Topic: PhoenixMiner 6.2c: fastest Ethereum/Ethash miner with lowest devfee (Win/Linux) - page 499. (Read 785074 times)

This is not true - these are some of the threats detected by virustotal.com for Claymore's miner:


These seem pretty specific threats, don't they? Yet, you decided to ignore them and post your false statement above.



We are not deflecting anything, we are defending our product from your attacks. Nobody forces you to use PhoenixMiner or to trust us but don't make any false claims about us! You made your opinion quite clear, so please stop shitting in our thread!!!

They are flagged for bitcoinminers not specific trojans like you seem to have.  Stop deflecting and justifying your virus program.

The results for our miner and Claymore's are at least somewhat understandable given that there is a anti-debug and anti-reversing code but the result of ethminer is really mind-boggling. This is quite unfortunate as there is no easy way to separate the software that can be trusted from the scams.


Well, as you can see in the post above yours, these scans should be taken with huge grain of salt. According to this site, the Claymore's miner is teaming with infections (dozens of them), so is the ethminer. Is this actually true? No, certainly not - these results obviously are not accurate and often give a lot of false positives. We can't expect any anti-virus developer to make sure that there aren't any false positives, because it doesn't really concern them - if their software finds a threat that isn't there, they aren't affected negatively in any way.

And really, think about it: we have spent a lot of time and efforts to make our miner as fast as possible and this wasn't easy at all. The potential profits if more people start using our miner are much higher than any potential profits of trying to infect them with malware. Why we would want to undermine our own efforts?

If the file has the right checksums:
then we can assure you that it is 100% clean. The checksums can be checked online or with a program like HashCheck (https://github.com/gurnec/HashCheck).

https://www.virustotal.com/#/file/23b6ffd3d67980bce45ef7196fed7349c5e6c0a2b1f3fe5b2182aa58f1ebbd21/detection

Very suspicious adware/malware trojan

Well, I'm not sure I qualify as "security expert" but I certainly am a "full-time security paranoic"  And as no one else seem to risk it, I downloaded and tested the miner as well as I could.

First, I used an online virus scanner to check the file.
The results are: 2/67 detected (https://www.virustotal.com/#/file/74cfd6a34e158c2f5fe1b8422d6b8daee304394eeaf85992b117bf5de315d569/detection), which is actually an excellent result, given that the Claymore's miner gives 41/68 positives (https://www.virustotal.com/#/file/7852c50c835d7110ab8d055cccad06674e94d85324414f91366852bed9be29cc/detection).

And even the open-source ethminer 0.12.0 gives 26/67 positives, which is ridiculous (https://www.virustotal.com/#/file/4aa1082b5581540eced3acb18ee52cd06ee062772a5d386cf7501b2a8b7af094/detection) 

So, I prepared a backup image of the SSD of my rig (in case that this new miner turn out to be malicious) and then ran it for about 18 hours while monitoring the PhoenixMiner.exe network, file system, and registry activity with Wireshark and some advanced system calls monitors. It connected to my mining pool as it should and then opened port 3333, which turned out to be the port for remote control similar to Claymore's miner. I disabled to remote port with the "-cdm 0" commnad-line switch and restarted the miner. Sure enough, this time port 3333 wasn't opened and the only connection was the one to my pool.

The first new connection was observed after 16 minutes of mining, which connected to another pool (ehtermine.org) and the miner showed that it was mining for developer fee. It disconnected after 35 seconds as advertised. After that I left the rig alone and analyzed the Wireshark and the other logs the next day.

The miner connected to the devfee pool every 90 minutes, with one exception when it wasn't able to connect to the ehtermine.org. It then tried again after 13 minutes and then resumed the normal 90 minutes period between devfee connections. No other network activity was recorded. The registry activity was also normal (no keys were created and no suspicious registry key reading was detected). Also, no files outside the current folder were opened or touched.

As for the mining speed, my rig has 6x ASUS Strix 570 OC (with BIOS mod) and under Claymore's miner it makes about 173 mhs. With Phoenix the speed was about 174.5 mhs, which is not much better but I guess is still something. The power consumption from the wall was about the same (755-765W). According the the pool, the speed was even better (169 vs 166 with claymore) but this doesn't mean much as I've seen this numbers change a lot without any apparent reason, so it would take some more time before declaring PhoenixMiner to be faster.

Of course, there is no guarantee that the PhoenixMiner won't "decide to go bad" at some point of the future, but right now it seems legit. 

Some suggestions for the devs: the share difficulty is a nice touch but it would be better to directly show the number of blocks found. Most pools doesn't report this and even when they do, I'm always suspicions. Also, your miner does seem to be compatible with Claymore's manager, which is nice, but I hope that you will produce a better manager (and maybe even a mobile app for Android), because the claymore's manager is rather simplistic and I miss a lot of features.

