JS:Miner-C: what it is and how to remove it
JS:Miner-c is a term that is used by antivirus programs to identify a dangerous Trojan horse virus. This cyber threat possesses a wide range of capabilities, including secretly mining cryptocurrency (Monero, Bitcoin, etc.)
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If JS:Miner-C keeps coming back after uninstalling, a scan can find what reinstalls it.
Do it yourself · free Remove JS:Miner-C yourself 5 steps, about 15 minutes, no software needed.
Start the steps
JS:Miner-C: summary
| Distribution | Spreads as malicious email attachments, or is disguised as legitimate software on P2P sites |
|---|---|
| Name | JS:Miner-C |
| Type | Trojan horse |
| Main activities | Mining of Monero and similar types of cryptocurrency |
| Symptoms | Extremely high CPU and GPU usage |
| Detection names | No Microsoft detection name is known |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 4 more facts
| Damage | Not recorded in the old report |
|---|---|
| Evidence | 4 write-ups by security sites; details still limited |
| First seen | 21 June 2021 |
| Facts checked | 6 October 2026 |
What JS:Miner-C does
From our report of Jun 2021 · not reviewed since
Beware of suspicious emails and dubious sites
One of the most prominent malware distribution methods is malicious attachments or links inside a phishing email.
Bad actors often employ bots that are capable of sending thousands of emails to innocent users. Therefore, it is vital to recognize a scam email by the following signs:
Thus, carefully check the message before proceeding with any actions. Another way to prevent malware would be scanning the attachment before opening it.
Furthermore, Monero miner can also be distributed via malware-laden ads which look incredibly genuine. Likewise, you must not only monitor the software installation procedure but also pay close attention when browsing the Internet.
We suggest you stay away from all types of ads you can encounter online. Note that developers aim to make them look genuine and trick credulous people into clicking on them (for example, the malicious pop-up might be disguised as fake update). Unfortunately, most of the time you might either fall into the trap of scammers who are offering fake and expensive products or manually infiltrate malware.
- grammar or/and spelling mistakes present;
- the author presents himself as a representative of a high profile organization;
- the "From" address is not genuine (even if it might look so at first glance);
- attachments (such as .zip, .rar, .pdf, .doc, .html) or cleverly hidden hyperlinks present.
From our report of Jun 2021 · not reviewed since
More from our earlier report on JS:Miner-C
- You can get rid of the miner and similar cryptocurrency-focused threats with anti-malware tools
- At the moment, you can receive an alert with such a name from Avast.
- If you ignore JS:Miner-c Avast detection, there are numerous computer-related issues you may face.
Is JS:Miner-C dangerous?
From our report of Jun 2021 · not reviewed since
JS:Miner-c is a term that is used by antivirus programs to identify a dangerous Trojan horse virus.
This cyber threat possesses a wide range of capabilities, including secretly mining cryptocurrency (Monero, Bitcoin, etc.) on targeted machines, track and record personal and technical information, or even serve as a backdoor to various other malware.
Experts categorize this infection as similar to Minergate virus as both of them can not only damage computer systems but infiltrate with other cyber threats as well. Thus, it vital to get rid of the infection promptly.
If you wonder what is JS:Miner-c, this is merely a name for the infection used by antivirus systems to warn users. The term refers to the crypto-mining malware designed to redirect users to infected websites which are misusing the legitimate script from Coinhive — Monero JavaScript miner.
According to Coinhive's Terms of Use, authors of the site MUST warn users about mining. However, it is more than obvious that hackers behind the trojan virus are not going to do that.
Have in mind that JS:Miner-c will never lead you to trustworthy sites. In fact, they cannot only use your computer's power to mine cryptocurrency but can also infect your system with the following potentially unwanted programs (PUPs) and other dangerous malware:
Note that once you enter a bogus website, it will use excessive amounts of CPU power while the page is open. The temporary way to stop the site from misusing your computer's resources is to close it immediately. However, this will not remove JS:Miner-c from your system which is the primary cause why you are redirected to such websites.
High CPU usage forces your computer to work at high temperatures for long periods of time. Likewise, after some time you will first notice a significant decrease in your PC performance, along with increased electricity bills.
