Trojan.BitCoinMiner: what it is and how to remove it
Trojan.BitCoinMiner is a malicious program that abuses your computer's CPU and GPU to generate cryptocurrency for cybercriminals without your consent. Once infected, your system experiences severe performance degradation and potential hardware damage from continuous mining operations.
Facts checked October 7, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Not sure whether run.exe is the only thing running? An automatic scan of the PC gives a second opinion.
Do it yourself · free Remove Trojan.BitCoinMiner yourself 6 steps, about 18 minutes, no software needed.
Start the steps
Trojan.BitCoinMiner: summary
| Name | Trojan.BitCoinMiner |
|---|---|
| Type | Cryptocurrency mining malware[2] |
| Family | Bitcoin virus |
| Infiltration | Trojans can be distributed in various ways, but most commonly users install this type of malware after trying to download pirated programs from torrent sites or when opening malicious spam email attachments |
| Symptoms | Trojans are generally designed to stay stealthy on the machine once established. However, coin mining malware can often be traced by the increased CPU usage, frequent BSODs, increased electricity bills, software crashes, and similar |
| Detection names | No Microsoft detection name is known |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 6 more facts
| Distribution | Not recorded in the old report |
|---|---|
| Damage | Not recorded in the old report |
| Evidence | 4 write-ups by security sites; details still limited |
| Files | run.exe |
| First seen | 15 June 2020 |
| Facts checked | 7 October 2026 |
What Trojan.BitCoinMiner does
From our report of Jun 2020 · outdated details corrected in October 2026
Trojan.BitCoinMiner - malicious program designed to abuse your computer power for malicious purposes
Trojan.BitCoinMiner is a detection name of a type of malware that belongs to the Bitcoin virus category.
These types of computer infections are programmed to utilize hardware such as CPU or GPU in order to perform complex mathematical calculations, generating cryptocurrency in the process. While the practice itself is not malicious, and many users can run such operations on their systems if so desired, an app injected into the machine without permission is malicious and should be terminated immediately.
Upon infiltration, Trojan.BitCoinMiner performs a variety of changes on Windows machines and begins its malicious processes immediately. In most cases, the malware is set to operate as soon as users turn on their PCs. During this process, computers' fans are running at full capacity, and CPU usage jumps as high as 100%.
Since the virus is programmed to deliver Bitcoin digital currency to cybercriminals' wallets, users themselves do not get any benefit from the mining process, but instead could suffer serious financial losses and even hardware component corruption.
Besides, if your security software flagged Trojan.BitCoinMiner on your system, there is a chance that there is a backdoor installed on your machine. You need to fully determine the intruder and clear all the possible threats fully.
While the detection name indicates that this Trojan is designed to mine Bitcoin, it is not always the case. Trojan.BitCoinMiner can also abuse computer resources to mine Monero, Ethereum, Litecoin, and many others. Regardless of the currency type, however, all the funds are delivered directly to cybercriminals' hands.
There are many ways how you could get infected with Trojan.BitCoinMiner virus. By definition, a Trojan indicates that a user tried to install something that he believed is harmless, but turned out to be malicious. There are several different instances when such a scenario could occur, for example:
To sum up, the infiltration lies within users getting tricked, as they believe that they are installing something harmless. If the boobytrapped file turns out to be malicious, their security software would immediately stop the infection. In the meantime, those who do not have a robust security tool installed would have to deal with Trojan.BitCoinMiner removal.
Once on the system, Trojan.BitCoinMiner will begin to generate cryptocurrency, all while showing a variety of symptoms. The immediate impact of cryptomalware might not be significant, if not considering the significant decline in the performance of the computer. Additional changes that malware can trigger in the system may affect the performance of the OS significantly, so rely on and make sure to repair affected or corrupted files.
However, Trojans can be programmed to perform a variety of tasks, so there is a chance that other malware can be installed as well. As a result, victims might suffer from such consequences as banking credential exposure to malicious parties or even identity theft. You need to fully remove Trojan.BitCoinMiner to get rid of any additional malware installed behind your back. Use anti-malware tools and clear infections thoroughly.
- Fake browser or codec update pop-ups claiming the plugin is outdated were used to distribute malware.
- Pirated software installers are often believed to be a working copy of legitimate applications. However, once the malicious .exe file is executed (typically titled by using legitimate names, such as run.exe, or Adobe Acrobat Pro DC 2020.009.20067.exe) malware is launched in the background;
- Bogus virus alerts that claim computer infection;
- Fake email attachments that pose to be receipts, bank statements, delivery notices, etc.
From our report of Jun 2020 · not reviewed since
Miners and other serious threats designed to appear on the system without the knowledge of the user
Trojans can appear as an attractive program, screensaver, an application, or an update to one.
It gets installed behind the users' back and triggers needed processes, runs programs that affect the system but do not trigger any symptoms. Unfortunately, once malicious program or file gets downloaded and open, the trojan can perform anything that author designed it for.
