Ethdcrminer64: what it is and how to remove it
Ethdcrminer64 is a crypto-miner that is dedicated to mine digital currency using targeted machines. The cryptocurrency mining malware has been on the rise recently and is becoming one of the most prominent types.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
A free scan checks startup entries, tasks and hidden folders where processes like Ethdcrminer64.exe usually hide.
Do it yourself · free Remove Ethdcrminer64 yourself 6 steps, about 18 minutes, no software needed.
Start the steps
Ethdcrminer64: summary
| Detection names | No Microsoft detection name is known |
|---|---|
| Distribution | Not recorded in the old report |
| Damage | Not recorded in the old report |
| Name | Ethdcrminer64 |
| Type | Cryptominer |
| Symptoms | An unknown process using the processor or graphics card |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 4 more facts
| Evidence | 6 write-ups by security sites; details still limited |
|---|---|
| Files | Ethdcrminer64.exe |
| First seen | 16 May 2018 |
| Facts checked | 6 October 2026 |
What Ethdcrminer64 does
From our report of May 2018 · not reviewed since
Ethdcrminer64 is a virus that mines various cryptocurrencies on users' machines for cybercriminals
Ethdcrminer64 is a crypto-miner that is dedicated to mine digital currency using targeted machines.
The cryptocurrency mining malware has been on the rise recently and is becoming one of the most prominent types. Security researchers have noted that cybercrooks sometimes even convert ransomware into crypto-mining viruses, as it is more profitable and brings more money in. It enters users' PCs via contaminated attachments from phishing emails or sites, or download from malware-infected websites.
This cyber threat installs Claymore's Dual Ethereum – a legitimate tool used by many – and starts harvesting Ethereum, Siacoin, Pascal and similar altcoin currencies.
The process in the Task Manager that users can see after infiltration is called Ethdcrminer64.exe and, because of the intensive workload the virus puts on GPU and CPU, the PC can continually crash, overheat, become not-responsive, or generally run slow. It goes without saying that the first action required is Ethdcrminer64 removal from your Windows OS.
Ethdcrminer64 virus can run as often as your machine is turned on and active. The primary difference users will notice is that their computer is becoming loud as it spins the fans at full speed while trying to cope with the workload.
Although it can use a dramatic amount of CPU resources, its primary focus is the graphics card. However, its load and temperature cannot be detected within the Task Manager; therefore, users are advised to download GPU temperature and performance tracking software. In some cases, such information can be accessed via BIOS.
It is extremely dangerous if Ethdcrminer64.exe remains on the machine for a prolonged period. First of all, the malware uses CPU and GPU on its full power, and it does increase wear and tear aspect of the hardware. In some cases, it can even damage internal components and result in malfunction or breakage of computer components.
As the virus has trojan horse capabilities, it is may also conduct the following:
It should be evident to you by now that you should remove Ethdcrminer64 malware from your computer before your hardware is damaged and your personal data is stolen. However, you should not try to get rid of this threat yourself and leave it for - a reputable security tool which is designed to detect and exterminate even the most robust viruses.
- Rendering system vulnerable to other malware infections;
- Recording and sending the information you type on your keyboard to cybercriminals (including personal data, such as name, address, credit card details, etc.);
- Change computer parameters, including DNS and Registry key modifications;
- Affect other software installed on the machine (make it crash or malfunction in other ways);
- Gain persistence and may become complicated to eliminate.
From our report of May 2018 · not reviewed since
Crypto-mining malware can be avoided by being vigilant online
Users typically get infected with malware either when they are careless while browsing the internet or not experienced enough to handle internet browsing safely.
Nevertheless, it is vital to know how trojan horses are distributed - and we will explain the process to you.
Most of the people nowadays own an email account and are probably aware of spam campaigns they get now and then. The bad thing is that a lot of individuals open those spam emails without adequately checking if they are legitimate. The malicious code is typically attached to contaminated attachment or is hiding within a cleverly hidden hyperlink inside the email.
Therefore, you should not open all the emails casually that come your way. Hackers employ bots that spam copies of such messages to thousands of people, in the hopes of users taking the bait. And they do, unfortunately. You should learn to recognize phishing email trends and delete them immediately.
For example, security experts advise users to check the original address the email is sent from - it is a typically misspelled name of a well-known company (for instance amazon-offers@anazon.com). Without checking it properly, one can assume that email is from Amazon.
