Avast WEBforum

Consumer Products => Avast Mac Security => Topic started by: REDACTED on September 26, 2018, 05:05:31 AM

Title: Need Help, JS: Miner - AA
Post by: REDACTED on September 26, 2018, 05:05:31 AM
Hello, I've been searching the internet all day trying to solve this problem with no success. I'm hoping to get some help here.

Just a heads up I am running Mac OS Sierra 10.12.6. And off that bat that has caused problems with me getting reports ran with the instructions that I found at the top of the forum. Malware Bytes won't let me export a log and I cannot run Farbar.
But I will do my best to give you all the info I can.

Recently I have started receiving an alert from my web shield letting me know that it has blocked an infection called JS:Miner-AA[trj]. This alert only pops up when I open Safari. When I open Firefox I don't get it.
I have ran a scan with Avast and Malware bytes and neither one picks up the Trojan. I have also tried resetting safari with Clean My mack and deleted all extensions. Nothing has worked.

Below is the popup I get and seems to be the only thing I can get with any detail.
 
(http://i349.photobucket.com/albums/q392/bunkerhill157/Screen%20Shot%202018-09-25%20at%203.13.24%20PM_zpsqj5vcid8.png)

Thank you for any help!
Title: Re: Need Help, JS: Miner - AA
Post by: REDACTED on September 30, 2018, 07:27:50 PM
I am having a very similar issue and it is driving me mental, to the point I hd to de-activate EVERY SINGLE Avast popup

What blew my mind is that Avast alerts me ONLY when I connect through my Home wifi - Not my office, not when I use the phone as Hotspot

I also tried to delete Avast, and when I did that I could hear the Fan going mad, as if the miner was actually mining. Then re-installed Avast and back to normal

It happens across browsers.

Attached just some of the screenshots.

HELP!!!
Title: Re: Need Help, JS: Miner - AA
Post by: ondrej.kolacek on October 01, 2018, 01:45:47 PM
Hello,
browsers love to remember various web pages they have visited and automatically load these when opened/connect to internet. They do this to have various pages ready when you visit them. Which is an issue if you have visited an infected page, as they reload it again and again.
Usually this is fixed if you flush the whole browsing history of the browser.
Kind regards,
Ondrej Kolacek