Hello everyone I think I caught the BitcoinMiner virus. I don't want to be removed by antivirus. A moment after I delete infected files, the virus notification pops up again. Over and over again... Could the virus get into your computer through pop-up ads? I paste logs from OTL. Help.
Attachments:
Extras.Txt(93.27 KB)
You must be logged in to download this attachment.
OTL.Txt(93.58 KB)
You must be logged in to download this attachment.
I did as written by krzychupar. I don't know enough to tell if everything is alright, that's why I paste FRST files. Is everything ok now?
EDIT Kolobos: Antivirus detects infected files in: C: \ Users \ Garvi \ AppData \ Local \ Chromium \ User Data \ f_008d3. After each scan, the file (f_008d3) the antivirus displayed a different name for the infected file; they were names like: f_008d4, f_008d38 etc. In an alert he said that this file is in the archive (like zip) and cannot delete it. I found files with similar names in the Ceche folder, but the target file was not there. That's why I deleted the entire Ceche folder. But it gave nothing. Over and over - an infection notification popped up -> I deleted the entire Ceche folder. After some time the infection window popped up again, so I deleted Ceche. After some time, I guessed that the virus may be associated with pop-up ads on the alltuve.tv website or with the alltube.tv website itself ... After opening it on a second computer, the fun with Bitcoin file infection began. Now I have the same on the other device ... Returning to the subject - can I not worry about this topic here yet, is the virus still lurking somewhere?
I merged. RADU23
Attachments:
FRST.txt(65.36 KB)
You must be logged in to download this attachment.
Addition.txt(46.82 KB)
You must be logged in to download this attachment.
I ask because I wasn't sure. Thank you for your help. When I got infected with a second BitcoinMiner computer, I scanned it with anti-virus, but (as before on the previous device) it did not delete the files. I deleted them manually, but the browser is still mussels and consumes up to 99% of memory when used. I think the virus is still in the computer. I put files from FRST below, please check that everything is OK.
Attachments:
FRST_02.txt(26.95 KB)
You must be logged in to download this attachment.
Addition_02.txt(31.28 KB)
You must be logged in to download this attachment.
Zawsze mozesz tez usunac przegladarke razem z katalogiem profilu C:\Documents and Settings\misio\Local Settings\Application Data\Chromium\ i zainstalowac ponownie.
Wczesniej zrob kopie zakladek itp. o ile sa potrzebne.
Why did I write to you that the contents of the cache and entries from this browser can not be seen in the logs? What I've provided is just a few unnecessary entries, you don't have to post logs.
✨ The discussion revolves around a persistent BitcoinMiner virus infection that resists deletion by antivirus software. The user reports repeated notifications of the virus after attempting to delete infected files, particularly in the cache of the Chromium browser. Several participants suggest using the Farbar Recovery Scan Tool (FRST) instead of the OTL program for better log analysis. They recommend updating software like Adobe Reader and uninstalling unnecessary programs such as SpyBot. The conversation highlights the importance of clearing the browser cache and the potential for the virus to be linked to specific websites, particularly those displaying pop-up ads. Users share logs indicating the detection of the BitcoinMiner virus and discuss methods to ensure complete removal. Generated by the language model.
TL;DR: Antivirus logged 2 detections in Chromium cache; “Spyware detected: Application.BitCoinMiner.SX.” These miners run from sites, not as a resident virus. Clear cache, update software, or reset the browser profile using FRST-guided cleanup. [Elektroda, Kolobos, post #16718243]
Why it matters: This FAQ helps Windows users fix recurring BitcoinMiner alerts that reappear after deletion and slow the browser.
Is this a real infection or just a browser-based miner?
It’s a browser-based miner triggered by the site you visit. The files land in the browser cache and do not install a resident virus. The expert explains these “work only when they enter the site,” which is why antivirus flags cache items rather than system binaries. Close the site and clean the cache to stop activity. [Elektroda, Kolobos, post #16718222]
Why does my antivirus keep detecting BitcoinMiner in f_00xxx files?
