JS: Cryptonight [Trj] Found

[Philip4k]

Hello! I did a virus search this morning and Avast showed me the same "virus" that you've been having trouble with. It was in the "private/var/db/uuidtext" folder so from what you're saying it's not a virus? Should I just ignore it and wait for Avast to come up with a update or what's going on? And should I put the file that it detected to The "quarantine/chest" or delete it? Best regards, Philip

"edit". I deleted the virus file "/private/var/db/uuidtext/7B/BC8EE8D09234D99DD8B85A99E46C64 JS: Cryptonight [Trj]", and did a new search and nothing showed, maybe it's all good then?

[drake145]

Philip4k,

Yes, this is a false positive. The VPS update yesterday should have resolved the issue, but it still persists for me. From Jiri's (Avast Team) posts, it appears that the VPS update is more to mitigate future events like this from happening, as the current issues seems rather difficult to fix.

I have not tried purging the logs yet as has been suggested, as another user has reported that the detection came back somewhere else.

I believe if you restart your mac, it will appear again, as the file re-generates (for the reason, see the superuser post: https://superuser.com/questions/1271760/avast-on-macos-high-sierra-claims-it-has-caught-the-windows-only-cryptonight-v).

[Philip4k]

Ah I see @Drake145! Thanks for the Reply! Glad that it's not anything dangerous! Now I can stop worrying about this and focus on my work !

I will restart my Mac later and then run a virus scan and see if anything pops up!

[REDACTED]

This whole problem seems to be cosmetic without functional ramifications .  What is wrong with uninstalling avast and using a different product leaving behind some remnants in the log file ? Or maybe I’m missing something.

[REDACTED]

Hi,

Thought I just let you know that Avast scan does not find anymore the "fake virus" on my mac. As I wrote earlier: I updated Avast, purged logs with OnyX and run Malwarebytes. Then I restarted the computer, and at first, the fake virus was found again. Then later the day, when I restarted the computer again and run Avast scan, the fake virus was gone. So, maybe Avast took some time to update or something, but now everything seems good and clean.

[drake145]

Hi,

Thought I just let you know that Avast scan does not find anymore the "fake virus" on my mac. As I wrote earlier: I updated Avast, purged logs with OnyX and run Malwarebytes. Then I restarted the computer, and at first, the fake virus was found again. Then later the day, when I restarted the computer again and run Avast scan, the fake virus was gone. So, maybe Avast took some time to update or something, but now everything seems good and clean.

After reading the above, I quarantined the file, deleted it, re-started, and, curiously, the log did not regenerate.

[drake145]

This whole problem seems to be cosmetic without functional ramifications .  What is wrong with uninstalling avast and using a different product leaving behind some remnants in the log file ? Or maybe I’m missing something.

Yes, this issue may not have any functional ramifications, but a false positive may cause unneeded stress, and if someone does not come to the forums first to see if others are having the same issue, they may end up spending time, and monetary resources, going to a computer technician in order to troubleshoot a non-consequential issue.

Also, false positives are not exclusive to Avast. If you look at the virustotal link (https://www.virustotal.com/#/file/4b263d8b55c3478f4e9d9d1af37ee277d59200cf5b6eb22ecd343eef25b0627b/detection) that I  posted, you will see that, as of this post, 4 other AVs flag this file. When I originally submitted the file, it was only 2.

[Jiří Šembera]

Hello viristim,

your problem seems to be caused by MacOS' MobileBackup tool. It looks like it has picked up the detected file and keeps restoring it. This might help: https://discussions.apple.com/thread/7333209?start=0&tstart=0

Jiri

[gbp_bnc]

I have the issue on my windows7 PC. The URL aborted keeps changing Avast says:

JS: cryptonight [Trj]

URL: http://94.130.97.189/m/g367thgwe29fhe4r/build.js
(The next time was 94.130.98.207)

Process: C;\Program Files (x86)\Google\Chrome\Application\chrome.exe

Detected by: Web shield

Status: Connection aborted

[drake145]

I have the issue on my windows7 PC. The URL aborted keeps changing Avast says:

JS: cryptonight [Trj]

URL: http://94.130.97.189/m/g367thgwe29fhe4r/build.js
(The next time was 94.130.98.207)

Process: C;\Program Files (x86)\Google\Chrome\Application\chrome.exe

Detected by: Web shield

Status: Connection aborted

I think this may need to be posted on the Windows forum, as this looks like something different than what is being discussed in this post.

[Jiří Šembera]

I have the issue on my windows7 PC. The URL aborted keeps changing Avast says:

JS: cryptonight [Trj]

URL: http://94.130.97.189/m/g367thgwe29fhe4r/build.js
(The next time was 94.130.98.207)

Process: C;\Program Files (x86)\Google\Chrome\Application\chrome.exe

Detected by: Web shield

Status: Connection aborted

Hello gbp_bnc,

in this case it is a legitimate blocking of malicious crypto miner which uses your computer to mine crypto currencies using your computer. It results in lower computer performance, shorter battery life and higher electricity bills.

Jiri

[gbp_bnc]

Thank you. It was in one of the Chrome extensions.