Short bio
RiskWare.CoinMiner is Malwarebytes’ generic detection name for crypto-currency miners that may be active on a system without user consent.
Symptoms
Users may notice a very slow computer as most of the CPU cycles will be used up by the miner. They may alos notice side-effects like high temperatures and noisy systems.
Type and source of infection
Riskware, in general, is a detection for items that are not strictly malicious, but pose some sort of risk for the user in another way.
Crypto-currency miners use a lot of resources to optimize the earning of the virtual currency. For this reason, threat actorstry to use other people’s machines to do the mining for them. This detection warns you that a bitcoin miner is active on your system, but it has no way of checking whether it is working for you or for someone else. That is why these bitcoin miners are detected as riskware.
RiskWare.CoinMiner can come from various sources ranging from installed by the users themselves, to dropped by a Trojan.
Aftermath
Extended use of crypto-miners can cause overheating of systems and high power usage, resulting in high costs to replace faulty systems and electicity bills.
Protection
Malwarebytes blocks RiskWare.CoinMiner
Home remediation
Malwarebytes can remove RiskWare.BitCoinMiner for you if you decide that you want to get rid of it.
- Pleasedownload Malwarebytesto your desktop.
- Double-clickMBSetup.exeand follow the prompts to install the program.
- When yourMalwarebytes for Windowsinstallation completes, the program opens to the Welcome to Malwarebytes screen.
- Click on theGet startedbutton.
- ClickScanto start aThreat Scan.
- ClickQuarantineto remove the found threats.
- Reboot the system if prompted to complete the removal process.
Add an exclusion
Should users wish to keep this program and exclude it from being detected in future scans, they can add the program to the exclusions list. Here’s how to do it.
- Open Malwarebytes for Windows.
- Click theDetection History
- Click theAllow List
- To add an item to theAllow List, clickAdd.
- Select the exclusion typeAllow a file or folderand use theSelect a folderbutton to select the main folder for the software that you wish to keep.
- Repeat this for any secondary files or folder(s) that belong to the software.
If you want to allow the program to connect to the Internet, for example to fetch updates, also add an exclusion of the typeAllow an application to connect to the internetand use theBrowsebutton to select the file you wish to grant access.
Business remediation
How to remove RiskWare.CoinMiner with the Malwarebytes Nebula console
You can use the Malwarebytes Anti-Malware Nebula console to scan endpoints.
Nebula endpoint tasks menu
Choose the Scan + Quarantine option. Afterwards you can check theDetections pageto see which threats were found.
On theQuarantine pageyou can see which threats were quarantined and restore them if necessary.