Your antivirus is inspecting Chromium’s cache. It finds items like f_00006a and f_00006c that came from the webpage. These are artifacts, not installed programs. Deleting cache reduces repeat alerts unless you revisit the same site. One log shows two alerts on those cache objects. [Elektroda, Kolobos, post #16718243]
Can pop-up ads or a streaming site cause this?
Yes. Visiting certain streaming or pop-up-heavy sites can deliver in-browser mining scripts. The activity persists while the tab stays open and leaves cache traces. Closing the site and clearing the cache ends the mining session. [Elektroda, Kolobos, post #16718136]
How do I stop the constant reappearance after I delete files?
Stop visiting the offending site, then clear the Chromium cache. If alerts return, reset or reinstall the browser profile. Avoid using the same site again to prevent re-creation. The expert notes files reappear because you go back to the miner site. [Elektroda, Kolobos, post #16718136]
What quick steps should I follow to clean up?
Clear Chromium’s cache and close suspicious tabs.
Generate FRST (FRST.txt and Addition.txt) and apply the provided fixlist.
Uninstall outdated tools, then reset or reinstall the Chromium profile if needed.
These steps removed detections in the discussed case. [Elektroda, Kolobos, post #16718243]
What is FRST and why not OTL?
FRST (Farbar Recovery Scan Tool) creates modern diagnostic logs and applies a custom fixlist. OTL is outdated and not supported in this workflow. Helpers requested FRST logs and supplied a fixlist tailored to entries found. [Elektroda, krzychupar, post #16717420]
Why can’t the antivirus delete the file if it’s in an archive?
Some detections reside inside compressed cache objects, so the antivirus reports the item but cannot remove it directly. Clearing the browser cache or deleting the profile removes the underlying file. The user observed the alert stating it was in an archive. [Elektroda, rhimo, post #16717595]
My browser now uses 99% memory—am I still infected?
High memory or CPU during browsing often follows visiting miner-laced sites. If FRST cleanup is done and only cache items were flagged, the system is not persistently infected. Reset the browser profile to stop resource spikes from leftover extensions or settings. [Elektroda, rhimo, post #16718227]
What did the logs actually show?
Event logs showed two detections labeled Application.BitCoinMiner.SX in Chromium’s cache. The expert concluded antivirus likely removed what it could and advised software updates and profile cleanup. This indicates transient, site-driven artifacts, not a resident trojan. [Elektroda, Kolobos, post #16718243]
Should I remove Spybot and old Adobe Reader?
Yes. The helper advised uninstalling Spybot and replacing old Adobe Reader with a current reader. This reduces conflicts and closes security gaps before reinstalling or resetting the browser. [Elektroda, Kolobos, post #16718243]
How do I fully reset the Chromium profile safely?
Back up bookmarks first. Uninstall the browser, then delete the profile folder at the specified user path. Reinstall Chromium, restore bookmarks, and avoid the problem site. “Always remove the browser together with the profile directory,” the helper noted. [Elektroda, Kolobos, post #16718243]
What is ‘riskware’ in this context?
Riskware means software or scripts that may be used for unwanted actions like cryptomining. The alert labeled the detection as riskware and named Application.BitCoinMiner.SX. It’s unwanted but not a classic self-installing virus. [Elektroda, Kolobos, post #16718243]
Edge case: What if I still get alerts after cleanup without visiting bad sites?
Extensions or startup tabs can reopen the miner page. Remove suspicious extensions, then reset the profile. As a fallback, reinstall the browser and profile. If alerts name cache files again, they originate from browsing activity. [Elektroda, Kolobos, post #16718243]
Can I ignore the detections if they’re only in cache?
Do not ignore them. Clear the cache and stop visiting the source site. Apply the fixlist and security updates. The expert emphasized cache-based nature but still advised cleanup and software hygiene steps. [Elektroda, Kolobos, post #16718243]
