Trojan.Win64.Miner.gen: what it is and how to remove it
Trojan.Win64.Miner.gen is the name Kaspersky products give to a 64-bit Windows program that its rule judges to be a cryptocurrency miner; it is a label on a file, not a program you can uninstall. Find out which file it names and where it came from, then scan and remove only what you can show does not belong.
Facts checked October 14, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If a Kaspersky alert for Trojan.Win64.Miner.gen naming a 64-bit file keeps coming back after uninstalling, a scan can find what reinstalls it.
Do it yourself · free Remove Trojan.Win64.Miner.gen yourself 5 steps, about 15 minutes, no software needed.
Start the steps
Trojan.Win64.Miner.gen: summary
| Type | A Kaspersky detection name for a 64-bit Windows cryptocurrency miner (generic rule); not a program you can uninstall |
|---|---|
| Risk | Medium until you know which file it names: the case we could read began with a fake app that also changed DNS settings and brought a changed torrent client, and a harmless file can also be flagged |
| Symptoms | A slow, hot PC with high processor or graphics-card use when idle; security sites that will not open; unknown startup items, tasks or folders; sometimes only the alert |
| How to get rid of it | Find the flagged file's path and source; Defender full scan; Kaspersky Virus Removal Tool; Safe Mode and Microsoft Defender Offline scans; undo changes you can explain: tasks, folders, DNS settings, exclusions |
| Our check (6 October 2026) | No PC test: we read Kaspersky's press release and report on a 2021 miner campaign, Kaspersky's class page and a Microsoft 2026 report; no sample was run |
| First seen | Named by Kaspersky on 11 March 2021 for a fake-app miner campaign that began in 2020; our guide first appeared on 16 July 2021 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 7 more facts
| Detection | Kaspersky: Trojan.Win64.Miner.gen. In the 2021 campaign it came with Trojan.Win64.Patched.netyyk, Trojan.Win32.DNSChanger.aaox and HEUR:Trojan.Multi.Miner.gen. No Microsoft detection name is known for this Kaspersky name. Microsoft's 2026 report uses Trojan:MSIL/CoinMiner!MS for the miner of a different campaign |
|---|---|
| Not to be confused with | HEUR:Trojan.Win32.Miner.gen (32-bit) and Trojan.Win64.Miner.alve (another family member) |
| Name | Trojan.Win64.Miner.gen |
| Evidence | 0 write-ups by security sites; details still limited |
| Distribution | Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps |
| Damage | Installs other malware, often several programs at once |
| Facts checked | 6 October 2026 |
Facts checked on 6 October 2026 against Kaspersky's threat encyclopedia (which has no page of its own for this name), Kaspersky's Securelist article and press release of March 2021, a Microsoft Security Blog report of 26 May 2026, Kaspersky's Virus Removal Tool page and Microsoft's pages. We ran no sample and tested no PC; the checks and removal steps follow those pages and were not tried on a live infection.
What Trojan.Win64.Miner.gen is, and what it is not
Trojan.Win64.Miner.gen is the name Kaspersky products show when they judge a 64-bit Windows program to be a cryptocurrency miner. It is a label on a file, not a program you can uninstall, and the file behind it can differ from case to case.
- 1
What the name says
Read left to right, it gives a class (Trojan), a platform (Win64, a program for 64-bit Windows), a family (Miner) and a generic ending (gen, one rule that covers many samples). Kaspersky's own page for the Trojan class describes a program that spies on the user. Kaspersky's 2021 write-up of a miner campaign calls the same kind of file a Monero cryptocurrency miner. So the name points to mining, not to spying.
- 2
What a miner does to you
A miner uses your processor or graphics card to earn coins for someone else. You pay in power, heat and a slow PC. Mining itself does not take your money or files. The danger is how it arrived: in the cases we found, it came inside a fake program, and that fake program also changed settings or opened the PC to other software.
- 3
What the old guide got wrong
Our 2021 guide said the infection shows no symptoms and cannot be seen on the desktop or in any folder. A running miner does show: a busy processor, a hot PC and files in places such as the ProgramData folder and Task Scheduler. The old guide also tied the name to Djvu ransomware, and we found no source that does. We say in each chapter what changed.
- 4
What to do first
Write down the full path of the file that was flagged and the exact wording of the alert. A file with a random name in a temporary, AppData or ProgramData folder is a different case from a file inside a program you installed on purpose.