We also advise users to stay away from file-sharing and Peer-to-Peer sites and clients. Shared files can be infused with malicious code and pretend to be legitimate.
From our report of May 2018 · not reviewed since
More from our earlier report on Ethdcrminer64
- Can damage system files, increase wear and tear of hardware and compromises the OS
- Spam emails, malicious websites, repacked software, etc.
- High CPU and GPU usage, slow PC performance, crashing software, etc.
Check your PC for Ethdcrminer64
- File:
Ethdcrminer64.exe
How to remove Ethdcrminer64
Miners hide when Task Manager opens and add Defender exclusions.
The steps deal with both, then remove the files.
Step 1: Check where Ethdcrminer64.exe runs from and stop it
In Task Manager (Ctrl + Shift + Esc) find
Ethdcrminer64.exeon Processes, right-click it and choose Open file location before ending anything.Windows' own files live in
C:\Windows\System32; the same name in%AppData%, %Temp% or C:\Users\Public is an impostor. If the folder is wrong, right-click the process again, choose End task and delete the file.If it starts again within seconds, a task or another process restarts it, so run the scan step in Safe Mode. Task Manager works the same in Windows 11 and Windows 10.
Full procedure with screenshots: Close a frozen app (Task Manager, Force Quit) On uGetFix
Step 2: Delete scheduled tasks that bring it back
Programs like Ethdcrminer64 add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 3: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 4: Turn Microsoft Defender back on and remove its exclusions
Open Windows Security > Virus & threat protection > Manage settings and switch Real-time protection and Tamper Protection on.
Further down, under Exclusions, click Add or remove exclusions and remove every folder, file or process you did not add, because malware excludes its own folder so the scan skips it.
If the switches are greyed out with "This setting is managed by your administrator", a policy was written to the registry, which the scan in the next steps usually clears. The pages are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Turn off Microsoft Defender protection for a moment On uGetFix
Step 5: Delete the folders left behind
Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.
Press Windows + R, type
%LocalAppData%and press Enter, then do the same for%AppData%and %ProgramData%, and look for folders named after Ethdcrminer64, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 6: Scan the PC, then run the offline scan
A scan finds the parts of Ethdcrminer64 that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Choose a proper web browser and improve your safety with a VPN tool
Online spying has got momentum in recent years and people are getting more and more interested in how to protect their privacy online.
One of the basic means to add a layer of security - choose the most private and secure web browser. Although web browsers can't grant full privacy protection and security, some of them are much better at sandboxing, HTTPS upgrading, active content blocking, tracking blocking, phishing protection, and similar privacy-oriented features.
However, if you want true anonymity, we suggest you employ a powerful VPN - it can encrypt all the traffic that comes and goes out of your computer, preventing tracking completely.
Lost your files? Use data recovery software
While some files located on any computer are replaceable or useless, others can be extremely valuable.
Family photos, work documents, school projects - these are types of files that we don't want to lose. Unfortunately, there are many ways how unexpected data loss can occur:
- power cuts
- Blue Screen of Death errors
- hardware failures
- crypto-malware attack
- even accidental deletion
To ensure that all the files remain intact, you should prepare regular data backups. You can choose cloud-based or physical copies you could restore from later in case of a disaster. If your backups were lost as well or you never bothered to prepare any, can be your only hope to retrieve your invaluable files.
From our report of May 2018 · not reviewed since
Eliminate Ethdcrminer64 trojan from your machine
Do not try to remove Ethdcrminer64 virus by yourself because you will not be able to accomplish anything.
Trojans are very complicated types of infections and should be taken care of professionally. What is more, malware changes Registry entries - these configuration settings for Windows should not be tampered with either.
Therefore, we suggest automatic Ethdcrminer64 removal. For that, download and install , or and enter Safe Mode with Networking as explained below. Then, run a full system scan. Security software will also take care of damaged or changed Registry entries.
[GI=method-1]To make sure that security software can start properly, enter Safe Mode with Networking:
[GI=method-2]You can use System Restore to eliminate the virus:
Questions about Ethdcrminer64
Why does Ethdcrminer64.exe use so much CPU?
Legitimate programs use a lot of processor time only while they work for you:
- a game
- a video export
- a Windows update
- an antivirus scan
If Ethdcrminer64.exe does it constantly, including when you are away from the PC, it is most likely mining cryptocurrency or running another background job for someone else.
