6

I have a weird problem since about a week. When I wake up my computer from suspend, a java process starts and consumes about 170 % CPU capacity.

I analyzed the java process a bit: it connects to static.icloud-ips.com.

Here's a screenshot of what I found out: http://imageshack.us/photo/my-images/688/javavirus.png/

To solve this problem I deleted all files in ~/.java/deployment/cache/ but however, it seems like the file was recreated.

Is this a virus?

How can I solve this problem?

I use Debian Wheezy x64 with Gnome 3.2

Marcel
  • 1,114
  • 1
  • 14
  • 28

2 Answers2

7

BitcoinPlus is a web-based Bitcoin mining application written in Java. It uses your CPU to perform intensive calculations in an attempt to solve difficult math problems - this is part of the Bitcoin creation and security process. I've not heard of any *nix trojans or virii for Bitcoin generation (the only one I'm aware of is, ironically, MacOSX exclusive) but I have seen this site exploited to generate Bitcoins on public-access systems.

It would be possible for a simple class of existing virii/trojans to launch this process hidden from view, so you may be dealing with a novel use for an old concept.

You might try contacting BitcoinPlus to determine which user your communications are mapped to and perhaps determine the source of the problem - or at the very least get the exploiter's account locked/seized.

If you need further Bitcoin-specific information or resources you could also ask at the Bitcoin StackExchange currently in public beta. Perhaps someone there knows something I don't.

David Perry
  • 186
  • 3
  • 1
    thank you! seems like I found it out: I had this page open in my browser for reading it later: http://apathyonline.net/archives/420 seems like they "hijack" visitors computers for bitcoin mining. – Marcel Jan 26 '12 at 22:03
  • 1
    but I have to admit, they do it quite open. they even have a start/stop-button. However, I just had this page open in background at didn't know where the processor load came from... Thank you for your help! – Marcel Jan 26 '12 at 22:16
  • 1
    Not a problem. I'd almost forgotten about 3rd party sites that use java/javascript miners. A lot of folks see it as a viable alternative to ad revenue, which it definitely can be, but it's also annoying to users who don't necessarily recognize what you're doing with their CPU cycles ;) – David Perry Jan 26 '12 at 22:59
  • To me this is new. It's actually a good idea. But it would be better if they would find a way to notify the user more offensive... and if it was possible to limit the CPU load 190 % is quite a lot on a notebook. – Marcel Jan 26 '12 at 23:22
  • 1
    I can't speak for *nix but I know in the Windows world it's customary to run such processes with the lowest possible priority, thus minimizing the effect on the system. It might be worth contacting the site admin at BitcoinPlus to inform him that his Java is running hot on certain platforms. – David Perry Jan 27 '12 at 00:23
1

Are you generating bitcoin(s)?

$ host bitcoinplus.com
bitcoinplus.com has address 184.106.146.244
Tim Kennedy
  • 19,369
  • 4
  • 38
  • 58