- Shown by
- Kaspersky products. Kaspersky's 2021 write-up lists it as one of four verdicts for a fake-installer miner campaign
- Class and platform
- Trojan on Win64: a program for 64-bit Windows
- Family
- Miner: software that uses the PC's processor or graphics card to generate cryptocurrency, in the cases we found Monero
- Is it a program?
- No. It is the label of a detection; the files can differ from case to case
- Kaspersky page for the name
- None found. Kaspersky's threat encyclopedia sends the name to its general Trojan class page
- Not the same as
- HEUR:Trojan.Win32.Miner.gen (a 32-bit name, as in the picture of our 2021 guide) and Trojan.Win64.Miner.alve (another family member)
Miner files from adult sites, and the name Trojan:Win64/HashVaultMiner.A
A file called a miner that came from an adult site is most likely a program you were tricked into running, such as a fake video player, a fake codec, a cracked tool or a forced download. This is our reading, not a finding from a named report. Delete nothing blindly: note the file's path and name first, then scan it as described in this guide.
Adult and pirate sites are a common place to meet this kind of download because they push fake update and player buttons. Do not run such a file again. If you already did, treat the PC as possibly infected: run a full Defender scan, then the offline scan, and check Task Manager for a process that keeps the processor or graphics card busy while you do nothing.
Trojan:Win64/HashVaultMiner.A looks like a Microsoft Defender style name for a 64-bit Windows miner, since the Trojan:Win64 prefix and the word Miner follow Microsoft's naming. We could not confirm it: Microsoft's malware encyclopedia returned no entry for this exact name on 14 October 2026, and we found no vendor write-up. Everything about this family is therefore unknown to us.
Do not treat that gap as a clean result. If Defender shows this name in Protection history, let it quarantine or remove the file, then run a full scan and an offline scan. The name is a label on a file, like Trojan.Win64.Miner.gen, so the steps in this guide for finding the source, undoing changes and changing passwords apply the same way.
What Trojan.Win64.Miner.gen does on an infected PC
How to read the name, and what else Kaspersky calls it
The old guide said you can see other detection names than this one. That is true, and in the one campaign we could read in detail, Kaspersky used four names for the parts of one attack.
| Part or name | What it means | Where the meaning comes from |
|---|---|---|
| Trojan | The behaviour class. The class page describes spying on the user; it is general and does not mention mining | Kaspersky threat page for the Trojan class |
| Win64 | A program built for 64-bit Windows | Our reading of the usual platform tag; the Kaspersky pages we reached do not define it |
| Miner | The family: a cryptocurrency miner | Kaspersky's March 2021 write-up on a Monero miner campaign |
| gen | A generic rule covering many samples, not one known file | Our reading of the usual naming; not defined on the pages we found |
| Trojan:MSIL/CoinMiner!MS | Microsoft's name for the mining program in its 2026 report: a .NET miner. A different campaign, not shown to be the same files as this Kaspersky name | Microsoft Security Blog, 26 May 2026 |
| Trojan.Win64.Patched.netyyk | Named for the same 2021 campaign: a patched program | Kaspersky, March 2021 |
| Trojan.Win32.DNSChanger.aaox | Named for the same campaign: a program that changes the DNS settings | Kaspersky, March 2021 |
| HEUR:Trojan.Multi.Miner.gen | Named for the same campaign: a miner found by Kaspersky's heuristic rules and not tied to one operating system | Kaspersky, March 2021 |
Search for the whole string you were shown. Trojan.Win64.Miner.gen, HEUR:Trojan.Win32.Miner.gen and Trojan.Win64.Miner.alve are three different names, and the answer for one is not always the answer for another.
What we checked on 6 October 2026, and what we could not
There is no website to test and no file to run, because a detection name is not a program. We read Kaspersky's pages, its 2021 campaign report, a Microsoft report of 2026 and Microsoft's own pages, and we ran nothing on a PC.
Our reading of the sources, 6 October 2026
- The name is a real vendor verdictKaspersky's press release of 11 March 2021 names Trojan.Win64.Miner.gen among the verdicts for fake apps that deliver a Monero miner.
- Miners that come inside fake programs are a current threatMicrosoft's security blog of 26 May 2026 describes lookalike download sites for system utilities that lead to a miner. It is a different campaign and is not tied to this name.
