Severity scale:  
  (45/100)

Win32.CoinMiner. How to remove? (Uninstall guide)

removal by Linas Kiguolis - -   Also known as CoinMiner | Type: Malware

CoinMiner virus – dangerous trojan horse which is still actively infecting PC systems

CoinMiner!Bit is used to mine crypto

CoinMiner is a deceptive virus which has been actively used to mine Bitcoin or other cryptocurrency. Typically, miner enters systems without users' direct consent under or approval by disguising itself as other program. The main problem caused by this threat is a serious drop in your Internet speed. You can start noticing browser crashes and similar problems when infected with CoinMiner which has already been wandering on the Internet since 2011.

Name CoinMiner
Type of malware Trojan
Symptoms High CPU usage, Internet speed reduction, crashes, freezes, unresponsive apps, etc.
AV detection coinminer!bit, trojan:win32/coinminer!bit, win32/coinminer!bit
Danger level Medium. Diminishes PC's performance, can cause crashes. Trojans can also try to steal personal information
Distribution Bundling. Usually mimic web browser's extensions
Elimination The only way to get rid of a Trojan is to run a scan with Reimage or other reliable anti-malware

Fortunately, trojan can be detected with the help of majority security applications, including Windows Defender.[1] Typically, it is reported as coinminer!bit, trojan:win32/coinminer!bit or win32/coinminer!bit. If this malware happens to infiltrate your operating system, it should be blocked within seconds. However, outdated security tool may fail to recognize and neutralize it. 

Since its appearance of the original version, malware has showed up under different versions. Here are just a few of them[2]

  • Win32/CoinMiner.EE
  • Win32/CoinMiner.DV
  • Win32/CoinMiner.BB

The miner might also execute cgminer.exe[3] command on the system. Though the miner does not leave any visible traces on the PC desktop, you can suspect its presence when the device starts underperforming. System programs may start lagging to open or become non-responsive. You might also detect CoinMiner Trojan task in the Task Manager. At times, it will use more than 40% of CPU energy resources. 

CoinMiner Trojan virus
CoinMiner Trojan virus causes system's slowdowns and high CPU usage.

Certainly, slow computer system is one of the main issues related to cryptocurrency miners. To improve your computer's functionality and start using it as previously, you need to remove CoinMiner virus without wasting your system's resources. If you want to make sure that this threat doesn't hide on your computer anymore, you can rely on third-party utilities, such Reimage or Plumbytes Anti-MalwareMalwarebytes Malwarebytes, that are able to help you with CoinMiner removal as well. Besides, if you are interested how did it get into your Windows, please, keep reading.

Miners – under the cover of browser extensions

Mining cryptocurrency is a new wave among malware developers. Discovered ample browser plug-ins in Chrome Web store, apps in Google Play and Apple stores prove such statement.[4] Fortunately, you may ward off such unwanted software by using specific anti-coin-mining browser add-ons. However, choose wisely before installing one. 

Furthermore, if you update your anti-virus tool, it will be also able to block such infection. Since some hackers are shifting their focus on crypto-currency miners rather than ordinary malware, it would be a fatal mistake to disregard the possibility that such miners might be delivered alongside ransomware – to double perpetrator's profits.

Therefore, it is of utmost importance to keep your system updated. In addition, pay attention to what and where you download new apps from. Note that free sound editing utilities, media players, and file converters often bear unwanted attachments under “Recommended” or even “Custom” settings. Inspect the stages of installation stages before hitting the “Install” button. 

Coinminer!bit removal steps

Updated anti-virus utility will block the threat before it settles on the system, so make sure you install reliable security software before it get onto your computer without your approval and starts mining cryptocurrency for your money. According to some users[5], Windows Defender and another third-party software did not help them remove CoinMiner virus. In that case, you may run the scan with Reimage, Malwarebytes MalwarebytesCombo Cleaner, Plumbytes Anti-MalwareMalwarebytes Malwarebytes or similar malware elimination program.

In case the crypto-coin miner infiltrated your PC system together with another trojan or backdoor, restart the computer in Safe Mode and run a full scan with your anti-virus to find hidden trojan components. Then, make sure you repeat this procedure in normal mode as well. These steps should complete CoinMiner removal:

 

 

Offer
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to remove virus damage. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manual removal instructions below.
Alternative Software
Different security software includes different virus database. If you didn’t succeed in finding malware with Reimage, try running alternative scan with Malwarebytes.
Alternative Software
Different security software includes different virus database. If you didn’t succeed in finding malware with Reimage, try running alternative scan with Combo Cleaner.

Win32.CoinMiner manual removal:

Kill processes:
%TEMP%bitcoin-miner.exe

Delete files:
%TEMP%bitcoin-miner.exe

%TEMP%taskmgr.exe

%TEMP%svchost.exe

Delete directories:
%WINDIR%ufa

%WINDIR%rpcminer

%WINDIR%phoenix

%APPDATA%WhileIdle

To remove Win32.CoinMiner, follow these steps:

Remove Win32.CoinMiner using Safe Mode with Networking

Follow a guide below to disable this Trojan horse and launch anti-spyware for its removal:

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove Win32.CoinMiner

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Win32.CoinMiner removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Win32.CoinMiner and other ransomwares, use a reputable anti-spyware, such as Reimage, Malwarebytes MalwarebytesCombo Cleaner or Plumbytes Anti-MalwareMalwarebytes Malwarebytes

About the author

Linas Kiguolis
Linas Kiguolis - Expert in social media

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Linas Kiguolis
About the company Esolutions

References

Removal guides in other languages