Home > Trojan > Coin Miner Virus

Coin Miner threats are shaping up to be the next big trend that is not likely to dissappear anytime soon. One such malware is the latest discovered BitCoinminer.sx which was very similar to the Adylkuzz Trojan horse based on the code it uses.

malware miners imageThis article has been made in order to help you in detecting and removing the new Coin Mining malware threats from your computer and protect it against future infections as well.

Many new such viruses have also appeared, using JavaScript code that is embedded on suspicious websites or in programs and this code begins to mine for cryptocurrencies, the most often targeted of which are BitCoin and Monero as well as other cryptocurrencies.

The end goal is to use your GPU and CPU power to generate tokens for the cryptocurrency wallet of the cyber-criminals and the outcome of this is not good, since your PC slows down, freezes and may even crash at some point.

Thus, if you believe that your computer has been infected by a such a file, we recommend you to learn more about those threats and how to detect and remove them, preferably by reading the following article.

Threat Summary

Name Coin Miner Viruses
Type Cryptocurrency Token Mining malware / Trojan
Short Description Aims to affect your computer system and use it’s CPU and GPU resources in order to mine for the cryptocurrency tokens.
Symptoms High CPU and GPU utilization plus your PC may overheat, slow down and even break down.
Distribution Method Via fake installers, fraudulent processes as well as malicious sites and e-mail attachments.
Detection Tool See If Your System Has Been Affected by malware


Malware Removal Tool

User Experience Join Our Forum to Discuss Coin Miner Viruses.

How Do Coin Miner Viruses Infect Victims

Such infections have continued to evolve adding new technologies to them that enable them to not only act as a Worm to infect as many devices as possible, but also to use the infected machine to it’s full extent and clear example for that is the WannaMine Cryptoworm infection, imitating the notorious WannaCry ransomware. Besides this the usage of JavaScript has further evolved and become more sophisticated with RAT features in some infections, like the Webmine.pro JavaScript viruses.

Additionally, these threats have begin to imimtate system processes very well.

There may be more than one possible method of infecting computers with such threats. The most often used methods are intermediary files, such as Trojans, Injectors, Worms, malicious JavaScript and several others. These malicious files or code may infect a given victim PC via several different ways, the main of which often turn out to be:

  • Malicious web links that are posted as spam messages online.
  • Via web links that can exist in various different types of forms, form the likes of fake buttons, changed banners on sites or if you already have a PUP installed on your device.
  • If you have opened a malicious e-mail which contains a convincing message and a malicious attachment.

The infection files themselves may have embedded exploits or other methods that allow them to be activated in an obfuscated manner while being undetected on the computers of victims. Such files may also be concealed as fake setups, key generators or other types unwanted types of files that exist on the victim’s machine.

Coin Mining Infections – More Information

threats out there. Most of them have resembled the code of different Trojan horses, but newer hazards emerged that also use already known cryptocurrency algorithms, such as Cryptonight or Coinhive, embedded as few lines of JavaScript code uploaded on various websites. So here are some of the most notorious dangerous software that are known out there:

Upup.exe Miner

This threat has the one and the only purpose to use the CPU and GPU resources of your device via its fake Upup.exe process, which it runs as a trusted process in the background of your device via your Windows Task Manager. The infection also aims to modify the Windows Registry Sub-keys and keys in order to automatically run, even if you stop the process and the real upup.exe process is concealed somewhere in the Windows system folder or other system directories of your OS.

The software was reported to even possibly have other capabilities, such as self-update silently to remain undetected for as long as possible on your machine and in addition, to this install other infections plus such threats on your infected PC. Below, you can find more information about Upup.exe.

Upup.exe – How to Detect and Remove from Your PC

Service.exe Miner

This malicious Windows process is of origins that are not well documented and established, but it is known for sure that it uses a fraudulent service.exe process that acts as a system file in Windows. This file has the purpose to perform it’s operation silently while taking a vast amount of your CPU and GPU resources.

The infections was also reported to be spread via multiple different channels, including large e-mail spam campaigns. Similar to the Upup.exe, it also has Trojan Horse capabilities, suggesting that the two viruses may be of the same family.