Spam email notifications can include links to malware pages, hacked sites, direct documents containing the malicious script, or a macro virus coding. Experts always note that any material online can be dangerous, especially sites and emails that you are not expecting to get or are familiar with.
Pay attention to questionable senders and sites that display suspicious material. Any links on Financial-themed email messages should be taken seriously. If you are not using the service or the company that sends you invoices is not the particularly known product or service provider, you should be suspicious. Delete any emails that are not waited and make sure to ignore shady senders.
From our report of Jun 2020 · not reviewed since
The generic detection of the Trojan.BitCoinMiner identification
This particular Trojan.BitCoinMiner virus detection result appears on the screen when the machine is infected by the trojan malware.
Even though such threats mainly infiltrate and run in the background, your AV tools indicate the danger automatically.
If the anti-malware engine that you have shows this result, you need to remove Trojan.BitCoinMiner using a powerful AV engine like that. Other security tools like or can also help, but make sure to check the PC with a few alternate tools to get the best results.
After the Trojan.BitCoinMiner removal and system cleaning, you may need to repair functions or programs additionally. Trojans can migrate on the machine and inject scripts that damage the machine, files, functions. So rely on PC repair applications like and recover functions properly.
[GI=method-1]Reboot the system in Safe Mode to find all threats using AV tools and clean off all the traces of the Trojan.BitCoinMiner virus
From our report of Jun 2020 · not reviewed since
More from our earlier report on Trojan.BitCoinMiner
- Manual elimination of crypto-mining malware can be extremely difficult, as it establishes a lot of new settings and imports a variety of malicious files.
- Therefore, the best way to terminate the infection is by scanning the machine with reputable anti-malware
- Malware can significantly deteriorate the performance of any Windows machine, and it might not work as well as previously.
Check your PC for Trojan.BitCoinMiner
- File:
run.exe
How to remove Trojan.BitCoinMiner
Miners hide when Task Manager opens and add Defender exclusions.
The steps deal with both, then remove the files.
Step 1: Check where run.exe runs from and stop it
run.exeis the part you can see, and its location tells you whether it belongs there. Right-click it on the Processes page of Task Manager and choose Open file location, then right-click the file > Properties > Digital Signatures to see who signed it.An unsigned file, or one in a user folder such as
%AppData%, is the one to remove: end the task, then delete the file.Note the folder name, because the same folder usually holds its other files. This is the same in Windows 11 and Windows 10.
Full procedure with screenshots: Close a frozen app (Task Manager, Force Quit) On uGetFix
Step 2: Delete scheduled tasks that bring it back
Open Task Scheduler from the Start menu and click Task Scheduler Library. Select each task you do not recognise and read the Actions tab:
- a task that starts a file in
%AppData%or%Temp% - runs
powershellwith a long encoded line - opens a web address belongs to Trojan.BitCoinMiner or a similar program
Right-click such a task and choose Delete, and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
- a task that starts a file in
Step 3: Remove it from startup
Whatever Trojan.BitCoinMiner installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 4: Turn Microsoft Defender back on and remove its exclusions
Trojan.BitCoinMiner turns protection off or adds exclusions so that Defender ignores it. In Windows Security > Virus & threat protection, open Manage settings and switch Real-time protection, Cloud-delivered protection and Tamper Protection back on.
Then open Add or remove exclusions at the bottom of that page and remove whatever you did not add yourself, for example a folder in
%AppData%or an entire drive. These pages look the same in Windows 11 and Windows 10.Full procedure with screenshots: Turn off Microsoft Defender protection for a moment On uGetFix
Step 5: Delete the folders left behind
What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items), and go through
%LocalAppData%,%AppData%, %ProgramData% and the two Program Files folders.Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold
.exe,.dll, .js or .ps1 files are the strongest sign.Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 6: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Stream videos without limitations, no matter where you are
There are multiple parties that could find out almost anything about you by checking your online activity.
While this is highly unlikely, advertisers and tech companies are constantly tracking you online. The first step to privacy should be a secure browser that focuses on tracker reduction to a minimum.
Even if you employ a secure browser, you will not be able to access websites that are restricted due to local government laws or other reasons. In other words, you may not be able to stream Disney+ or US-based Netflix in some countries. To bypass these restrictions, you can employ a powerful VPN, which provides dedicated servers for torrenting and streaming, not slowing you down in the process.
Data backups are important - recover your lost files
Ransomware is one of the biggest threats to personal data.
Once it is executed on a machine, it launches a sophisticated encryption algorithm that locks all your files, although it does not destroy them. The most common misconception is that anti-malware software can return files to their previous states. This is not true, however, and data remains locked after the malicious payload is deleted.
While regular data backups are the only secure method to recover your files after a ransomware attack, tools such as can also be effective and restore at least some of your lost data.
Questions about Trojan.BitCoinMiner
What is Trojan.BitCoinMiner?
Trojan.BitCoinMiner is a detection name for malware belonging to the Bitcoin virus category, designed to abuse your computer's processing power for unauthorized cryptocurrency mining. These infections are programmed to utilize CPU or GPU to perform complex mathematical calculations that generate cryptocurrency, which is sent directly to cybercriminals' wallets.
