Windows Defender flags all crypto miners. It is not unique to NiceHash. You don't have to add an exception for the whole NiceHash directory for it to work, but it makes it easier. NiceHash updates the miners occasionally, and if you don't add an exception for the whole directory, then every time a miner gets an update, it's disabled by Windows Defender until you manually allow it.

Seems like there should be a way to have NiceHash sign their binaries or otherwise vet with Microsoft so Defender can automatically allow it. Setting an exception seems like it makes it a target for other malware to hijack or piggyback on.

A signed binary won't help.

Cryptominers fall into the "Potentially Unwanted Program" category, along with remote access software like a VNC server. They're not malware, but can be installed maliciously. If Windows Defender finds a cryptominer, it has no way to determine if it was deliberately installed, so it flags. Manually excepting the directory NiceHash installs the miners is the only way around it.

I wonder if other actual malware now actively looks for that directory to opportunistically install itself into if available?

Yes this would be my concern!

I'd bet that writing botnet software was pretty good training for writing distributed processing software like NiceHash, though I think your concern is still valid.

Yes absolutely, I'm sure writing a botnet is not trivial so I respect the technical ability!

Nicehash (the app) is a convenience tool to manage miner executables -- it's mostly those that are flagged by AVs. You can connect most miner executables to Nicehash (the service) or other pools directly, and some are open-source.

For instance I GPU mine with https://github.com/ethereum-mining/ethminer and CPU mine with https://github.com/xmrig/xmrig, both built from source and I don't use Nicehash (the app). But I haven't looked at the source, so at some point I'm still trusting someone.

This is interesting, so I could run the NiceHash app (which doesn't require an AV exception) and have it mine using open source miners which I have built myself?

Not really - each miner (and versions of them) may have different command line arguments or monitoring APIs Nicehash wouldn't know about, so it's going to be more trouble than it's worth. I meant just starting them from the command line:

ethminer.exe -P stratum2+tcp://<your nicehash wallet address>@daggerhashimoto.usa.nicehash.com:3353

Possibly.

Depends on whether or not the heuristics scanning in Windows Defender would still flag the miners if you compiled it yourself.

Self-ad: check mine (which is also conveniently called Mine). https://losttech.software/Downloads/Mine/

I am considering to add a feature, that would pause when external sensor reports high temperature. But you can already hack around that by creating a background window titled "DON'T MINE" and setting the tool to stop when it sees it.

I'll take a bit of your NiceHash and add some water [0] to that and make you something tasty. A bit more turnkey and a middleman if you don't mind.

[0]: https://www.753.plus/

NiceHash is on GitHub and you could always build it yourself if you’re worried. I think the reason it flags as malware is because virus scanners flag anything crypto mining-related as malware by default.