Service.exe Miner – How to Remove It Completely

WDF.EXE Trojan Horse

Yet another malicious file that has recently been detected to use the WDF.EXE after it creates a folder, named “wdf” in the %Windows% directory. The virus installs silently on the victims computers and it has also been reported to drop two other malicious files on the computers, infected by it that are named:

  • NvProfileUpdater64.exe
  • Taskmon.exe

More information about the WDF.EXE Coin minining can be found below:

WDF.EXE – How to Remove It

Svchost.exe.exe (SearchGo) Coin Mining Trojan

This malware, rather recent has been reported to likely spread via a malicious e-mail attachment, which causes the initial infection via obfuscator. Then a file is created in the %Microsoft% directory, named svchost.exe.exe. This file is reported to begin performing various different types of processes, such as inject a malicious script in the legitimate Svchost.exe process, whch is responsible for hosting the system services in Windows.

Ultimately, this results in the fake file Svchost.exe.exe being launched from the SYSTEM user name, making it appear legitimate when you open Windows Task Manager, but it can be recognized by the double .exe.exe extension. Below, you can find more information plus removal for this suspicious process:

Svchost.exe.exe (SearchGo) Moner Trojan – How to Remove It

Wuapp.exe Monero Coin Mining Malware

Wuapp was detected back in the middle of December 2017 and its primary goal on the victim computers was to drop multiple executable files of various processes, then modify the Windows Registry Editor, which results in the legitimate process Windows Update Service (wuapp.exe) to run in the background of the infected device. The miner does not just run, however. It is embedded with the following script:

→ wuapp.exe –o pool.minexmr.com:4444 –u {wallet of the hacker} –p x –v 0 –t 2

The script itself makes it possible for the malware to to begin performing various different activities on the victim’s machine, including the begging of a miner operation via the port 4444 on the victim’s PC and this results in heavy loading of the CPU and GPU on the victim’s PC, primarily the GPU usage. More information is available on the related link below:

Wuapp.exe Monero Mining Virus – How to Remove It

Android Coin Miner Virus

What appears to be the first Coin miner that is oriented towards Android devices is already a fact. The virus has 3 different variations and it spreads via fake apps, like the Recitamo Santo Rosario app or the SafetyNet Wireless App. Those apps, contain a Coinhive JavaScript code which links your accunt to a Coinhive wallet and your smartphone begins to mine for different easily mineable cryptocurrencies. The ones which were mined were reportedly the following:

  • Magicoin
  • Feathercoin
  • VertCoin
  • MiriyadCoin
  • Unitus

More information plus removal instructions for the Android Coin miner hazardous software can be located on the related web link below:

Android Miner Virus – How to Remove from Your Mobile Device

qc64.exe Trojan

Similar to the other miners, using an executable to run on the computer of the victim, the qc64.exe’s infection file may pretend to be an Invoice, a purchase receipt, order confirmation and other type of seemingly legitimate file that is usually sent to you via e-mail.

Then, the qc64.exe may drop it’s malicious files in the system folders of Windows. Since the coin miner also has Trojan capabilities, it may also perform other activities of an unwanted character on your computer, like steal files, copy your passwords and logins, obtain network information form your computer and even infect it with more hazardous software.

You can read more information about the qc64.exe from the article below:

How to Remove qc64.exe Miner Trojan?

Trojan:HTML/Brocoiner Virus

This JavaScript browser virus has been reported to inject a malicious JavaScript onto the computers of it’s victims and this results in the victim’s computer to connect to the Coinhive mining servcie and mine for the cryptocurrency Monero by overloading your CPU and GPU power. What is interesting about the Brocoiner is that it uses fake websites of video games to spread, like the old site of the game Titan Quest. Below, you can find more info about Brocoiner:

How to Remove Brocoiner Coinhive Monero Virus?

JS:Cryptonight Coin Miner Virus

This is probably one of the most notorious cryptocurrency miners out there for web browsers, primarily because it uses the Cryptonight mining algorithm to generate Monero tokens at the expense of your Graphics Processor (Video Card).

The worst thing about it is that it is very difficult to notice it, primarily because the JS:Cryptonight Mining virus aims to perform various different tasks to hide itself and the only way to spot is if you see that the temperature of your GPU has gone way above the average one or if you have an advanced anti-malware protection enabled. More information about the JS:Cryptonight Miner can be found below:

How to Remove JS:Cryptonight Virus?

