Re: [PLUG] Mining for Cycles (Pavel Kovtunenko)

Is this machine a desktop or a server? I googled this and found very good information on _javascript_ cryptomining with common cms software:

https://www.getastra.com/blog/911/remove-crypto-mining-malware-cms-wordpress-magento-drupal/

If it's a desktop you may have been infected by browsing a site like this. I recommend if you use firefox to use noscript. This blocks all _javascript_ other than what you explicitly allow.

Thanks,

Michael

On Wed, Jan 23, 2019 at 9:27 AM jeff <jeffv@op.net> wrote:

On 1/23/19 12:10 AM, Pavel Kovtunenko wrote:
> ------------------------------
> ------------------------------
>
> Jeff,
> How could a _javascript_ get that deep into a system?
> Do you mind sharing what web browser you use?

The articles I read said they get in through the browser and use known
exploits in the OS to implant.

There are a few browsers. FF is main, but different ones for different
sites. They're all _javascript_ off by default. Apparently I turned it on
for the wrong site. Obviously no idea which browser or site. The issue
got into my profile, so when I hooked it back in, it reactivated. It was
not picked up by any local scanners and only by Virustotal when the
process substituted its versions for the originals, then put them back.
There is no activity now. New OS, new profile, some text files moved
over. I'm tin foil squad, so this is weird.

Wish I had better answers for all of us.
I picked a bad week to stop visiting adult hamster sites.
___________________________________________________________________________
Philadelphia Linux Users Group -- http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug

___________________________________________________________________________ Philadelphia Linux Users Group -- http://www.phillylinux.org Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug