HEUR:Trojan.MSIL.Miner.gen: what the alert means and what to do

What HEUR:Trojan.MSIL.Miner.gen is, and what it is not

HEUR:Trojan.MSIL.Miner.gen is the name Kaspersky products give to a .NET program they judge to be a cryptocurrency miner. It is a detection label, not a program you can uninstall, and it is a verdict from a rule, not a finding about your PC.

1. 1

   What the name says

   Kaspersky's own threat page for the name gives the class Trojan, the platform MSIL (the Microsoft .NET intermediate language) and the family Trojan.MSIL.Miner. The family page says that malware in this family secretly uses the processor of an infected computer to generate cryptocurrency. So the name points to a miner written for .NET.

2. 2

   Why the old guide called it a possible false alarm

   The name begins with HEUR:, which Kaspersky's encyclopedia says marks an object found by its heuristic module, a rule that looks at what a file does and how it is built. A rule can be wrong, and the cases we found show both a real campaign and a flagged tool that was harmless. That is why this page first helps you decide which one you have.

3. 3

   What the old guide got wrong

   Our 2021 guide listed key logging, click fraud, remote access and phishing as things this detection can do, and said it may be linked to "compatibility or file corruption". Kaspersky's page lists spying behaviour only in its generic text for the Trojan class; the family text says mining. File corruption is not given by any source we found as a cause. We have rewritten those parts and say in each chapter what changed.

4. 4

   What to do first

   Write down the full path of the file that was flagged. A flagged file inside a game-modding or development tool you downloaded yourself is a different case from a flagged file in a temporary folder, a Startup folder or a folder you do not recognise.

Shown by

Kaspersky products. The prefix can also read UDS:, as in a 2024 forum case, which Kaspersky's pages do not explain

Class and platform

Trojan on MSIL, so the file is a .NET program or library

Family

Trojan.MSIL.Miner: malware that secretly uses processor capacity to generate cryptocurrency, per Kaspersky

Is it a program?

No. It is the label of a detection; the file behind it can differ from case to case

Not the same as

HEUR:Trojan.Win32.Miner.gen (the name on the pictures in our 2021 guide), which is a native Windows detection, not a .NET one

Kaspersky page

Updated 08/09/2026 as shown on the page; two sample hashes listed

A miner uses your processor or graphics card to earn coins for someone else. The cost to you is power, heat and a slow PC, and, when a real miner got in through a remote access tool, the loss of control of the PC.

How to read the name, part by part

Kaspersky explains some parts of this name on its own pages and leaves others undefined, so the right-hand column says where each reading comes from.

Search for the whole string you were shown. HEUR:Trojan.Win32.Miner.gen, HEUR:Trojan.Script.Miner.gen and HEUR:Trojan.MSIL.Miner.gen are three different detections, for a Windows program, a script and a .NET program.

What we checked on 6 October 2026, and what we could not

There is no website to test and no file to run, because a detection name is not a program. We read Kaspersky's pages for the name, a Microsoft report on a real .NET miner campaign and a public forum case, and we ran nothing on a PC.

The name from 2016 to 2026

Our guide dates from 28 July 2021. The picture below is from it; the other entries are the vendor and forum sources we found.

1. 2016

   Kaspersky starts the family Trojan.MSIL.Miner

   The Kaspersky page for the family shows a detect date of 07/01/2016 and describes malware that secretly uses processor capacity to generate cryptocurrency. The page does not say whether the date is 7 January or 1 July.

2. 28 July 2021

   Our first guide

   The 2021 guide called the name a heuristic alert that may be a real virus or a false alarm, and listed what trojans can do. Its pictures are Kaspersky notification windows. They show a different name, HEUR:Trojan.Win32.Miner.gen for C:\Windows\System32\winlogui.exe, and adware warnings for a downloaded video-editing installer, so they illustrate a Kaspersky alert, not this detection.

   

3. 14 August 2024

   A modding tool is flagged as UDS:Trojan.MSIL.Miner.gen

   A user of the game-modding tool DynDOLOD wrote on the tool's support forum that Kaspersky reported UDS:Trojan.MSIL.Miner.gen in all executables in the tool's Edit Scripts folder after he downloaded it from Nexus Mods. The tool's author answered with a link to the FAQ: check the Nexus scan result and VirusTotal, treat it as a false positive when most tests find nothing, and report it to the antivirus vendor. The user said he had thought the download site was infected.

4. 26 May 2026

   Microsoft describes a real .NET miner campaign

   Microsoft Defender Experts wrote about fake download sites for system utilities, reached through search results and AI chatbot answers, that delivered a legitimate program with a malicious DLL, then remote access software, then a .NET miner that Microsoft detects as Trojan:MSIL/CoinMiner!MS. It is the closest current picture of a real case, though no source ties it to the Kaspersky name.

