Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a weird problem since about a week. When I wake up my computer from suspend, a java process starts and consumes about 170 % CPU capacity.

I analyzed the java process a bit: it connects to static.icloud-ips.com.

Here's a screenshot of what I found out: http://imageshack.us/photo/my-images/688/javavirus.png/

To solve this problem I deleted all files in ~/.java/deployment/cache/ but however, it seems like the file was recreated.

Is this a virus?

How can I solve this problem?

I use Debian Wheezy x64 with Gnome 3.2

share|improve this question
1  
Run ps fxawww and see who started that process. –  angus Jan 25 '12 at 23:18
add comment

2 Answers

up vote 7 down vote accepted

BitcoinPlus is a web-based Bitcoin mining application written in Java. It uses your CPU to perform intensive calculations in an attempt to solve difficult math problems - this is part of the Bitcoin creation and security process. I've not heard of any *nix trojans or virii for Bitcoin generation (the only one I'm aware of is, ironically, MacOSX exclusive) but I have seen this site exploited to generate Bitcoins on public-access systems.

It would be possible for a simple class of existing virii/trojans to launch this process hidden from view, so you may be dealing with a novel use for an old concept.

You might try contacting BitcoinPlus to determine which user your communications are mapped to and perhaps determine the source of the problem - or at the very least get the exploiter's account locked/seized.

If you need further Bitcoin-specific information or resources you could also ask at the Bitcoin StackExchange currently in public beta. Perhaps someone there knows something I don't.

share|improve this answer
1  
thank you! seems like I found it out: I had this page open in my browser for reading it later: apathyonline.net/archives/420 seems like they "hijack" visitors computers for bitcoin mining. –  Marcel Jan 26 '12 at 22:03
1  
but I have to admit, they do it quite open. they even have a start/stop-button. However, I just had this page open in background at didn't know where the processor load came from... Thank you for your help! –  Marcel Jan 26 '12 at 22:16
1  
Not a problem. I'd almost forgotten about 3rd party sites that use java/javascript miners. A lot of folks see it as a viable alternative to ad revenue, which it definitely can be, but it's also annoying to users who don't necessarily recognize what you're doing with their CPU cycles ;) –  David Perry Jan 26 '12 at 22:59
    
To me this is new. It's actually a good idea. But it would be better if they would find a way to notify the user more offensive... and if it was possible to limit the CPU load 190 % is quite a lot on a notebook. –  Marcel Jan 26 '12 at 23:22
1  
I can't speak for *nix but I know in the Windows world it's customary to run such processes with the lowest possible priority, thus minimizing the effect on the system. It might be worth contacting the site admin at BitcoinPlus to inform him that his Java is running hot on certain platforms. –  David Perry Jan 27 '12 at 0:23
add comment

Are you generating bitcoin(s)?

$ host bitcoinplus.com
bitcoinplus.com has address 184.106.146.244
share|improve this answer
    
actually - no. At least not intentionally –  Marcel Jan 26 '12 at 21:57
1  
thank you! seems like I found it out: I had this page open in my browser for reading it later: apathyonline.net/archives/420 seems like they "hijack" visitors computers for bitcoin mining. –  Marcel Jan 26 '12 at 22:05
    
wow. interesting find. thanks for following up. –  Tim Kennedy Jan 27 '12 at 18:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.