- A page for this exact nameNot found. Kaspersky's threat encyclopedia led to its general Trojan class page, which has no text about this detection, no sample hashes and no file names.
- What the name means on your PCNot settled by the name alone. We cannot say which file Kaspersky flagged in your case, or whether the verdict was right.
- One vendorA single product can be right, wrong or out of date. Compare it with other scanners before you delete a program.
- A quiet checkDoes not clear a PC. A miner can wait until you stop using the PC; Microsoft's 2026 report describes one that stopped mining when the user was active or the graphics card was busy.
Check the flagged file before you delete anything We saw nothing that clears this name and nothing that proves harm on your PC. Use the checks below: where the file sits, where it came from, whether other scanners agree and whether anything starts with Windows that you did not install. This is one reading of public sources on one day, not a scan of your PC.
The name from 2020 to 2026
Our guide dates from 16 July 2021. Its two pictures are Kaspersky notification windows; the other entries come from vendor reports.
26 June 2020
A Kaspersky quarantine list of a miner case
The older of our two pictures shows a Kaspersky Total Security notification for Trojan.Win64.Miner.alve and a quarantine list dated 6/26/2020 with entries such as Trojan.Multi.GenAutorun and HEUR:Backdoor.Win64. Files in a folder under Windows\System32 are listed. The quarantine list shows several families at once, which is why a miner alert should make you look at the whole PC and not one file.
A picture from our 2021 guide: two Kaspersky Total Security windows. They name Trojan.Win64.Miner.alve, not the .gen name of this guide. The person is a stock photo and shows nothing about the detection. August 2020 to February 2021
Fake apps deliver a Monero miner
Kaspersky wrote that it saw a surge in fake applications that deliver a Monero miner, passed on by malicious websites that can turn up in search results. By early February 2021 its data showed attempts to install the fake apps on the devices of 21,141 users, with more than 2,500 users a day at the peak, most of them in Russia and CIS countries.
14 February 2021
A miner alert in a picture of our guide
The second picture shows an alert window dated 14/02/2021 headed Trojan:Win64/Miner, with the status Quarantined, beside a Kaspersky Notification Center that lists HEUR:Trojan.Win32.Miner.gen for a file in System32 and adware warnings for downloaded installer files. It shows that a miner alert often comes with other warnings from the same download.
The cover picture of our 2021 guide. Neither window shows the exact name Trojan.Win64.Miner.gen: the black window reads Trojan:Win64/Miner and the Kaspersky window reads HEUR:Trojan.Win32.Miner.gen. 11 March 2021
Kaspersky names Trojan.Win64.Miner.gen in a press release
Kaspersky's press release listed four verdicts for the fake ad blocker and DNS installers: Trojan.Win64.Patched.netyyk, Trojan.Win32.DNSChanger.aaox, Trojan.Win64.Miner.gen and HEUR:Trojan.Multi.Miner.gen. The mining program itself was the open-source XMRig.
16 July 2021
Our first guide
The 2021 guide called the name a trojan that mines cryptocurrency in the background and recommended an anti-malware tool plus Safe Mode with Networking. We have kept the Safe Mode scan, corrected the claims that nothing can be seen and rewritten the removal for Windows 11 and 10.
26 May 2026
Microsoft describes a different miner chain
Microsoft Defender Experts wrote about lookalike download sites for utilities such as CrystalDiskInfo and HWMonitor, reached through search results and AI chatbot answers, which delivered a real program with a malicious DLL, then remote access software and a miner. It is the closest current picture of how a miner is installed, though no source ties it to this Kaspersky name.
Across the years the name is a vendor verdict on a miner. Every case we could read began with a program the user chose to download and run.
What Trojan.Win64.Miner.gen can steal or download
What it can cost you
The old guide said the trojan can damage the machine, load other malware and steal accounts. Some of that fits a miner that came with other programs, and some does not. Each item says what supports it.
- Medium
Your processor or graphics card works for someone else
That is what the Miner family does. You see a slow, hot, noisy PC and a larger power bill, and the PC wears faster under constant load.
- High
Other software on the same PC
In the cases we found the miner was not alone. The 2021 installer changed the DNS settings and fetched a changed torrent client, and the 2026 Microsoft case added remote access software. The old guide's point that a trojan can open the way for other malware fits these cases.
