Monero Miner (Removal Guide) - Nov 2017 update

What is Monero Miner?

Monero Miner – malicious program used to mine cryptocurrencies behind users' back

Monero Miner is a malicious program that has been actively mining Monero cryptocurrency^[1] since 2016. In 2017, Monero virus has been updated and continued making virtual currency illegally by using affected computer’s CPU. Currently, JSMiner-C, Coinminer, Vatico Monero (XMR) CPU Miner, Shadowsocks Miner, Wise XMRig virus and other miners are spreading on the web.

Monero virus has mostly been spread as a Trojan horse and invaded systems with a help of software bundle. However, security experts have recently detected Coinhive JS miner which uses JavaScript library, injected in several popular websites and browser extensions, to spread around.

Gplyra Miner, Vnlgp Miner and CPU Miner are just a few of the cyber threats that stand alongside this threat virus. Their purpose is the same – mine cryptocurrency. While other miners focus on Bitcoins, Dash or Decred, Monero CPU Miner – as its title suggest itself – is based on mining Monero cryptocoins.

This malware occupies computers by stealth but still can be seen running as NsCpuCNMiner32.exe or Photo.scr in the system’s Task Manager. In fact, the hackers create Botnets of such computers that all use Monero virus for the same purpose. Of course, their owners have no idea about such activity being carried out behind their back and they only notice something is up when their devices start acting strange.

The main issue caused by Monero virus and similar miners is their CPU usage – typically, they use so much system's capabilities that they clearly decrease computers' speed. In fact, all of this extra use of resources will not only slow your device but may also cause hardware damage due to overheating.

Frankly, Trojan creators do not care about your computer performance and only use it to generate profit for themselves. Luckily, you do not have to face all of these inconveniences. There is a way to stop and remove Monero virus from your computer. To be precise, automatic virus-fighting utilities like FortectIntego or Malwarebytes can help you take care of that. Keep reading the article for more recommendations on the virus elimination.

Coinhive technology gets abused by cybercriminals

Coinhive is a JavaScript library for Monero Blockchain that it can be integrated into various websites. This tool was launched only a few weeks ago, on September 14, but already managed to grab crooks’ attention. Unscrupulous people took advantage of this tool to mine cryptocurrency using computer’s CPU while a user browses particular websites. Besides, Coinhive JS miner was also spotted spreading via tech support scam campaign.^[2]

Researchers spotted Coinhive being integrated into SafeBrowse extension too. When users install this extension, Monero Miner virus was started running and using up to 50% of computer’s CPU. Due to this activity, a computer becomes sluggish and might be physically damaged due to working on high heat. The mining process keeps running until users close the browser. Therefore, this activity might take hours.

What is more, Coinhive was embedded in various websites that mimic popular social networks, for instance, Twitter. Indeed, there’s a registered domain twitter.com.com which loads mining program as soon as a person mistypes Twitter’s address and enters this site. It’s possible that crooks registered numerous similar sites and currently profit from inattentive computer users.

Additionally, it a bunch of websites was reported of using in-browser miner secretly.^[3] Among such sites was The Pirate Bay,^[4], showtime.com and showtimeanytime.com.^[5]. However, the latter websites stopped these activities as soon as it was spotted. Though, the online community discusses that owners of these sites may have earned hundreds of thousands of dollars.

Update August 2017: Vatico Monero (XMR) CPU Miner hits the surface

The latest version malware is set to mine XMR, Monero and other digital currency. As its former version, the malware also functions via a trojan. On the other hand, it can be detected as moloko.exe. The file name suggests that the malware might have originated or targeting Russian^[6] users. Unfortunately, mining trojans are a relevant issue in the country.^[4]

The Task Manager will identify it as Monero (XMR) CPU miner. The key indicator suggesting the presence of a miner virus is extremely high CPU usage. The malware will also connect to XMR mining pool at xmr-eu.dwarfpool.com:8050 and start its activity.

Even if you do not have a habit to check the Task manager once in a while, you will notice the deteriorated PC processes. In case you encountered this cyber misfortune, eliminate it right away.

Elaborating on the modus operandi of Monero Miner, it is important to note that this infection enters the computer as a Photo.scr file which then drops copies of the same file on all of the infected computer drives. Eventually, the Trojan extracts the executable NsCpuCNMiner32.exe which is responsible for the mining process.

This file will be placed in the %Temp% folder and operates from it. This process will also initiate automatically every time the computer is booted. Fortunately, the hackers are helpless if your device is disconnected from the Internet because all of the mining processes need a network connection to perform properly. Thus, it is also recommended to carry out the Monero Miner removal while offline. To learn how to do it manually, scroll down below.

November 2nd, 2017: Malicious Monero Miners found in Google Play Store

Once again, Google Play Store proved to be an untrustworthy “official app” store. It seems that all the latest malware tendencies successfully reach this app platform and start attacking Android users straight away. This time, researchers spotted malicious apps hiding cryptocurrency-mining scripts in them. The malicious Android Monero Miner virus is usually recognized as ANDROIDOS_JSMINER or ANDROIDOS_CPUMINER.

