RiskWare.CoinMiner

Short bio

RiskWare.CoinMiner is Malwarebytes’ generic detection name for crypto-currency miners that may be active on a system without user consent.

Symptoms

Users may notice a very slow computer as most of the CPU cycles will be used up by the miner. They may alos notice side-effects like high temperatures and noisy systems.

Type and source of infection

Riskware, in general, is a detection for items that are not strictly malicious, but pose some sort of risk for the user in another way.

Crypto-currency miners use a lot of resources to optimize the earning of the virtual currency. For this reason, threat actors try to use other people’s machines to do the mining for them. This detection warns you that a bitcoin miner is active on your system, but it has no way of checking whether it is working for you or for someone else. That is why these bitcoin miners are detected as riskware.

RiskWare.CoinMiner can come from various sources ranging from installed by the users themselves, to dropped by a Trojan.

Aftermath

Extended use of crypto-miners can cause overheating of systems and high power usage, resulting in high costs to replace faulty systems and electicity bills.

Protection

Malwarebytes blocks RiskWare.CoinMiner

Home remediation

Malwarebytes can remove RiskWare.BitCoinMiner for you if you decide that you want to get rid of it.

Please download Malwarebytes to your desktop.
Double-click MBSetup.exe and follow the prompts to install the program.
When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
Click on the Get started button.
Click Scan to start a Threat Scan.
Click Quarantine to remove the found threats.
Reboot the system if prompted to complete the removal process.

Add an exclusion

Should users wish to keep this program and exclude it from being detected in future scans, they can add the program to the exclusions list. Here’s how to do it.

Open Malwarebytes for Windows.
Click the Detection History
Click the Allow List
To add an item to the Allow List, click Add.
Select the exclusion type Allow a file or folder and use the Select a folder button to select the main folder for the software that you wish to keep.
Repeat this for any secondary files or folder(s) that belong to the software.

If you want to allow the program to connect to the Internet, for example to fetch updates, also add an exclusion of the type Allow an application to connect to the internet and use the Browse button to select the file you wish to grant access.

Business remediation

How to remove RiskWare.CoinMiner with the Malwarebytes Nebula console

You can use the Malwarebytes Anti-Malware Nebula console to scan endpoints.

Nebula endpoint tasks menu

Choose the Scan + Quarantine option. Afterwards you can check the Detections page to see which threats were found.

On the Quarantine page you can see which threats were quarantined and restore them if necessary.