- Medium
Antivirus sites you cannot reach
When DNS settings are changed, some security sites fail to open. Kaspersky's report named Malwarebytes.com. If your security tool cannot update or a security site will not open, check the DNS settings before you decide the PC is clean.
- Medium
Security tools switched off for the miner
Microsoft's 2026 miner added Windows Defender exclusions and re-applied them every five seconds. An exclusion you did not make is a sign of tampering.
- Low
Ransomware
The old guide named Djvu ransomware. We found no source that ties this name to any ransomware. Any malware on a PC with weak protection is a risk, and that is why the checks come before the clean-up.
- Low
Stolen passwords and money
A miner does not need them, and Kaspersky's report on the 2021 campaign does not mention theft. If remote access software is on the PC, someone could reach your accounts, so the chapter on accounts applies.
- Low
Damage to the registry, boot files and system files
The old guide listed these. No source for this name describes them. What the sources do describe is startup entries, scheduled tasks and added folders, which you can look at yourself.
- Low
A false alarm costing you time
If the verdict is wrong, you lose the hours you spend and a quarantined file that your program may need.
What you may notice, and what the sources show
The old guide said the infection shows no symptoms. A miner is meant to be quiet, but it cannot hide its load, so we list what to look at and when.
| Sign | What we found |
|---|---|
| The alert itself, with the full name | Often the first sign. It is the only sign that the old guide's "no symptoms" wording fits. |
| High processor or graphics-card use when you are idle | The sign a miner is meant to cause. Open Task Manager when the PC has been idle. Microsoft's 2026 miner stopped mining when the user was active, so watch while you do nothing. |
| A fan that runs hard and a hot laptop | Follows from heavy use of the hardware. Games and updates cause it too. |
| A slow PC and random programs running | The old guide's wording. It fits, but has many harmless causes. |
| A security site that will not open or a tool that cannot update | In the 2021 campaign the changed DNS settings did this. |
| Scheduled tasks, startup items or folders you did not create | Both reports describe them. See the checks below. |
| A Defender exclusion you did not add | The 2026 miner added them. Check Windows Security. |
| No sign at all | Does not clear a PC, and does not prove an infection either. |
How to check the PC for Trojan.Win64.Miner.gen
How it gets onto a PC: what our old guide said and what the sources show
The old guide listed pirated software, game cracks, spam attachments and careless browsing. The only route with a source behind this name is a fake app found on a malicious website. The table says what supports each claim.
| The old guide said | What the sources show |
|---|---|
| It spreads via pirated applications and cracked games | Not shown for this name. Kaspersky's 2021 report and Microsoft's 2026 report both describe fake versions of ordinary programs, which is the same idea: the file you run is not what it says. We have no source that names cracks for this name. |
| Malicious files come from malspam email attachments | Not shown for this name. In Kaspersky's report the fake apps were found on malicious websites that turn up in search results. |
| Email campaigns pose as messages from a known company | Common for trojans in general, not mentioned in the sources about this name. |
| Clicking the email, downloading the file or opening a link gives you the malicious file without knowing | Not shown for this name. In both reports the user started the installer. |
| The machine is infected in a matter of minutes | No source gives a time. In the 2021 case the installer changed DNS settings at once and then a scheduled task kept the miner running. |
| Trojans act unnoticed and delete themselves | Not for a miner: it has to stay on the PC to earn anything, and both reports describe files and tasks that remain. |
| People get it when they surf without paying attention | Partly right: both reports begin with a search result and a download button. |
- 1
What this means for you
Ask where the flagged file came from. A free ad blocker, a DNS or antivirus utility, a system tool or a program from a search result you did not check are the routes with a source behind them. A file from a maker you trust points the other way.
What a real case looked like: Kaspersky's 2021 fake ad blocker
This is the case behind the Kaspersky press release that names Trojan.Win64.Miner.gen. It is about one campaign, so read it as a list of places to look and not as what every alert means. We print no server address or hash from it.
- 1
A fake app on a website
Kaspersky found fake versions of the ad blockers AdShield and Netshield and of the OpenDNS service, copied from mobile apps and offered on malicious websites that can turn up in search results. The same scheme followed a summer 2020 campaign that used a fake Malwarebytes installer.
