Need Help: Bitdefender reporting Bitminer being stopped - part of plexscripthost.exe

General Discussions
1

Hi all, I’m getting a new issue with my media PC where bitdefender is reporter a bitminer being stopped, apparently somehow the plexscripthost.exe is trying to access websites that are bitminers. One of them is below, another is similar except the website is: http://xpau.se/

Anyone have any advise how to deal with this?

Infected web resource detected
6 minutes ago

Feature:
Web Protection

The application plexscripthost.exe accesses a web resource http://www.primewire.ag/ that has been detected as infected. Virus name: Application.CoinMiner.AY. The web resource has been successfully blocked and your PC is now safe.

2

Disable and remove 3rd party Plex plugins (formerly known as ‘channels’)

The re-add them one by one until Bitdefender is complaining again.
You have now identified the culprit. Cease using it.

3

Sounds like a solid plan. Hey Otto, where are the plugins installed via folders I mean?

4

https://support.plex.tv/articles/201106098-how-do-i-find-the-plug-ins-folder/

5

And please report back when you find it! Thanks!

6

Got it! I believe it was the subzero subtitle plugin. All good now, thanks!

7

@maseren are you 100% sure it was Sub-Zero? I’ve never heard of this. Sounds like a false-positive, but I’d like to verify first before investigating further.

Edit: Did/do you perhaps have ArconaiTV or PrimeWire installed using the UAS?