• 所有社区 - 中文
    • 所有社区 - 中文
    • 论坛
    • 创意
    • 博客
高级

不是您要找的? 咨询专家!

此论坛帖文需要解决方案。
好评0

Web Attack: JSCoinminer Download 22

For the first time ever today, I received numerous messages (incessant actually) from Notron saying it had blocked an attack from JSCoinminer 22.   Having read the Norton advice, it says to not use the site causing the problem but the message doesn't tell me the name of the rogue site(s).  

I've run a malware detection tool but nothing is showing up as a problem and I haven't used any sites that I don't use every day.  So how do I fix this annoying and, I must admit, somewhat worrying problem?   I know I can block the messages but that doesn't fix the issue.

Using Chrome on a Windows 10 PC.

btw, while I've been typing this message, Norton has "blocked an attack" 10 times !!!!!

回复

好评0

Re: Web Attack: JSCoinminer Download 22

btw, while I've been typing this message, Norton has "blocked an attack" 10 times !!!!!

Do you have any other browser tabs open while this is happening? If so, one of those sites would be a likely suspect. 

I haven't used any sites that I don't use every day.

The same site you visit one day will have different ads the next time you visit. These ads can be the source of the miner malware. 

I've run a malware detection tool but nothing is showing up as a problem

If you were scanning files on your system, that is why nothing is showing. This coinminer malware is only working while you are on the infected site. Nothing is actually downloaded to your system, or left behind when you close the browser.

Things happen. Export/Backup your Norton Password Manager data.
好评0

Re: Web Attack: JSCoinminer Download 22

The only site I was on was this one!  So it must have been something to do with Chrome or adblock.

I deleted as many Chrome extensions as I could do without, removed Adblock pro and installed ublock instead.  Problem has gone away but I have no idea where the source of the problem actually was. 

好评3 Stats

Re: Web Attack: JSCoinminer Download 22

There were two other fake ad blockers -- ripped off from legitimate ad-blocking code: a fake uBlock Plus with eight million users, and a fake Adblock Pro with two million users.

https://www.zdnet.com/article/google-cuts-fake-ad-blockers-from-chrome-store-were-you-among-20-million-fooled/

好评0

Re: Web Attack: JSCoinminer Download 22

Hello all,

I had exactly the same problem after updating the Vivaldi browser to v1.15.1147.36. It was nothing to do with extensions as I reverted very soon to the previous stable version - 1.14.1077.60 - with all the same extensions and since then I've had no notifications and there are no further entries about JSCoinminer Download 22 in Norton's Security History. As Vivaldi and Chrome both use the chromium engine I wonder if that's involved somehow.

Madeline

2 x Windows 7 Home Premium SP1 - 64bit, 1 x Windows 7 Home Premium SP1 - 32bit, NIS v22.7.0.76
好评0

Re: Web Attack: JSCoinminer Download 22

I have had the very same issue but I was using Mozilla Firefox. It's very annoying and intrusive how it keeps coming up saying that Norton has blocked the intrusion but it does not  give a clue as to how to SOLVE the problem by removing the stupid thing. I have found other sites that say they have a tool for download to remove it but I do not know if that is a safe download (https://greatis.com/blog/howto/remove-jscoinminer-forever.htm). Does anybody know?

好评2 Stats

Re: Web Attack: JSCoinminer Download 22

From Norton's blog on JSCoinminer here...

JScoinminer is a web-based detection for a JavaScript cryptocurrency miner that runs in web browsers. The JavaScript coin miner consumes enormous CPU resources, making computer very slow. The JavaScript is loaded in the browser when you visit a webpage hosting the JavaScript. The JavaScript runs as long as you stay on the webpage. As long as the website being visited is injected with the coin mining JavaScript, the website will be blocked by this signature. The computer system is not actually "infected" when this detection triggers.

So as you see there is no infection actually on your computer. The malicious code is resident on the web site, and is only executed while you are connected to that web site. Norton will block the code from running on your system, thus the entries in your history. 

The only way to stop this is to determine what web site you are getting this from, and either stop using it or contact the site owner and let them know the site has this issue. 

It is also possible that the JavaScript is located in ads on the affected page. Many web sites use an ad service, so they do not know exactly what ads may be on the site at a given time. An ad blocker extension for our browser can help with this kind of attack. But as bjm_ notes above there are some fake ad blockers out there. 

Things happen. Export/Backup your Norton Password Manager data.
好评0

Re: Web Attack: JSCoinminer Download 22

You say "The only way to stop this is to determine what web site you are getting this from, and either stop using it or contact the site owner and let them know the site has this issue. " as if it's easy.  I had the message cropping up when I was on this site and this site alone and also when I closed Chrome (yes, I know Chrome doesn't close completely).  If Norton cannot tell me which website is at fault, then I have no idea how I'm supposed to determine that.

However, as I said, I disabled a few Chrome Extensions and removed ADBlock pro (replacing it with Ublock) an the issue went away - looks suspiciously like a Chrome problem to me but I have no proof.  I'm just glad it's stopped!

好评0

Re: Web Attack: JSCoinminer Download 22

However, as I said, I disabled a few Chrome Extensions and removed ADBlock pro (replacing it with Ublock) an the issue went away

From bjm_'s post above....

There were two other fake ad blockers -- ripped off from legitimate ad-blocking code: a fake uBlock Plus with eight million users, and a fake Adblock Pro with two million users.

You seem to have had a bogus ad blocker installed. ADBlock Pro seems to have been a phony ad blocker with a name to mimic the legit ADBlock products, as noted in the link in bjm_'s post. If the UBlock you installed was not the Plus version, you now seem to have the genuine ad blocker. So now, as I noted, if the ads on a site you are visiting are that are feeding the JSCoinminer to your browser, the genuine UBlock seems to be blocking the attacks.

Things happen. Export/Backup your Norton Password Manager data.
好评0

Re: Web Attack: JSCoinminer Download 22

Since JSCoinminer Download 22 shows up for me only when I'm using Vivaldi 1.15.1147.36, I  think that's its appearance will happen under various circumstances. I use the same sites on other browsers and I use uBlock Origin (genuine and fully up to date) in all of my browsers. Although I reverted to v1.14.1077.60 of Vivaldi on this laptop, I've kept the later version on our other 2 PCs so that I can see when the problem disappears ~ hopefully. I don't find that JSCoinminer Download 22 " consumes enormous CPU resources, making computer very slow", I wouldn't have had any indication of its apparent existence if it hadn't been for Norton's constant notifications.

Madeline

2 x Windows 7 Home Premium SP1 - 64bit, 1 x Windows 7 Home Premium SP1 - 32bit, NIS v22.7.0.76

This thread is closed from further comment. Please visit the forum to start a new thread.