• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

crypto mining using Wineth

I have two systems on my home network that are running Wineth (Crypto mining software).  I have other machines on the same home network and they keep getting a Security popup and as me to reboot to remove problem.  I think the problem is Norton Security Software detects all the outbound internet activity created by the cryto miners and throws the exception.  Short of uninstalling Norton on all my computers on the home network, how do I turn off this exception, it has become very annoying.

Replies

Kudos0

Re: crypto mining using Wineth

Ken you should submit the program here and have Norton review it for a false positive. You can also follow these instructions to change your firewall / detection settings.

Cheers

"From DOS to Windows10 what a journey it has been" / MS Certified Professional / Windows 10 Home / Professional x 64 version 1903 / build 18362.239 / N360 Deluxe 22.17.3.50 / Norton Core v.282 on Android 2.00
Kudos0

Re: crypto mining using Wineth

Thanks for the reply but...it ain't that easy to fix.  As I said above, the computer throwing the error popup does not have the mining program installed but tends to run for emails, google, skype, etc., etc. most of the day.  I read somewhere in a thread that the Norton Security Suite has something built into it to detect unusual outgoing activity on a network.  Meaning they are trying to detect a mining program that that has been inserted into a computer on the network and is unknown and unwanted by the user.  That's great but the only way I can make the Norton Security Alert/Reboot popup go away is to uninstall the Norton Suite!  I did that on the machines that are running Wineth 24/7.   Windows 10 Defender Firewall tolerates the mining activity.

Kudos0

Re: crypto mining using Wineth

Ken I read your original post in its entirety. The two suggestions I gave are standard when Norton falsely detects an issue on a single device OR within a network. In your Norton product there is a setting for excluding a program from scans. Click "configure" where you see the statement "Items to Exclude from Auto-Protect, SONAR, and Download Intelligence Detection". Add the program and its folders to the exclusion list, do this on all your machines. If the issue persists submission of the file(s)/program for review is the only answer which will get the results needed.

Cheers

"From DOS to Windows10 what a journey it has been" / MS Certified Professional / Windows 10 Home / Professional x 64 version 1903 / build 18362.239 / N360 Deluxe 22.17.3.50 / Norton Core v.282 on Android 2.00
Kudos1 Stats

Re: crypto mining using Wineth

I read somewhere in a thread that the Norton Security Suite has something built into it to detect unusual outgoing activity on a network.  

That kind of activity monitoring is just for the computer that you are using at that time. It does not sniff all traffic on your local network to see what other devices are sending/receiving.

You need to check the Norton History on the machines asking for restart to see what is being detected.

Things happen. Export/Backup your Norton Password Manager data.
Kudos0

Re: crypto mining using Wineth

Just goes to show - don't believe everything you read on the internet!  For some unknown reason after several days of the Restart Windows Popups Norton said it found and eliminated a problem without having to restart Windows.  Like magic the restart popups have gone away.  I don't know why it took several days to for Norton to fix the issue but it could have been triggered by the fact that I was turning options on and off trying to find a solution to the mining problem that did not exist on this machine.  

The error shown in the History File says "PUA.Couponviewer detected by Virus Scanner - Restart Required".

Kudos0

Re: crypto mining using Wineth

I got caught up in two separate problems that occurred with Norton Security Suite at about the same time.  I was playing with a mining program on one machine which triggered the outbound internet activity response that caused Norton to shut down the mining program and apparently my wife was visiting a site on another machine that installed the PUA.Couponviewer "virus".  Hopefully, if and when it occurs again I'll try to figure out who is the bad guy.

Thanks for the help!

Kudos0

Re: crypto mining using Wineth

Thanks for posting back on this. It is easy to get focused on one item when there are multiple issues that crop up around the same time.

Things happen. Export/Backup your Norton Password Manager data.
Kudos0

Re: crypto mining using Wineth

Spoke too soon.  The  PUA.CouponViewer virus came back.  I ran several other virus scanners in addition to Norton Security Suite and non of them found ANY virus on the system.  I also ran the Microsoft msert.exe program and it came up empty like all the others.  So...at least for now I've taken the easy way out and uninstalled the Norton Security Suite supplied by Comcast for their customers - me being one of them.  I'll rely on Windows Defender for now.  Is there a recommended standalone virus scanner that will detect and eliminate this elusive virus?  Other than the daily Norton popup telling me to restart the system to eliminate the threat I do not detect anything unusual going on with the system?!

Kudos0

Re: crypto mining using Wineth

Ken use this article and remove the registry keys for this PUA or have someone with the tech knowledge to assist.

https://us.norton.com/online-threats/pua.couponviewer-2018-041814-3548-99-writeup.html

Cheers

"From DOS to Windows10 what a journey it has been" / MS Certified Professional / Windows 10 Home / Professional x 64 version 1903 / build 18362.239 / N360 Deluxe 22.17.3.50 / Norton Core v.282 on Android 2.00
Kudos0

Re: crypto mining using Wineth

If you have not already, I would suggest a second opinion scan using the FREE version of Malwarebytes. You can find it here http://www.malwarebytes.org/products/malwarebytes_free/

Be sure you do not accept the offer of the free trial of the Premium version.

MBAM focuses more on PUA/PUP's than Norton. While they are annoying, they do not cause damage to your system. Some people actually want the 'Features' offered by these programs. They are usually downloaded alongside a legitimate download when you do not uncheck the option for the additional download.

Norton products concentrate on malware that can damage your system, that is why some PUPs are not detected.

Things happen. Export/Backup your Norton Password Manager data.
Kudos0

Re: crypto mining using Wineth

Ok folks, I installed and ran the Malwarebytes free program and it found and fixed ~60 occurrences of PUP.Optional.MindSpark.Generic, 1 occurrence of PUP.Optional.TotalAV, 4 occurrences of PUP.Optional. Trovi, 2 occurrences of PUP.Optional.Ask and 1 occurrence of PUP.Optional.Conduit.  I should have tried Malwarebytes free before now since I have the old paid forever license version running on my home server!

I then ran the Norton NEP.com program and it found nothing.  The Norton Security Suite popup of the PUA detection remains a mystery.

Kudos0

Re: crypto mining using Wineth

The Norton Security Suite popup of the PUA detection remains a mystery.

If you are referring to the original Couponviewer being detected, as I noted above about Norton not detecting some PUA.s, it is not saying Norton never detects them. It is just that Norton has some algorithm for which PUA/PUPs it feels are more intrusive than others. If a PUA crosses that line, it will flag and quarantine it. 

From all the detections MBAM made, it sounds like the users in your home need to be reminded to check all options when downloading and installing software to ensure they do not accept any tag along junk.

Things happen. Export/Backup your Norton Password Manager data.

This thread is closed from further comment. Please visit the forum to start a new thread.