- 2
The DNS settings are changed
After the user started the program it changed the DNS settings so that all domains were resolved through the attackers' servers. That stopped the user from reaching some antivirus sites, such as Malwarebytes.com. This is why the old guide's remark that the infection can block security tools was right for this case.
- 3
A changed torrent client brings the miner
The updater downloaded and ran a modified version of the Transmission torrent client, which reported the installation and fetched a mining module. The module was built for each machine so that it would not run on a security researcher's analysis system.
- 4
The miner hides inside find.exe
The mining module held the open-source XMRig miner. It ran the miner inside a process that looked like the Windows program find.exe, which is why the process list can show an ordinary name.
- 5
A task keeps it running
A scheduled task named servicecheck followed by random numbers started the module again, so the miner returned after a restart.
| Where to look | What Kaspersky found in this campaign |
|---|---|
| Installed apps | AdShield, NetshieldKit or an OpenDNS program you did not choose; a Transmission torrent client you did not install |
| Folders | A folder named Flock under C:\ProgramData, and folders named flock and flock2 in the all-users Startup folder |
| Task Scheduler | A task whose name begins servicecheck_ and ends in random numbers |
| Network settings | DNS server addresses you did not enter |
| Processes | A find.exe that uses the processor, or a flock.exe |
Check the file and the PC before you delete anything
Write down exactly what the alert says and which file it names before you click Delete. Then look for what could start a miner again. We did not run these checks on an infected PC; they use the Windows tools named in each step.
- 1
Copy the alert
Take a screenshot. Note the full name, the product and its version, the date and the full path of the file.
- 2
Where is the file?
A file inside a program you installed on purpose is a candidate for a false positive. A file with a random name in a temporary folder, in AppData or ProgramData, in a Startup folder, or a program with a Windows-like name that sits outside C:\Windows, is more worrying.
- 3
Where did it come from?
Think about the last downloads. A free ad blocker, an antivirus or DNS tool, a system utility, a crack or a cheat are the routes with a source behind them.
- 4
Ask more scanners about the same file
Upload the file, or only its hash, to VirusTotal. A file that many engines call a miner is a different case from one that only one product flags. Do not upload files with private contents.
- 5
Look at the load
Press Ctrl + Shift + Esc, open Processes and Performance, sort by CPU and GPU, and look when you are not using the PC. A program you do not know that keeps the processor busy is the thing to find.
- 6
Look at what starts with Windows
In Task Manager open Startup apps. Open Task Scheduler and look at tasks you do not recognise, such as a name that begins servicecheck_ or one that imitates Windows. Microsoft's Autoruns tool lists more places.
- 7
Look at the folders
In File Explorer open C:\ProgramData and the Startup folder for all users (type shell:common startup in the address bar). Hidden folders may need View > Show > Hidden items. A folder you do not know, such as Flock in the 2021 case, is a reason to go on to the removal chapter.
- 8
Look at the DNS settings
Open Settings > Network & internet, choose your Wi-Fi or Ethernet connection, then its Hardware properties and the DNS server assignment. If you did not set manual servers, the setting should be Automatic (DHCP). Addresses you did not enter are a warning sign. The menu names are those of Windows 11 and may differ slightly in Windows 10.
- 9
Look at your Defender exclusions and installed apps
Open Windows Security > Virus & threat protection > Manage settings > Add or remove exclusions. Then open Settings > Apps > Installed apps and look for an ad blocker, DNS tool, torrent client or remote access program that you did not install.
- 10
Scan twice
Scan with Microsoft Defender and with a second on-demand scanner and compare the names. If only the product that gave this name reports it, update it first and scan again.
How to remove Trojan.Win64.Miner.gen
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Delete scheduled tasks that bring it back
Open Task Scheduler from the Start menu and click Task Scheduler Library. Select each task you do not recognise and read the Actions tab:
- a task that starts a file in
%AppData%or%Temp% - runs
powershellwith a long encoded line - opens a web address belongs to Trojan.Win64.Miner.gen or a similar program
Right-click such a task and choose Delete, and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
- a task that starts a file in
Step 2: Remove it from startup
Whatever Trojan.Win64.Miner.gen installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items), and go through
%LocalAppData%,%AppData%, %ProgramData% and the two Program Files folders.Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold
.exe,.dll, .js or .ps1 files are the strongest sign.Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Assume that the passwords saved in this PC's browsers, and the accounts that were open in them, are known to the attacker. From a phone or a clean computer, change the e-mail password first, then banking, shopping, social and gaming accounts.
