We just had the exact same problem pop up. Fifteen of our ad zones had a script included that loaded a coinminer.f JavaScript.
These were all added into the table xxx_zones in the prepend column.
To remove the coinminer.js script go into your database and pull up any xxx_zones where prepend or append is not null. You should see the script there and can delete it.
More importantly I need to figure out how it got there. I just began looking into this, I will let you know what else I find. This came up right after we upgraded to revive version 4.1.1. That might just be a coincidence. I'll post what I find.
I also disabled the prepend/append columns in the xxx_zones table since I do not use these. By "disabled" I mean I just changed their column type from text to char(1). This way nothing can be entered into those columns. Again though, most importantly I need to figure out how they got there in the first place since it means there is a hole somewhere.