Service.exe and Webservice.exe Virus Processes

Similar to other cryptocurrency miners, using executable files to run while resembling legitimate Windows processes, the service.exe and webservice.exe files also attack the resources of your computer and it may have Trojan Horse capabilities, meaning that the viruses may create various different types of files on your computer that may link it’s IP address to a mining pool and in addition to this steal information from it. More information about the full dangers of having the service.exe and webservice.exe miners on your PC can be seen on the related article below:

How to Remove the Service.exe Virus Process (Crypto-Mining)
How to Remove the WebService.exe Virus Process (Crypto-Mining)

“Mercury Text Not Found” Message

“Mercury Text Not Found” Message runs primarily on web browsers, like Mozilla Firefox and Google Chrome. It takes advantage of a fake web page, that displays the following message:

In reality, the website embeds a JavaScript code which results in a file, named winhost.exe being drooped and ran actively on your computer. This file uses your system resources and may suddely slow down your computer plus make it freeze and some victims even report seeing BSOD (Blue Screen of Death) type of errors.


This Trojan has been reported to be very similar to the Adylkuzz Trojan horse which had various data stealing capabilities plus to min different types of cryptocurrencies, according to what are the strong components of your computer (CPU or GPU stronger).

More information about it can be found from the link below:

How to Remove Bitcoinminer.sx from Your Computer

How to Detect, Remove Coin Mining Viruses (Including Protection Tips)

The viruses have multiple different methods by which they are slithered on your computer. Some of them mine while remain filelessly on your PC, and some of them run suspicious executable processes as a system task in the background. One thing is clear though – if you have a high usage of your PC’s GPU or CPU components, recommendations are to immediately follow the SensorsTechForum.com removal instructions below to detect and remove such viruses, after which change all of your credentials as well (passwords, account names, e-mails, etc.).

How to Protect Yourself from Getting Infected With Malicious E-mails

Coin Miner Viruses Protection Tips

To best help you protect yourself against such threats in the future, you can follow the tips we have provided below:

  • Run programs in sandbox.
  • Install advanced anti-malware protection.
  • Keep everything updated, especially your web browsers.
  • Install ad-blocker software.
  • Be very careful on how you open e-mails.
  • Disable macros in Microsoft Office.
  • Disable JavaScript if you are not using it.
  • Keep your firewall and automatic updates on at all times.

Be advised that despite following many guidelines and protection tips, like the ones we have linked below, the best method to remove Coin Miner viruses and to detect them before they have even been activated is to use and advanced anti-malware protection. Such software will help you automatically remove any Coin Mining virus by scanning your PC for it’s definitions and your PC immediately becomes protected against being infected by such viruses in the future as well.

Ventsislav Krastev

Ventsislav is a cybersecurity expert at SensorsTechForum since 2015. He has been researching, covering, helping victims with the latest malware infections plus testing and reviewing software and the newest tech developments. Having graduated Marketing as well, Ventsislav also has passion for learning new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management, Network Administration and Computer Administration of System Applications, he found his true calling within the cybersecrurity industry and is a strong believer in the education of every user towards online safety and security.

More Posts - Website

Follow Me:

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

How to Remove Coin Miner Viruses from Windows.

Step 1: Boot Your PC In Safe Mode to isolate and remove Coin Miner Viruses


Manual Removal Usually Takes Time and You Risk Damaging Your Files If Not Careful!
We Recommend To Scan Your PC with SpyHunter

Keep in mind, that SpyHunter’s scanner is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware removal tool to remove the malware threats. Read our SpyHunter 5 review. Click on the corresponding links to check SpyHunter's EULA, Privacy Policy and Threat Assessment Criteria

1. Hold Windows key() + R

2. The "Run" Window will appear. In it, type "msconfig" and click OK.

3. Go to the "Boot" tab. There select "Safe Boot" and then click "Apply" and "OK".
Tip: Make sure to reverse those changes by unticking Safe Boot after that, because your system will always boot in Safe Boot from now on.