Yes you are correct the difficulty is the most important if i am trying to solve a block.... and i am glad that your miner has it shown, Nobody could convince claymore to print it. (also i took "-log 2", nice!! you had it!).

And for a side note i tested finally your miner on my 1080Ti card and it is indeed a little bit faster than Claymore at same setting .....giving 35.3 MH/s.... plus your's devfee is less.

We can guarantee that the file is clean but there may be some anti-virus programs that doesn't like it. We have tried all the major ones and they do not find anything. The .exe is not packed but it contains some code to detect if debugger or profiler is attached to try and debug and reverse it. In such case PhoenixMiner just exits.


Unfortunately we don't know why this is happening so there is no easy way to fix it. It shouldn't be the CUDA toolkit as it is installed on all of our development machines and it doesn't interfere with PhoenixMiner.


As you can see on the screenshot from the first post  (you can also see it here: ), we print the difficulty to each found share and also the maximum difficulty of any found share. The nonce itself can be seen in the log file but it is not very interesting as what it matters is the difficulty of the found share. If it is bigger than the current difficulty of the coin that you mine, you have found a block! For example for Pirl the current difficulty is about 9.8 TH and the screenshot shows that the maximum difficulty of found share is 14.3 TH, so at least one block as found in the current mining session.

We need some security experts with good level of trust to dig in and verify this otherwise the developers could always come back and say "hey it is safe, the antivirus is paranoid"

very instersting... but i will lurk and watch people testing it and make sure this program is safe then i will try and i will support you.
thanks anyway for the great job!

After download, the antivirus show file has virus....

I know Quadro cards are not suitable for mining but i can run ccminer almost all algo and siaminer in it with no issue. However i have not yet run any Ethash based miner. I thought your's would be the first .... but no luck.

Regarding debugger, i don't have any on it. I do have CUDA 8 Toolkit which i use with compute 3.0 and drivers version is 377.48.
Anyway ... see if it is something very easy to spot and correct for you.......... otherwise you can safely ignore....

Do have any plan to show the found Nonce in your miner.

We can guarantee that the executables are 100% clean. We even decided to avoid packing the executable to allow better inspection by the anti-virus programs. Still, there is always some chance that an over-aggressive anti-virus program will give you a false positive but you can safely ignore it. As an additional precaution you can check if the .zip archive you have downloaded has the right checksum (the checksums are listed in text file PhoenixMiner_2.1_checksums.txt, which is in the MEGA folder from the first post in this thread).

Point taken Still, we thought that our time is best spent trying to improve the mining performance instead of trying to come up with a cool name

While 1% or so may seem too little to matter, the hard truth about mining is that you have to pay your electricity bill and the amortization costs of the hardware, so the real ROI is often less than 20% per year. In this context 1% is quite welcome. Of course, if you keep your earnings in crypto and hope that it will go up, it may be a lot more than that but this is a risk that a lot of miners can't or won't take.


This means that anti-dubugger code is kicking in. Probably you have some kind of CUDA profiler or debugger running and PhoenixMiner is terminating to avoid reverse engineering. At any rate we haven't tested Quadro cards (and their drivers) as they are not very often used for mining.

PhoenixMiner team

dude! look at top section of the report! it clearly says .bat with size of 615B ! Read the report details

file .exe

You thought many hours for the name of the miner?

you mean the .bat file is clean as water?!

https://www.virustotal.com/#/file/c0f6ff3dc366de7c4a908fcfcd7d0482352ceee9f6add1a272c1afa6f6358a7f/detection



the program is as clean as water

first of all claymore would be even now to lower his devfee, especially on the miner 12.6 equiash, which still the devfee is high, and lasts 90 seconds.
in my opinion it is right that there is a lot of competition, if the miner of this boy is faster than only 1% compared to claymore or other miners, considering the devfee 0.65% and more gain for us miners.
the question is: and clean this miner? are we sure that it does not hide anything illegal to steal coins and empty the customer wallets?
for the rest if it is clean and deserves, well come.

Great that there developers out there trying to build a competition to profit both developers and users. In my personal opinion, having a roughly 1% higher hash rate (which you are not sure nor promote strongly) and offering 0.3% lower rate won't attract many users.
Claymore has gained so much popularity and credit which won't let the users bother trying a new miner program, unless it is way faster, better, feature-rich.

There are so many obstacles for your miner program to enter the competition, like trust, benefit, speed, stability, feature, and ...

I tried your miner ..... using my Quadro K2100M..... with 2GB VRAM and 3CU
but it says.........

NVML library initialized
FATAL ERROR: Debugger detected

Why is that ??