5. 8 or 9 September 2026

   Kaspersky updates the page

   The threat page for HEUR:Trojan.MSIL.Miner.gen shows the update date 08/09/2026. It lists the behaviours its rule can map to, among them scheduled tasks, services, registry Run keys, process injection and hidden windows, and it lists resource hijacking as the impact. We take that as the range of what the rule covers, not as what one file did.

Across the years the name is a vendor label that sometimes marks a real miner and sometimes a harmless tool. That is a reason to check the file, not a verdict on it.

What it can cost you

The old guide listed eight things this detection can do. Only some belong to a miner, so each item below says what supports it. Read the list as what a real miner case can do, not as a finding about every alert.

• High

  A stranger with access to the PC

  In the Microsoft campaign the miner arrived through a remote access tool. That is an open door, and it can be used to download and install other malware, which the old guide also listed.

• Medium

  Your processor or graphics card works for someone else

  Kaspersky's family text says the malware secretly uses processor capacity to generate cryptocurrency. In the Microsoft report the miner used the graphics card.

• Medium

  A slow, hot, noisy PC and a larger power bill

  Mining runs the hardware hard for hours. The old guide's performance problems fit this and it is the most common sign of a real miner.

• Medium

  Security tools switched off for the miner

  The Microsoft miner added Defender exclusions and re-applied them every five seconds. An exclusion you did not make is a sign of tampering.

• Low

  Spying on keys and websites

  The old guide listed keystroke recording and site tracking. Kaspersky's text for the Trojan class describes this, but its family text for the miner does not. We found no case of it for this name.

• Low

  Click fraud, redirecting ads and phishing material

  These were in the old guide's list. No source we found ties them to this name, and a miner has no need for them.

• Low

  A false alarm costing you time

  If the detection is wrong, the cost is the hours you spend and a quarantined file that your program may need. The DynDOLOD case was of this kind.

What you may notice, and what the sources show

The old guide said users mostly report the alert itself and not real problems, and that performance problems appear when a real infection is present. Both fit the sources. The alert is often the only sign.

How it gets onto a PC: what our old guide said and what the sources show

The old guide said trojans come from hacked pages, spam email, files and malicious sites. None of those is tied to this name by a source. The table says what supports each claim.

1. 1

   What this means for you

   Ask where the flagged file came from. A fake download of a system or hardware monitoring tool, a crack, a cheat or a mod, and a remote access tool you did not install are the routes with a source behind them. A flagged file from a developer you trust points the other way.

What a real .NET miner can look like: Microsoft's May 2026 report

This is the most detailed current description of a .NET miner that we found. It is about one campaign and is not tied to the Kaspersky name, so read it as a list of places to look, not as what every alert means.

1. 1

   A lookalike download

   People searched for common system utilities or asked AI chatbots for downloads and landed on lookalike sites. The ZIP file held a legitimate executable and a malicious autorun.dll that Windows loads when the executable starts (DLL sideloading).

2. 2

   Remote access software is installed

   The DLL silently installed a second DLL that was a packaged installer for the remote access product ScreenConnect. That gave the attacker a session on the PC.

3. 3

   The miner is dropped

   Through that session the attacker dropped a program named SimpleRunPE.exe, which copied itself into a hidden folder as RuntimeHost.exe and set up six ways to start again: scheduled tasks, registry Run entries and a Startup folder shortcut.

4. 4

   It hides inside Microsoft .NET programs

   It tried to run its code inside signed Microsoft .NET programs such as InstallUtil.exe, RegAsm.exe and MSBuild.exe, added Windows Defender exclusions with PowerShell, and downloaded a graphics-card miner (gminer, lolMiner or SRBMiner-MULTI) at run time.

5. 5

   It tries not to be seen

   Microsoft wrote that it re-applied the Defender exclusions every five seconds, repaired its persistence and ended mining processes when high graphics-card use, user activity or monitored programs were seen.

We print no wallet, server address or certificate value from the report. Nothing here needs them for a home PC.

Check the file and the PC before you delete anything

Write down exactly what the alert says and which file it names before you click Delete. Then look for what could start a miner again. We did not run these checks on an infected PC; they use the Windows tools named in each step.

1. 1

   Copy the alert

   Take a screenshot. Note the full name including HEUR: or UDS:, the product and its version, the date and the full path of the file.

2. 2

   Where is the file?

   A file in a folder of a program you installed on purpose, such as a game, a mod tool or a developer tool, is a candidate for a false positive. A file with a random name in a temporary folder, in AppData or in a Startup folder, or a file that looks like a Microsoft program outside C:\Windows, is more worrying.

3. 3

   Where did it come from?

   Think about the last download. A crack, a cheat, a mod, a fake driver or monitoring tool, or a utility found through a search or a chatbot answer are the routes with a source behind them.