While cryptocurrency mining itself is not inherently malicious, an application injected into your machine without permission is thoroughly malicious and must be terminated immediately. Upon infection, your system begins mining operations automatically, often starting as soon as you turn on your PC, forcing your hardware to work at maximum capacity.
How do I know if I have Trojan.BitCoinMiner?
Trojan.BitCoinMiner produces distinctive symptoms that indicate cryptocurrency mining malware presence. Your computer's fans run at full capacity continuously, and CPU usage jumps to 100% even when you're not running demanding applications. You'll notice significant performance degradation—simple tasks become extremely slow.
The system experiences frequent blue screen of death errors, software crashes, and your electricity bills spike noticeably due to excessive power consumption. Your security software will flag the detection as Trojan.BitCoinMiner or related variants like TROJ_DIGMINEIN.A or Trojan.GenericKD. However, if no security software is installed, these symptoms appear without alerting you to their malicious cause.
What cryptocurrencies can this trojan mine?
Although the detection name indicates Bitcoin, Trojan.BitCoinMiner can mine multiple types of cryptocurrency depending on the specific variant. The malware is capable of mining Bitcoin, Monero, Ethereum, Litecoin, and many others. Regardless of the currency type, all funds generated through these mining operations are delivered directly to the cybercriminals' hands—you receive nothing from the mining process.
The criminals simply program the trojan to mine whichever cryptocurrency is most profitable at the moment. Your computer bears all the costs through electricity bills and potential hardware damage, while the perpetrators collect all the rewards.
How did I get infected with Trojan.BitCoinMiner?
Trojan.BitCoinMiner typically arrives through common distribution methods targeting users seeking free software. Fake Flash Player update pop-ups claim your plugin is outdated and you need to install the newest version to view website content.
Pirated software installers are often believed to be working copies of legitimate applications like Adobe Acrobat, but the malicious executable actually launches malware in the background when executed. Bogus virus alerts falsely claim your computer is infected.
Fake email attachments pose as receipts, bank statements, or delivery notices. In all cases, users are tricked into installing what they believe is harmless software, but malware launches instead if you lack robust security protection.
What damage can Trojan.BitCoinMiner cause?
Beyond the obvious performance degradation, Trojan.BitCoinMiner causes multiple types of damage. Your hardware components suffer serious wear from continuous maximum-capacity operation, potentially causing permanent damage requiring replacement. There's a significant financial impact through elevated electricity bills from the mining operations running constantly.
The malware makes additional system changes that further degrade performance. Since trojans are often programmed to perform multiple tasks, other malware may be installed simultaneously, leading to banking credential exposure to malicious parties or identity theft. You need to fully remove all variants of this trojan and any associated malware it may have installed on your system.
Can manual removal work for Trojan.BitCoinMiner?
Manual elimination of Trojan.BitCoinMiner is extremely difficult because it establishes many new settings and imports a variety of malicious files throughout your system. The malware obfuscates its presence by hiding components under legitimate-sounding process names. Attempting manual removal risks missing essential components, leaving your system vulnerable to reinfection and further malware attacks.
The best approach is using reputable security software that performs a thorough scan and removes all traces completely. Professional antivirus programs can also repair system files and functions that the malware corrupted during its installation and operation, restoring your system's stability.
What happens after I remove Trojan.BitCoinMiner?
After successful removal and system cleaning with security software, you may need to repair damage the trojan caused to your operating system. The malware may have injected scripts, modified registry entries, and damaged various system files and functions. Recovery tools can repair corrupted registry entries, remove duplicate files, and eliminate other side effects caused by the virus infection.
Your system may still exhibit performance issues until these repairs are complete. Once the trojan is removed and repairs are finished, your CPU usage should return to normal levels, fans should operate at reasonable speeds, your software should stop crashing, and your electricity bills should return to typical amounts.
How do I prevent Trojan.BitCoinMiner infection?
Prevent infection by avoiding pirated software, torrent sites, and untrusted download sources where malicious installers are commonly distributed. Always download software from official developers' websites or verified legitimate distribution platforms.
Never trust unexpected update notifications—manually verify through official channels before installing updates. Be extremely suspicious of unsolicited email attachments and links, especially if they contain typos or appear from unknown senders. Never open email attachments from unfamiliar contacts without verification.
Maintain robust security software installed and updated at all times, performing regular system scans. Keep your operating system and all installed programs updated with the latest security patches to close vulnerabilities that malware exploits.
Will Fortect remove Trojan.BitCoinMiner?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Trojan.BitCoinMiner, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Wikipedia: Backdoor trojans (read October 7, 2026)
- CSOonline: What is cryptojacking? How to prevent, detect, and recover from it (read October 7, 2026)
- Virusai: Virusai (read October 7, 2026)
- FTC: How to recognize, remove and avoid malware (read October 7, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 7, 2026)