Look at the file's location and digital signature, and at what starts it: the Startup list in Settings, Task Scheduler and services. A process with no clear owner, an unsigned file and a hidden restart entry should be removed and the PC scanned offline.
I ended Ethdcrminer64.exe but it came back. Why?
Ending a process in Task Manager only stops it until something starts it again. Programs like Ethdcrminer64.exe keep a restart entry:
- a scheduled task
- a service
- a Run key in the registry
- a shortcut in the Startup folder
Some also have a second watcher process that relaunches the first. Find the entry first (Settings > Apps > Startup, Task Scheduler, services), disable or delete it, then end the process and delete its folder. A Microsoft Defender Offline scan run afterwards catches the parts that hide while Windows is running.
Is Ethdcrminer64.exe part of Ethdcrminer64?
Yes, Ethdcrminer64.exe is one of the files we found in infections with Ethdcrminer64. Malware often uses names that look like Windows or common programs, so the name alone is not proof; the location matters too.
Right-click the process in Task Manager and choose Open file location. A file with this name in a user folder or a random-named folder is very likely malicious. Do not just delete it by hand; run the offline scan so related tasks and entries go too.
Windows Security keeps finding Ethdcrminer64 again. Why?
Something is reinstalling it. Common causes are a scheduled task that downloads it again, a second program from the same source, an infected USB drive that is plugged in regularly, or another infected PC on the same network. Remove the detection, then check Task Scheduler, Installed apps sorted by date and every connected drive.
Run the offline scan with all USB drives unplugged. If the detection still comes back, resetting Windows is often faster than continuing the search. Copy only documents and photos before a reset.
Is my phone or my other laptop at risk from Ethdcrminer64?
Other Windows PCs can be, if they shared drives, folders or downloads with the infected one. Scan them with a full scan and the offline scan. Phones are not affected by Windows malware of this kind, but accounts you use on them are, if passwords were stolen from the PC.
That is why the account steps matter even when only one computer was infected. Change important passwords from a clean device and turn on two-step verification. Scan external disks used on the infected PC as well.
Can a cryptominer damage my hardware?
Not directly in most cases; modern processors and graphics cards slow down before they overheat. But weeks of constant full load wear fans and batteries faster, raise temperatures inside laptops and add to the power bill. Dust-clogged laptops suffer most.
Once the miner is removed, the load drops and normal wear resumes. If fans stay loud afterwards, clean the vents, and check in Task Manager that nothing else is still using the processor or graphics card. A laptop cooling pad can help while you clean up.
Is Ethdcrminer64 a virus?
In everyday language, yes: Ethdcrminer64 is malware, a program that runs without your consent. More precisely, the reports point to a cryptominer, based on what people saw: Ethdcrminer64.exe using the processor or graphics card at full load. It is not part of Windows and no legitimate program behaves this way while hiding from the user.
It should be removed, and the PC checked for other programs that may have come with it. Because there is no public analysis yet, we cannot list everything it does; the removal plan in this guide is written to cover the usual places this kind of malware uses to start and hide.
Are my files and accounts safe after Ethdcrminer64?
Your files are probably intact: nothing in the reports of Ethdcrminer64 mentions encryption or deletion, and the sign people saw is Ethdcrminer64.exe using the processor or graphics card at full load. Accounts are the bigger question. Code that runs under your user account can read browser data, and threats like this one are often bundled with a stealer.
Until a scan proves the PC clean, avoid signing in to important accounts on it. Afterwards, change your main passwords from another device and turn on two-step verification. Check your e-mail for forwarding rules you did not set up, a common sign that an account was accessed.
Is it enough to quarantine Ethdcrminer64?
Quarantine stops the file from running, which is the main point. It is not the whole clean-up, though. Malware rarely consists of one file: there may be a scheduled task, a startup entry, a second copy or a payload that was installed later.
Run a full scan and the offline scan, check Task Scheduler and Startup apps for unfamiliar entries, and follow the plan in this guide. Never restore an item from quarantine unless you are certain it was a false alarm.
Will Fortect remove Ethdcrminer64?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Ethdcrminer64, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Wikipedia: Graphics processing unit (read October 6, 2026)
- SearchSecurity: Trojan horse (computing) (read October 6, 2026)
- FTC: How to recognize, remove and avoid malware (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 6, 2026)
- Microsoft Learn: How Microsoft names malware (read October 6, 2026)