js:cryptonight miner-a blocked but nothing found in scans

Viruses and worms
1

Hello

I’m looking for some help, today I’ve have alerts from my Avast Antivirus blocking “js:cryptonight miner-a”. It seems to be on loading sites, but doesn’t appear to have any pattern, on any site, I’ve been browsing quite normal and what I imagine are safe sites today job hunting!

I’ve run the Avast Scan a couple of times when the error has appeared but they haven’t found anything. I did a search of the forum and found the recommendations here https://forum.avast.com/index.php?topic=194892.0 which I have followed; installed both programs and ran the scans both of which seemed to not find anything either from what I can tell…

So as instructed I have collected the three different reports and attached them to this post.

If anyone is able to help me or give me some advice for resolving this problem I would be very grateful for your time.

Thanks

Andy

2

Receiving the same warnings again today, here is the screenshot of the message…

3

Here is my notification list to give an idea of how much it is occurring…

4

Hi andrew_bunce,
it is a script shield detection . For more info see https://forum.avast.com/index.php?topic=221801.msg1476160#msg1476160.
If you see detection dialog during every page load (www.google.com should be clean) your browser might be infected. Usually malware inserts miner script into browsers internal script.

5

Hello

Thank you very much for your reply and taking the time, I really appreciate it.

That seems to make sense for what I’m experiencing, it’s not every single page maybe 50%… What could/should I do in this case? From running Malwarebytes it doesn’t come up with any results… Should I uninstall and reinstall my browser? Will that make a difference?

Thanks again,

Andrew

EDIT: just updated to Chrome Version 69.0.3497.92 (Official Build) (64-bit)

6

Hi andrew_bunce,
yes reinstall may resolve it but first I would try to use firefox. Script shield works also with firefox so if you will not see detection dialog in firefox but just in chrome on the same url → chrome has to be compromised by miner and it has to be reinstalled.

7

Thank you very much for your help. I will try those.

Andrew

8

Type in address bar (or just copy paste)

about:serviceworkers

And Unregister/delete every listed service worker.

9

Thank you, have done, I haven’t received any messages so far today so let’s see if it’s been resolved…

Thanks again!

10

I since haven’t had any more issues.

I updated Chrome to the latest version - Version 69.0.3497.92 (Official Build) (64-bit) - the same time as my #4 reply (September 12, 2018, 08:08:03 PM) and without any expert knowledge I believe this maybe might’ve helped solve the issue.

The same warning also appeared on my wife’s computer at the weekend so I updated Chrome and I believe this has solved this issue as well.