Bitcoin Miner/TVF/Bitdefender/Attack?

[simoh1490]

Yesterday my desktop was logged on to TVF, nothing else was running - I use TOT fibre.

 

Bitdefender Internet Security flashes a message to say it's blocked a malicious website which it shows as https://api.aalbbh84.info/lib/main.js (which looks very much like an api).

 

Over the next ten minutes I get the same message several times so I come out of TVF and the messages stop. I scan for virus and malware, clean temporary files and reboot, after an hour nothing unusual has happened. I start up TVF again and after 45 minutes the attacks start again, they appear to be a bitcoin data miner!

 

Anyone, TVF is this your api that shows a false positive or something else entirely?

[simoh1490]

Twenty-one minutes after posting it seems that TVF has started doing it again, here's the message from Bitdefender: "This webpage https://api.aalbbh84.info/lib/main.js is identified as infected with malware. Virus name: Trojan.CoinMiner.I. The webpage has been successfully blocked by Antimalware filter and your PC is now safe".

 

Whatever are you doing?

[simoh1490]

I just checked, my wife's laptop is delivering the same message andI'm now getting them from the only site that is running, TVF, about every six minutes or so.

[Peterw42]

Its a virus/redirect trying to get to, download from that website, Try connecting to other sites and see if the same message, use a different browser etc. If its coming from Thaivisa site the reports would say thaivisa.com etc.  Who is on the domain shows it as being in russia, registered 2 weeks ago.

Task manager to see if anything using resources in the background, look for weird additions to startups in msconfig etc.

Is the other computer also running bitdefender ?

 

Edited February 14, 2018 by Peterw42

[simoh1490]

1 minute ago, Peterw42 said:

Its a virus trying to get to, download from that website, Try connecting to other sites and see if the same message, use a different browser etc. If its coming from Thaivisa site the reports would say thaivisa.com etc.  Who is on the domain shows it as being in russia, registered 2 weeks ago.

Task manager to see if anything using resources in the background, look for weird additions to startups in msconfig etc.

Is the other computer also running bitdefender ?

No problem with any other sites both in country and internationally.

 

Same results using Chrome or Firefox.

 

Laptop is also using same version of (paid for) Bitdefender.

 

Task Manager/resource utilisation looks normal.

 

Am looking at startups etc currently.

 

 

[Peterw42]

Maybe malwarebytes, hitman pro etc. My way of thinking, bitdefender is letting a process run so it thinks its ok, but blocking what the process is trying to do.

[simoh1490]

7 minutes ago, Peterw42 said:

Maybe malwarebytes, hitman pro etc. My way of thinking, bitdefender is letting a process run so it thinks its ok, but blocking what the process is trying to do.

MSCONFIG and startup look fine, Zonealarm logs are clean, not running Admin. account.....perhaps it's gods way of telling me I'm spending too much time on TVF. 

 

Thanks for your input, appreciated.

[Peterw42]

Go to the root of that site and it says its a javascript miner, so need to get to the bottom of who is dishing it up. Possibly only pops up on sites with Java etc, not somuch the Thaivisa site, rather than something TV sends is triggering it.

 

api.aalbbh84.info

[simoh1490]

6 minutes ago, Peterw42 said:

Go to the root of that site and it says its a javascript miner, so need to get to the bottom of who is dishing it up. Possibly only pops up on sites with Java etc, not somuch the Thaivisa site, rather than something TV sends is triggering it.

 

api.aalbbh84.info

Now that's interesting, it seems CoinHave is the name to look for, I wonder who. I think I'll try disabling Java and see what that does.

[Peterw42]

6 minutes ago, simoh1490 said:

Now that's interesting, it seems CoinHave is the name to look for, I wonder who. I think I'll try disabling Java and see what that does.

It even gives a sample of the code to add to a website, <script src="SITE_LINK"></script>, if you can find whats adding that code. So thaivisa site loads then something puts that script in and it trys to load etc but bitdefendr blocks etc.

 

The thing that throws me is 2 computers doing it, anything thats recent and common across both, a browser extension etc.

[simoh1490]

No, nothing, the laptop hasn't been used in over a month!

 

I just switched to Explorer to see what happens plus I turned off Java.

Edited February 14, 2018 by simoh1490

[Peterw42]

2 minutes ago, simoh1490 said:

No, nothing, the laptop hasn't been used in over a month!

 

I just switched to Explorer to see what happens plus I turned off Java.

And ?????, dont leave me hanging, lol

 

[simoh1490]

13 minutes ago, Peterw42 said:

And ?????, dont leave me hanging, lol

 

Nature called :)

 

No more Bitdefender messages so I'm now switching back to see what happens next.