4. 4

   Ask more scanners about the same file

   Upload the file, or only its hash, to VirusTotal. The DynDOLOD author's rule of thumb was that a false positive is one where most of the tests find nothing wrong. A file that many engines call a miner is a different case. Do not upload files with private contents.

5. 5

   Look at the load

   Press Ctrl + Shift + Esc, open Performance and Processes, sort by CPU and GPU, and look when you are not using the PC. A program you do not know that keeps the processor busy is the thing to find.

6. 6

   Look at what starts with Windows

   In Task Manager open Startup apps. Open Task Scheduler and look at tasks you do not recognise, especially names that imitate Windows such as System Health. Microsoft's Autoruns, from Sysinternals, lists more places.

7. 7

   Look at your Defender exclusions

   Open Windows Security > Virus & threat protection > Manage settings > Add or remove exclusions. Any exclusion you did not add is a reason to go on to the removal chapter.

8. 8

   Look for remote access programs

   Open Settings > Apps > Installed apps. A remote access tool such as ScreenConnect that you did not install is a serious find.

9. 9

   Scan twice

   Scan with Microsoft Defender and with a second on-demand scanner and compare the names. If only the product that gave this name reports it, update that product first and scan again.

Remove it from Windows 11 and Windows 10

The old guide said to boot in Safe Mode with Networking, scan, and try System Restore. We keep the Safe Mode scan, add the checks above and the offline scan, and leave out System Restore and the repair-tool walkthrough. The steps follow Microsoft's pages and Kaspersky's tool page; we did not run them against a live infection.

1. 1

   Decide first whether it is a false alarm

   If the file sits in a program you trust, VirusTotal shows no agreement and the checks above found nothing, do not delete the program. Go to the false-alarm chapter. Otherwise go on.

2. 2

   Disconnect and back up documents

   If you think a remote access tool is on the PC, turn off Wi-Fi or unplug the cable. Copy documents and photos, not programs, to an external drive that you unplug afterwards.

3. 3

   Run a full scan with Microsoft Defender

   In Windows Security > Virus & threat protection > Scan options choose Full scan and Scan now.

4. 4

   Scan memory and startup objects with a second tool

   Download Kaspersky Virus Removal Tool from Kaspersky's page. Kaspersky says it is a free on-demand tool that needs no installation, can run alongside your own antivirus and lets you choose scan areas that include system memory and startup objects.

5. 5

   Start in Safe Mode with Networking

   Windows 11: open Settings > System > Recovery, next to Advanced startup select Restart now. Windows 10: Settings > Update & Security > Recovery. Or hold Shift and select Power > Restart. Then choose Troubleshoot > Advanced options > Startup Settings > Restart and press 5 for Safe Mode with Networking. Microsoft says Safe Mode starts Windows in a basic state with a limited set of files and drivers. If you use BitLocker you will need the recovery key.

6. 6

   Run Microsoft Defender Offline

   In Windows Security > Virus & threat protection > Scan options choose Microsoft Defender Offline scan and Scan now. Microsoft says it runs from outside the normal Windows kernel, takes about 15 minutes and restarts the PC. It does not apply to Windows Server editions or ARM PCs, and with BitLocker you should suspend protection first. Review the result under Protection history.

7. 7

   Remove what you found in the checks

   Delete scheduled tasks, Startup shortcuts and Run entries only when you have confirmed that they belong to the miner and not to a program you installed. Remove Defender exclusions you did not add, and uninstall a remote access program you did not install from Installed apps. Write down what you removed.

8. 8

   Quarantine only what you cannot account for

   If scans agree that a file is harmful, let the product quarantine it and then delete it. Quarantine can be undone, deleting cannot.

9. 9

   Last resort: reset Windows

   Back up documents, then use Settings > System > Recovery > Reset this PC and choose Remove everything, or reinstall from a USB installer. Restore documents only, no programs and no full system image.

Never install a repair tool because a pop-up or a stranger tells you to. The old guide's walkthrough of a PC repair program is gone from this page: a registry or system repair tool is not a malware remover.

Could it be a false alarm?

Quite possibly, and the one case we found was one. The old guide said the same: a heuristic name can come from a compatibility or file problem. Use the table to decide how careful to be.

1. 1

   Update the product and scan again

   Make sure the antivirus databases are up to date, then scan the same file again. Old versions can report names that newer ones no longer do.

2. 2

   Report a wrong verdict

   The DynDOLOD FAQ advises reporting a false positive to the antivirus developer. Use the vendor's own form, and send the file or its hash.

3. 3

   Do not turn off protection

   Do not switch off your security product or exclude a whole folder to stop the alert. Exclude one file only when the maker and VirusTotal back it and you accept the risk.

4. 4

   Do not act on pop-ups

   A pop-up in a browser that says your PC has this infection and tells you to call or buy something is a scam. A detection name is shown by your own security product, not by a web page.