Use each service's option to sign out of all other sessions, because stolen cookies keep a session open even after a password change. Turn on two-step verification on each account. Wait with the infected Windows 11 or Windows 10 PC until the scans are clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Remove it from Windows 11 and Windows 10
The old guide said to boot in Safe Mode with Networking, update an antivirus and run a full scan. We keep that, add the checks above and an offline scan, and leave out the repair-tool walkthrough. The steps follow Microsoft's and Kaspersky's pages; we did not run them against a live infection.
- 1
Decide first whether it is a false alarm
If the file sits in a program you trust, VirusTotal shows no agreement and the checks above found nothing, do not delete the program. Go to the chapter on false alarms. Otherwise go on.
- 2
Disconnect and back up documents
If you think remote access software is on the PC, turn off Wi-Fi or unplug the cable. Copy documents and photos, not programs, to an external drive that you unplug afterwards.
- 3
Run a full scan with Microsoft Defender
In Windows Security > Virus & threat protection > Scan options choose Full scan and Scan now.
- 4
Scan memory and startup objects with a second tool
Kaspersky says its Virus Removal Tool is a free on-demand tool that needs no installation, can run alongside your own security product and lets you choose scan areas that include system memory and startup objects. Download it from Kaspersky's own page.
- 5
Start in Safe Mode with Networking
Windows 11: open Settings > System > Recovery, next to Advanced startup select Restart now. Windows 10: Settings > Update & Security > Recovery > Restart now. Or hold Shift and select Power > Restart. Then choose Troubleshoot > Advanced options > Startup Settings > Restart and press 5 for Safe Mode with Networking. Microsoft says Safe Mode starts Windows in a basic state with a limited set of files and drivers. If the drive uses BitLocker you will need the recovery key. In Safe Mode update your security product, run a full scan, then restart normally.
- 1
Run Microsoft Defender Offline
In Windows Security > Virus & threat protection > Scan options choose Microsoft Defender Offline scan and Scan now. Microsoft says it runs from outside the normal Windows kernel, takes about 15 minutes and restarts the PC. It does not apply to Windows Server editions or ARM PCs, and with BitLocker you should suspend protection first. Review the result under Protection history.
- 2
Undo what the campaign changed
If the checks found it, uninstall the fake ad blocker or DNS program and a torrent client you did not install from Installed apps, delete the folders and the servicecheck task Kaspersky names, and set the DNS assignment back to Automatic (DHCP). Delete a task, a Startup shortcut or a folder only when you have confirmed that it belongs to the miner and not to a program you installed. Write down what you removed.
- 3
Remove Defender exclusions and remote access programs you did not add
Remove any exclusion you did not add in Add or remove exclusions, and uninstall a remote access program you did not install.
- 4
Quarantine only what you cannot account for
If scans agree that a file is harmful, let the product quarantine it, and delete it later. Quarantine can be undone, deleting cannot.
- 5
Last resort: reset Windows
If the PC is still wrong after all this, back up documents, then use Settings > System > Recovery > Reset this PC and choose Remove everything, or reinstall from a USB installer. Restore documents only, no programs and no full system image.
Never install a repair or optimizer tool because an alert or a stranger tells you to. The old guide's walkthrough of a PC repair program is gone from this page: a registry repair tool is not a malware remover, and a reset is the answer for a PC you can no longer trust.
Could it be a false alarm?
It can be, because a generic rule is a guess about many files. The old guide did not say so. We found no case of a false alarm for this exact name, so use the table to decide how careful to be and do not treat it as a test.
| Points to a real infection | Points to a false positive |
|---|---|
| The file has a random name and sits in AppData, ProgramData, a temporary folder or a Startup folder | The file is part of a program you installed on purpose, from its maker or a known download site |
| You downloaded a free ad blocker, antivirus or DNS tool, a crack, a cheat or a utility from a search result | The download came from the maker's own site and the maker answers questions about it |
| Many engines on VirusTotal call it a miner or a trojan | Most engines find nothing and only one product reports it |
| The PC is slow and hot when idle, or Task Manager shows a program you do not know using the processor or graphics card | Nothing is slow, hot or odd |
| Tasks, startup items, DNS settings or Defender exclusions you did not make; a program you did not install | All those lists hold only things you know |
- 1
Update the product and scan again
Make sure the security databases are up to date, then scan the same file again. Old versions report names that newer ones no longer do.