Also, be aware that mining cryptocurrency usually takes up to 100% of CPU and there are no resources left for performing other vital system processes. As a result, your programs will crash or it will take a lot of time for them to load. Moreover, you might face other issues related to the virus as well:
For all the reasons mentioned above, we strongly suggest you remove JS:Miner-c from both, Mac and Windows operating systems. You can employ professional security software, like or .
Additionally, we would like to warn you that successful threat removal requires you to get rid of all its malicious components. Since this malware has adware-like features, it is vital to delete all suspicious entries from your browsers. Instructions on how to do that are also provided at the end of this article.
- Browser hijackers;
- Adware-type applications;
- Ransomware;
- Trojan horses.
- Continuous freezes;
- Slowdowns;
- Sluggish system.
How to remove JS:Miner-C
Miners hide when Task Manager opens and add Defender exclusions.
The steps deal with both, then remove the files.
Step 1: Delete scheduled tasks that bring it back
Open Task Scheduler from the Start menu and click Task Scheduler Library. Select each task you do not recognise and read the Actions tab:
- a task that starts a file in
%AppData%or%Temp% - runs
powershellwith a long encoded line - opens a web address belongs to JS:Miner-C or a similar program
Right-click such a task and choose Delete, and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
- a task that starts a file in
Step 2: Remove it from startup
Whatever JS:Miner-C installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Turn Microsoft Defender back on and remove its exclusions
JS:Miner-C turns protection off or adds exclusions so that Defender ignores it. In Windows Security > Virus & threat protection, open Manage settings and switch Real-time protection, Cloud-delivered protection and Tamper Protection back on.
Then open Add or remove exclusions at the bottom of that page and remove whatever you did not add yourself, for example a folder in
%AppData%or an entire drive. These pages look the same in Windows 11 and Windows 10.Full procedure with screenshots: Turn off Microsoft Defender protection for a moment On uGetFix
Step 4: Delete the folders left behind
What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items), and go through
%LocalAppData%,%AppData%, %ProgramData% and the two Program Files folders.Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold
.exe,.dll, .js or .ps1 files are the strongest sign.Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 5: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Stream videos without limitations, no matter where you are
There are multiple parties that could find out almost anything about you by checking your online activity.
While this is highly unlikely, advertisers and tech companies are constantly tracking you online. The first step to privacy should be a secure browser that focuses on tracker reduction to a minimum.
Even if you employ a secure browser, you will not be able to access websites that are restricted due to local government laws or other reasons. In other words, you may not be able to stream Disney+ or US-based Netflix in some countries. To bypass these restrictions, you can employ a powerful VPN, which provides dedicated servers for torrenting and streaming, not slowing you down in the process.
Data backups are important - recover your lost files
Ransomware is one of the biggest threats to personal data.
Once it is executed on a machine, it launches a sophisticated encryption algorithm that locks all your files, although it does not destroy them. The most common misconception is that anti-malware software can return files to their previous states. This is not true, however, and data remains locked after the malicious payload is deleted.
While regular data backups are the only secure method to recover your files after a ransomware attack, tools such as can also be effective and restore at least some of your lost data.
From our report of Jun 2021 · not reviewed since
You can uninstall JS:Miner-c with an antivirus software
If you consider whether the removal is necessary, we can assure you that this is the only way to protect your computer's well-being.
Note that this malware not only deteriorates it performance but it can also infiltrate the system with other potentially dangerous infections. Thus, get rid of it as soon as possible.
For that, we strongly recommend employing one of the antivirus tools mentioned below. They are designed to help you eliminate various potentially unwanted programs with a few clicks. Thus, this is the easiest way to get rid of JS:Miner-c virus. However, feel free to use any other malware removal tool of your choice.
LosVirus.es team warns that users should remove the virus manually, at will most likely fail and can damage the compromised system even more. Rely on , for the job. Also, trust fr the help of cleaning the system.
Questions about JS:Miner-C
Can I safely uninstall JS:Miner-C?
If you did not install JS:Miner-C yourself and it is not part of your hardware or a program you rely on, yes. Uninstalling an unwanted program does not harm Windows. Before you do, search the exact name and publisher to be sure it is not a driver tool, a printer utility or a game launcher with an odd name.
Then remove it from Settings, Apps, Installed apps. Ignore any offers or warnings in its uninstaller about losing protection or performance. Afterwards check Startup apps and your browsers for leftovers, and restart once to confirm that it does not reinstall itself.
