Kodi Malware: How to Check if Gaia Has Infected You

It’s been discovered that the Bubbles and Gaia addons have been maliciously installing Kodi malware on unsuspecting users and has been mining crypto-coins without user knowledge. Come and read the full story and find out if you’ve been infected!

The news has taken over the Addons4Kodi subreddit, which has been notoriously pro-Gaia in the past. After some confusion, blame pointing, and miscommunication, the official story is as follows:

In the last update to the Bubble Kodi addon, a malicious piece of Kodi malware was added into the simplejson dependency. This malware acts as a cryptocurrency miner for Windows and Linus Kodi users, taking up CPU resources to generate money for the old Bubbles developer.

At some point, the Gaia Kodi development group discovered the Kodi malware and removed it from the code. The team did not address the findings or information users.

So… If you are a Windows or Linux Kodi user, it is highly recommended that you check for the malicious Kodi malware and remove it as soon as possible!

Follow our guide below to check and delete these malware:

 

How to Check if you are Infected by Kodi Malware from Gaia

NOTE: You can only be affected if you are using either Windows or Linux. Android Kodi users are not involved in this Kodi Malware scheme at all.

1. From the Kodi home screen, navigate to SYSTEM (cog wheel) > SYSTEM SETTINGS
2. Change the settings level in the bottom level to Advanced or Expert
3. Click on Addons
4. Click Manage Dependencies
5. Scroll down to Simplejson and right click or press the menu button (‘c’).
6. Click on Information
7. If you have version 3.4.1 installed, then you have been infected with Kodi malware and need to get version 3.4 from the official Kodi repository instead.
8. Find the Kodi addons folder and delete the script.module.python.requests folder.

If you have been infected, you should use an anti-malware software to scan and block these threats:

1. CoinMiner.II and CoinMiner.MK on Windows
2. CoinMiner.BC, CoinMiner.BJ, CoinMiner.BK, and CoinMiner.CU on Linux

 

So far, the Gaia team has not address the Kodi malware directly. It is also unknown why the old Bubbles repository would tarnish his reputation and add in this cryptominer code.

We will update this guide with any more details as they come out!

Let us know on Twitter or Facebook if we can help you out!