- 2
Report a wrong verdict
Use the vendor's own form for a false positive and send the file or its hash.
- 3
Do not turn off protection
Do not switch off your security product or exclude a whole folder to stop the alert. Exclude one file only when the maker and VirusTotal back it and you accept the risk.
- 4
Do not act on pop-ups
A pop-up in a browser that says your PC has this infection and tells you to call or buy something is a scam. A detection name is shown by your own security product, not by a web page.
After removal: passwords, accounts and prevention
Accounts come next
Because the PC showed A Kaspersky alert for Trojan.Win64.Miner.gen naming a 64-bit file in the list of installed apps, a sign of a program that could read browser data, the clean-up is only half of the work. The other half happens in your online accounts.
Change passwords from a clean device, beginning with e-mail; sign out of all sessions; check forwarding rules and recovery phone numbers; and turn on two-step verification with an authenticator app or a passkey. Ask your bank to replace cards saved in the browser.
Why the order matters and what to check in each account: secure your accounts after malware.
If it was real: what to do about your accounts
A miner itself does not need your passwords, but whatever came with it might have exposed them, and the old guide said to take the damage seriously. Start from another device.
- 1
Change passwords from another device
Email first, then banking, then everything else. Turn on two-step sign-in.
- 2
Sign out everywhere
Use the sign out of all sessions option in your Google, Microsoft and social accounts so stolen cookies stop working.
- 3
Check your money
Look at card statements and any wallets for payments you did not make.
- 4
Tell the right people
At work, tell your security team and your manager. At home, report the incident to your national cybercrime reporting service or the police if money or accounts were lost. We list no agencies, because contact links differ by country and we have not checked them all.
- 5
Scan again in a week
A clean scan today does not clear code that hides. Run a full scan and a Defender Offline scan a week later, and check Task Scheduler, the DNS settings and your Defender exclusions again.
Keep miners off your PC
The old guide said to be careful online and to keep the machine safe with security tools. Both reports show where the care matters: the download.
Do
- Download ad blockers, DNS tools and system utilities only from the maker's own site, typed or bookmarked, and not from a search result, an ad or a chatbot answer.
- Keep one security product with Real-time protection on. Microsoft Defender is built into Windows 11 and 10; turn on Cloud-delivered protection.
- Install Windows Update monthly, and update browsers and other programs.
- Open email attachments only when you expected them, and read a link before you click it, especially mail that says it comes from a known company.
- Use a standard account for daily work and keep the administrator account for changes.
- Use a different password for every account and a password manager, and turn on two-step sign-in.
- Keep a backup of documents on a disk you unplug (File History or OneDrive), so a bad infection costs you a reinstall and not your files.
Don't
- Do not run cracks, cheats, keygens or files from torrent sites.
- Do not install a program that promises to block ads or protect you because a web page or a pop-up said so.
- Do not install a remote access program because someone on a call or a web page asks you to.
- Do not add Defender exclusions that a download tells you to add.
- Do not install a repair tool or a second antivirus because a pop-up said your PC is infected.
Questions about Trojan.Win64.Miner.gen
What is Trojan.Win64.Miner.gen?
It is the name Kaspersky products show when they judge a 64-bit Windows program to be a cryptocurrency miner. Kaspersky's March 2021 press release names it as one of four verdicts for fake ad blocker and DNS apps that delivered a Monero miner.
The name is a label on a file, not a program you can uninstall, and the word gen means a generic rule that covers many samples.
It tells you what Kaspersky's rule thought of a file, not what the file did on your PC. To find out, check which file was flagged, where it came from and whether other scanners agree.
Is Trojan.Win64.Miner.gen dangerous?
It can be, and it is more than a slow PC. A miner uses your processor or graphics card for someone else's profit, which costs power, heat and speed. In the case Kaspersky described, the fake app also changed the DNS settings, which kept the user away from some antivirus sites, and fetched a changed torrent client.
That is why the other software on the PC matters as much as the miner. A flagged file can also be a false alarm, so check the file's path and source before you delete anything, then scan.
How do I remove Trojan.Win64.Miner.gen?