4. When prompted, click on "Restart" to go into Safe Mode.

5. You can recognise Safe Mode by the words written on the corners of your screen.

Step 2: Uninstall Coin Miner Viruses and related software from Windows

Here is a method in few easy steps that should be able to uninstall most programs. No matter if you are using Windows 10, 8, 7, Vista or XP, those steps will get the job done. Dragging the program or its folder to the recycle bin can be a very bad decision. If you do that, bits and pieces of the program are left behind, and that can lead to unstable work of your PC, errors with the file type associations and other unpleasant activities. The proper way to get a program off your computer is to Uninstall it. To do that:

1. Hold the Windows Logo Button and "R" on your keyboard. A Pop-up window will appear.

2. In the field type in "appwiz.cpl" and press ENTER.

3. This will open a window with all the programs installed on the PC. Select the program that you want to remove, and press "Uninstall"
Follow the instructions above and you will successfully uninstall most programs.

Step 3: Clean any registries, created by Coin Miner Viruses on your computer.

The usually targeted registries of Windows machines are the following:

  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

You can access them by opening the Windows registry editor and deleting any values, created by Coin Miner Viruses there. This can happen by following the steps underneath:

1. Open the Run Window again, type "regedit" and click OK.

2. When you open it, you can freely navigate to the Run and RunOnce keys, whose locations are shown above.

3. You can remove the value of the virus by right-clicking on it and removing it.
Tip: To find a virus-created value, you can right-click on it and click "Modify" to see which file it is set to run. If this is the virus file location, remove the value.

Before starting "Step 4", please boot back into Normal mode, in case you are currently in Safe Mode.
This will enable you to install and use SpyHunter 5 successfully.

Step 4: Scan for Coin Miner Viruses with SpyHunter Anti-Malware Tool

1. Click on the "Download" button to proceed to SpyHunter's download page.

It is recommended to run a scan before purchasing the full version of the software to make sure that the current version of the malware can be detected by SpyHunter. Click on the corresponding links to check SpyHunter's EULA, Privacy Policy and Threat Assessment Criteria.

2. After you have installed SpyHunter, wait for it to update automatically.


3. After the update process has finished, click on the 'Malware/PC Scan' tab. A new window will appear. Click on 'Start Scan'.


4. After SpyHunter has finished scanning your PC for any files of the associated threat and found them, you can try to get them removed automatically and permanently by clicking on the 'Next' button.


If any threats have been removed, it is highly recommended to restart your PC.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Get rid of Coin Miner Viruses from Mac OS X.

Step 1: Uninstall Coin Miner Viruses and remove related files and objects

Manual Removal Usually Takes Time and You Risk Damaging Your Files If Not Careful!
We Recommend To Scan Your Mac with SpyHunter for Mac
Keep in mind, that SpyHunter for Mac needs to purchased to remove the malware threats. Click on the corresponding links to check SpyHunter’s EULA and Privacy Policy

1. Hit the ⇧+⌘+U keys to open Utilities. Another way is to click on “Go” and then click “Utilities”, like the image below shows:

2. Find Activity Monitor and double-click it:

3. In the Activity Monitor look for any suspicious processes, belonging or related to Coin Miner Viruses:

Tip: To quit a process completely, choose the “Force Quit” option.

4. Click on the "Go" button again, but this time select Applications. Another way is with the ⇧+⌘+A buttons.

5. In the Applications menu, look for any suspicious app or an app with a name, similar or identical to Coin Miner Viruses. If you find it, right-click on the app and select “Move to Trash”.

6: Select Accounts, after which click on the Login Items preference. Your Mac will then show you a list of items that start automatically when you log in. Look for any suspicious apps identical or similar to Coin Miner Viruses. Check the app you want to stop from running automatically and then select on the Minus (“-“) icon to hide it.

7: Remove any left-over files that might be related to this threat manually by following the sub-steps below:

  • Go to Finder.
  • In the search bar type the name of the app that you want to remove.
  • Above the search bar change the two drop down menus to “System Files” and “Are Included” so that you can see all of the files associated with the application you want to remove. Bear in mind that some of the files may not be related to the app so be very careful which files you delete.
  • If all of the files are related, hold the ⌘+A buttons to select them and then drive them to “Trash”.