JS:Miner-C will not uninstall. What can I do?
First restart the PC and try again, because the program may have been running and locked its own files. If the uninstaller is missing or fails, start Windows in Safe Mode, where most third-party programs do not start, and remove JS:Miner-C from Installed apps there.
If it still refuses, delete its startup entry and its scheduled task, restart, and try once more. A program that actively prevents removal is behaving like malware, so finish with a Microsoft Defender offline scan. Avoid third-party uninstallers offered on search ads; several of them are unwanted programs themselves.
Could JS:Miner-C have come from a website?
Visiting a website alone rarely installs malware on an up-to-date Windows PC. What websites do is persuade people to download and run something:
- a fake update
- a crack
- a codec
- a command pasted into the Run box
For JS:Miner-C, the exact route is not known yet, but JS:Miner-C in the list of installed apps means a program or script was started on the PC at some point.
Check your Downloads folder and browser history for the days before the sign appeared, and remove any program installed then. Keeping Windows, the browser and Microsoft Defender updated closes the few routes that need no click at all.
Are my files and accounts safe after JS:Miner-C?
Your files are probably intact: nothing in the reports of JS:Miner-C mentions encryption or deletion, and the sign people saw is JS:Miner-C in the list of installed apps. Accounts are the bigger question. Code that runs under your user account can read browser data, and threats like this one are often bundled with a stealer.
Until a scan proves the PC clean, avoid signing in to important accounts on it. Afterwards, change your main passwords from another device and turn on two-step verification. Check your e-mail for forwarding rules you did not set up, a common sign that an account was accessed.
Should I scan my other computers too?
It is a good idea, even for malware that does not spread by itself. The same download, USB stick or loader may have been used on other PCs in the household, and shared folders can carry files between them.
Run a full scan followed by the Microsoft Defender offline scan on each Windows PC that shared drives or files with the infected one. Do not copy programs or installers from the infected PC until it is clean, and change Wi-Fi and router passwords if they were saved on it.
What is JS:Miner-C?
From the reports we have, JS:Miner-C is a cryptominer. The one sign people describe is JS:Miner-C in the list of installed apps, and that pattern fits malware that runs hidden on Windows for someone else's benefit.
No sample has been analysed in public yet, so we do not name a family or a coin and we do not guess at extra features. What matters for you is that it is not a Windows component and not something you installed on purpose.
The steps in this guide remove it whatever the details turn out to be: find what starts it, remove that, scan offline and check what may have arrived with it. We update this page when an analysis appears.
Can I just delete the file Windows Security found?
Let Windows Security handle it instead. When it finds JS:Miner-C, choose Remove or Quarantine; the scanner also removes related startup entries and tasks that a manual delete would miss. Deleting a running file by hand often fails, and many threats restore themselves from a second copy.
After the removal, run the Microsoft Defender offline scan, which works before Windows starts and catches parts that hide while Windows runs. Then check Task Scheduler for leftovers. Restart afterwards and check that the detection does not return.
How much electricity does a miner use?
It depends on the hardware and how hard the miner runs, so there is no single figure. A miner that keeps a desktop processor or graphics card busy around the clock can noticeably raise a household power bill over a month, and laptops lose battery life fast.
Some miners limit themselves to part of the available power to stay unnoticed, which lowers the cost but also hides the problem longer. Removing it is the only fix. Afterwards, idle use should fall back to a few percent.
The PC is still slow after removing JS:Miner-C. What now?
Restart the PC first; some changes only take effect after a reboot. Then open Task Manager and check the Processes and Startup apps tabs for anything unfamiliar using the processor, disk or network. If something remains, run the Microsoft Defender offline scan once more.
Slowness can also come from a second infection installed alongside JS:Miner-C, or from programs that were damaged during the clean-up. If nothing helps, back up your files and reset Windows. Copy only documents and photos before a reset, and scan the copies.
Will Fortect remove JS:Miner-C?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For JS:Miner-C, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- How-To Geek: PUPs Explained: What is a "Potentially Unwanted Program"? (read October 6, 2026)
- MakeUseOf: What Is A CPU and What Does It Do? (read October 6, 2026)
- LosVirus: LosVirus (read October 6, 2026)
- FTC: How to recognize, remove and avoid malware (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 6, 2026)