Check first, then scan. Find the path of the flagged file and decide whether it is a program you installed on purpose. Run a full Microsoft Defender scan, scan memory and startup objects with Kaspersky Virus Removal Tool, boot into Safe Mode with Networking and run Microsoft Defender Offline.
Then remove only the tasks, folders, DNS settings, exclusions and programs you can show do not belong. Let your product quarantine files that scans agree on. If the PC is still not right, back up documents and reset Windows with Remove everything.
Is Trojan.Win64.Miner.gen a false positive?
It can be, because a generic rule is a guess about many files, but we found no case for this exact name that was shown to be wrong. Treat the alert as real until you have checked the file.
A file with a random name in AppData, ProgramData or a Startup folder, found by many engines on VirusTotal, is probably real. A file inside a program you installed from its maker, flagged only by one product, may be a false alarm. If you think it is wrong, update the product, scan again and report the file to the vendor.
How did Trojan.Win64.Miner.gen get on my PC?
The sources we found point to a download you chose to run. Kaspersky's 2021 report describes fake ad blocker and DNS apps offered on malicious websites that turn up in search results, and Microsoft's 2026 report describes lookalike sites for system utilities reached through search results and AI chatbot answers.
Our 2021 guide named cracked games, pirated programs and spam attachments, which are general routes for trojans, and we have no source that ties them to this name. Think about your last downloads, and get programs only from the maker's own site.
How do I know if a miner is really running?
Look at the load when you are not using the PC. Open Task Manager with Ctrl + Shift + Esc, sort Processes by CPU and GPU and look for a program you do not know that keeps the hardware busy.
Microsoft's 2026 report says its miner stopped mining when the user was active, so a PC that is calm while you work can still be affected.
Also check Task Scheduler, Startup apps, the ProgramData folder, your DNS settings, the Defender exclusions and the installed apps. None of these alone proves a miner, and none being odd does not clear the PC.
Can Trojan.Win64.Miner.gen lead to ransomware such as Djvu?
We found no source that ties this name to Djvu or any ransomware. Our 2021 guide said miners are often the vector for Djvu, and we have corrected that. What is true is that a miner can come with other programs, as in the 2021 campaign, and in Microsoft's 2026 case the miner arrived together with remote access software.
Any such access could be used for worse things later. That is a reason to check the whole PC, keep a backup on a disk you unplug, and not to ignore the alert because the PC still works.
Do I have to use Safe Mode, and does F8 still work?
Safe Mode is useful when malware blocks your security tool, but you do not always need it. Run the Defender full scan and the Kaspersky tool first.
If a program will not open or a scan will not finish, start in Safe Mode with Networking. The old advice to press F8 while the PC starts no longer fits:
- Microsoft's page for Windows 11 and 10 uses the Windows recovery environment
- reached from Settings
- by holding Shift while you choose Restart
In Startup Settings press 5. With BitLocker you will need your recovery key.
Why can't I open Malwarebytes or other antivirus sites?
A changed DNS setting is one possible cause. In Kaspersky's 2021 campaign the fake app changed the DNS settings so that all domains were resolved through the attackers' servers, and that stopped the user from reaching some antivirus sites, such as Malwarebytes.com.
Check Settings, Network and internet, your connection, Hardware properties and DNS server assignment. If you did not set servers by hand, choose Automatic (DHCP) and restart the browser. Other causes exist, such as a network or browser problem, so this is a check and not proof of an infection.
Will Fortect remove Trojan.Win64.Miner.gen?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Trojan.Win64.Miner.gen, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Kaspersky Threats: Trojan (class page reached for Trojan.Win64.Miner.gen) (read October 6, 2026)
- Kaspersky Securelist: Ad blocker with miner included (March 2021) (read October 6, 2026)
- Global Security Mag, Kaspersky press release: Over 20,000 users in less than two months: Monero cryptominers on the rise (11 March 2021) (read October 6, 2026)
- Microsoft Security Blog: From poisoned search results to GPU mining (26 May 2026) (read October 6, 2026)
- Kaspersky: Free Virus Removal Tool (read October 6, 2026)
- Microsoft Support: Windows startup settings (Safe Mode) (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline scan in Windows (read October 6, 2026)
- Microsoft Security Intelligence: malware encyclopedia (no entry found for Trojan:Win64/HashVaultMiner.A, read 14 October (read October 14, 2026)