The JSMiner, one of Monero virus versions, was detected in “Recitiamo Santo Rosario Free” (an app for religious mobile users) and “SafetyNet Wireless App” (an app promising great deals and coupons for watching videos and taking surveys). Not surprisingly, these apps take advantage of Coinhive technology (described above) to mine digital currency. The JavaScript code executes itself within apps' webview; however, the victim won't notice anything suspicious except for the following issues:

• Shorter battery life;
• Slow performance of the device;
• App crashes.

The CPUMiner was detected as “Car Wallpaper HD: mercedes, ferrari, bmw and audi” application. This group of malicious applications configures legitimate versions of apps and infects them with cryptocurrency-mining libraries such as cpuminer (the criminals use an updated 2.5.1. version of it).

Later on, these are repacked and distributed. Analysis from TrendMicro^[7] shows that this type of malware is capable of mining several cryptocurrencies (not exceptionally Monero).

The code responsible for mining gets a config file from criminals' servers. The file contains data about the mining pool via Stratum mining protocol.

Monero Miner virus still targets unsuspecting users.

Monero Miner versions and processes associated with them

ShellExperienceHost.exe and MicrosoftShellHost.exe. These processes might show up in the Windows Task Manager after the Trojan horse infiltration. The malicious program creates ShellExperienceHost.exe which is launched automatically at system startup. This process also launches MicrosoftShellHost.exe which is responsible for mining Monero cryptocurrency by using affected computer’s CPU processing power.

Booster.exe. This trojan horse might enter the system with the help of adware bundles. Once inside, it configures Windows settings in order to launch at system startup. In the Task Manager, Booster.exe file is described as VsGraphics Desktop Engine. However, it uses up to 25% computer’s CPU which is a clear indicator of mining virtual currency.

Wise XMRig virus. The Wise Miner is a Trojan horse that can create two processes on the affected device in order to mine Monero currency – AudioHD.exe and winserv.exe. When this Trojan enters the system, it immediately creates the AudioHD.exe miner that starts running when a user turns on his/her computer. In the task manager, this process has a description of XMRig.

Another file associated with Wise Miner is winserv.exe which has a description of the WindowsHub. Both of these processes use lots of computer’s CPU power and makes the system sluggish.

Shadowsocks Miner. This trojan horse is known for creating and launching service.exe or websock.exe processes on the affected device. Users can see them in the Windows Task Manager using lots of computer’s resources. Malware often arrives on the system in software bundles. Additionally, it might bring other spyware or potentially unwanted apps to the system too.

Vatico Monero (XMR) CPU Miner. This Trojan horse gets inside the system pretending to be a useful program. However, once it gets inside the system, it launches an autorun process moloko.exe. Thus, every time a victim boots Windows, the miner starts using up to 80% computer’s CPU to mine Monero.

Adylkuzz Miner virus. This Monero virus gets inside the system using the EternalBlue exploit and DoublePulsar backdoor. Malware connects affected computer to the mining botnet and starts using its CPU to mine cryptocurrency. Connecting affected computers into network helps to generate more crypto-money than usual.

Coinhive Miner. Authors of the miner took advantage of the legit Coinhive tool that allows website owners mining crypto-currency. Crooks took placed a mining code into malicious browser extensions and hacked websites. Additionally, criminals spread this virus via tech support scams or corrupted sites that are impossible to open without forcing the browser to quit.

Monero Miner distribution techniques

Mostly, Monero Miner is distributed via various suspicious domains and fraudulent websites. The users who download it on their computers are tricked into thinking they are obtaining some useful content. In reality, they download an infected file, which immediately starts spreading the virus throughout the computer preparing for the mining process.

It is especially important to check your computer for malware regularly, especially if you frequently download software online. It is also advisable to keep track of the programs that are entering your PC and additionally check them with reliable antivirus scanners.

On September 2017, malware has been noticed spreading via SafeBrowse extension too. Therefore, Google Chrome users are advised to stay away from this extension. This version of malware is extremely dangerous to the computer because it uses lots of computer's CPU. In the Task Manager users can see that Chrome uses up to 50% of CPU. However, if you open Chrome Task Manager, you will find out that the problem is the SafeBrowse extension.

Remove Monero Miner Trojan instantly using professional guidelines

Though Monero Miner virus is a bit more complex than the browser hijackers, adware, and similar lightweight infections, it can be eliminated from the infected computers nearly effortlessly. As we have already mentioned, you can remove Monero Miner automatically. You only need to select a trusted anti-virus utility for the job, for instance FortectIntego or Malwarebytes.

Scan your computer with your chosen anti-malware, antispyware or antivirus software and you will not have to deal with system slowdowns and computer crashes anymore. We should remind you that the Monero virus removal will be more successful if you execute it offline, using the Safe Mode.

Besides, if you have installed (or it came in software bundle) SafeBrowse Chrome extension, you have to uninstall it as well. As we have mentioned in the article, it is closely related to the malware and puts your computer in danger due to high usage of CPU.