git / moonbite-network / release/miner/ANTIVIRUS.md · raw

# Antivirus warnings and the MoonBite minerSome antivirus products flag CPU miners, including this one, as"PUA" (potentially unwanted application), "CoinMiner", "RiskWare" or similar.This file explains why that happens, how to check that what you downloaded isthe genuine release, and how to report a false positive. It does not ask youto turn anything off.## Why a legitimate miner trips heuristicsAntivirus engines rarely have a signature for a specific small project. Theyrely on behavioural heuristics, and a proof-of-work miner looks exactly likethe thing those heuristics were written to catch:- **RandomX JIT.** RandomX, the proof-of-work MoonBite uses, generates random  programs and compiles them to machine code at run time. Allocating memory  that is both writable and executable is a classic malware trait, and the  node does it on purpose, continuously, while mining.- **Large memory footprint.** RandomX reserves roughly 2-3 GB of RAM for its  dataset. Ordinary desktop software does not.- **Long-running, CPU-saturating process.** The node uses every core for as  long as you let it run. Cryptojacking malware behaves the same way, so  "sustained high CPU from an unknown binary" scores badly.- **Unknown publisher.** The binaries are not yet Authenticode-signed with a  verified-identity certificate, so Windows SmartScreen and reputation-based  engines have nothing positive to weigh against the heuristics.- **Unpopular file.** Reputation systems count how many machines have seen a  file. A new release of a small coin has, by definition, been seen by very  few.- **`-ExecutionPolicy Bypass` in the launcher.** `Mine-MoonBite.bat` starts  `mine.ps1` with this flag so it runs on PCs that block all PowerShell  scripts. Malicious batch files use the same flag, so some engines score it.  Here it applies only to that one run of the script next to it and changes no  setting on your PC.What the miner deliberately does NOT do, because those behaviours are whatturns a warning into a real detection and because they would be wrong anyway:- It never installs itself, adds a startup entry, scheduled task or service.  It runs only while the window you opened stays open.- It never downloads or executes anything. There is no updater.- It never asks for administrator rights and never changes Windows Defender or  any other security setting.- It is not packed or obfuscated (no UPX, no self-extracting stub).- It does not touch your keys. The miner needs only a receiving address.If a copy of this miner you obtained does any of the above, it is not ours.## Verify the download before trusting itChecksums and signatures are what tell a genuine release from a tamperedone; an antivirus verdict (clean or flagged) does not.1. **SHA-256.** Compare the archive and each `.exe` against the   `SHA256SUMS.txt` published with the release on   https://moonbite.org/mine   (the miner scripts print the hash of `moonbited.exe` every time they start):       Get-FileHash .\moonbite-miner-windows-x86_64.zip -Algorithm SHA256       Get-FileHash .\moonbited.exe -Algorithm SHA256       Get-FileHash .\moonbite-cli.exe -Algorithm SHA256   On Linux or macOS: `sha256sum -c SHA256SUMS.txt`.2. **minisign signature** over the manifest, when `SHA256SUMS.txt.minisig` is   published. The public key is `deploy/moonbite-release.pub` in the repository:       minisign -Vm SHA256SUMS.txt -p moonbite-release.pub3. **Build provenance.** Archives built by the project's GitHub Actions   release workflow carry a Sigstore attestation that ties the file to the   exact source commit and workflow run:       gh attestation verify moonbite-miner-windows-x86_64.zip --owner moonbitecoinIf any of these checks fails, do not run the files. Delete them and downloadagain from the release page.## If your antivirus quarantines the minerYou have two reasonable choices:- Do not run it. Mining is optional and nothing else in MoonBite depends on  it. The wallet is a separate download and is unaffected.- Restore the file and add an exclusion for the folder you unzipped into,  *only after* the checksum and signature checks above pass. This is your  decision to make in your antivirus product's own interface. The miner will  never do it for you, and no MoonBite script or page will ever ask you to run  a command that changes your security settings.## Reporting a false positiveEvery release is submitted to the major vendors' false-positive portals by theproject. If your product still flags a file whose checksum matches thepublished manifest, you can help by submitting it yourself; vendors weightindependent reports.- Microsoft Defender: https://www.microsoft.com/en-us/wdsi/filesubmission- Avast / AVG: https://www.avast.com/false-positive-file-form.php- Bitdefender: https://www.bitdefender.com/consumer/support/answer/29358/- ESET: https://support.eset.com/en/kb141- Kaspersky: https://opentip.kaspersky.com/- Malwarebytes: https://forums.malwarebytes.com/forum/42-false-positives/- Norton / Symantec: https://submit.norton.com/- Sophos: https://support.sophos.com/support/s/filesubmissionInclude the file name, the SHA-256 and the release tag. You can also open anissue at https://moonbite.org/support with thevendor name and the detection label so it can be tracked against the release.Policy background: docs/ADR-013-miner-distribution-policy.md in the repository.