV picked it up over the wire from its original source indicates this is likely a false positive. If it had found it buried in some app-data folder somewhere you should be concerned.

  • 1
    "If all you have is a hammer, you see all problems as nails". Now it is "if you see a murderous hammer, all hammers are murderers" – schroeder Dec 8 '17 at 10:47
  • minor (pun intended) note: it mines monero, not bitcoin – not22 Dec 8 '17 at 17:39
  • It appears in my Safari cache. Does this mean that it's been running in the browser continuously? – aris Feb 1 '18 at 22:25
1

There are many articles that talk about javascript miners, i.e. monero coin-hive.

All cryptocurrency miners are harmless UNLESS it is NOT running with user consent.

There are countless malware out there packed with legitimate miners, so for any antivirus, it is common sense to flag them, since users will complain that the AV is "not doing its job" when the system slows down or overheats!

(update) By the way, I don't think any organisation wants a lurking miner in their network. Well, unless their sole business is mining cryptocurrency blockchain.

  • They all run without user consent. I have rarely seen sites that notify you of a coin miner. Yet they're harmless (regular sites with a coinminer). – EpicKip Dec 8 '17 at 12:42

protected by Community Dec 12 '17 at 7:36

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.