In case you cannot remove Coin Miner Viruses via Step 1 above:

In case you cannot find the virus files and objects in your Applications or other places we have shown above, you can manually look for them in the Libraries of your Mac. But before doing this, please read the disclaimer below:

Disclaimer! If you are about to tamper with Library files on Mac, be sure to know the name of the virus file, because if you delete the wrong file, it may cause irreversible damage to your MacOS. Continue on your own responsibility!

1: Click on "Go" and Then "Go to Folder" as shown underneath:

2: Type in "/Library/LauchAgents/" and click Ok:

3: Delete all of the virus files that have similar or the same name as Coin Miner Viruses. If you believe there is no such file, do not delete anything.

You can repeat the same procedure with the following other Library directories:

→ ~/Library/LaunchAgents

Tip: ~ is there on purpose, because it leads to more LaunchAgents.

Step 2: Scan for and remove Coin Miner Viruses files from your Mac

When you are facing problems on your Mac as a result of unwanted scripts and programs such as Coin Miner Viruses, the recommended way of eliminating the threat is by using an anti-malware program. SpyHunter for Mac offers advanced security features along with other modules that will improve your Mac’s security and protect it in the future.

Click the button below below to download SpyHunter for Mac and scan for Coin Miner Viruses:


SpyHunter for Mac

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Remove Coin Miner Viruses from Google Chrome.

Step 1: Start Google Chrome and open the drop menu

Step 2: Move the cursor over "Tools" and then from the extended menu choose "Extensions"

Step 3: From the opened "Extensions" menu locate the unwanted extension and click on its "Remove" button.

Step 4: After the extension is removed, restart Google Chrome by closing it from the red "X" button at the top right corner and start it again.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Erase Coin Miner Viruses from Mozilla Firefox.

Step 1: Start Mozilla Firefox. Open the menu window

Step 2: Select the "Add-ons" icon from the menu.

Step 3: Select the unwanted extension and click "Remove"

Step 4: After the extension is removed, restart Mozilla Firefox by closing it from the red "X" button at the top right corner and start it again.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Uninstall Coin Miner Viruses from Microsoft Edge.

Step 1: Start Edge browser.

Step 2: Open the drop menu by clicking on the icon at the top right corner.

Step 3: From the drop menu select "Extensions".

Step 4: Choose the suspected malicious extension you want to remove and then click on the gear icon.

Step 5: Remove the malicious extension by scrolling down and then clicking on Uninstall.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Remove Coin Miner Viruses from Safari.

Step 1: Start the Safari app.

Step 2: After hovering your mouse cursor to the top of the screen, click on the Safari text to open its drop down menu.

Step 3: From the menu, click on "Preferences".

stf-safari preferences

Step 4: After that, select the 'Extensions' Tab.


Step 5: Click once on the extension you want to remove.

Step 6: Click 'Uninstall'.

stf-safari uninstall

A pop-up window will appear asking for confirmation to uninstall the extension. Select 'Uninstall' again, and the Coin Miner Viruses will be removed.

How to Reset Safari
IMPORTANT: Before resetting Safari make sure you back up all your saved passwords within the browser in case you forget them.

Start Safari and then click on the gear leaver icon.

Click the Reset Safari button and you will reset the browser.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Eliminate Coin Miner Viruses from Internet Explorer.

Step 1: Start Internet Explorer.

Step 2: Click on the gear icon labeled 'Tools' to open the drop menu and select 'Manage Add-ons'

Step 3: In the 'Manage Add-ons' window.

Step 4: Select the extension you want to remove and then click 'Disable'. A pop-up window will appear to inform you that you are about to disable the selected extension, and some more add-ons might be disabled as well. Leave all the boxes checked, and click 'Disable'.

Step 5: After the unwanted extension has been removed, restart Internet Explorer by closing it from the red 'X' button located at the top right corner and start it again.

Remove Push Notifications caused by Coin Miner Viruses from Your Browsers.

Turn Off Push Notifications from Google Chrome

To disable any Push Notices from Google Chrome browser, please follow the steps below:

Step 1: Go to Settings in Chrome.


Step 2: In Settings, select “Advanced Settings”:

advanced settings

Step 3: Click “Content Settings”:

Content Settings

Step 4: Open “Notifications”:


Step 5: Click the three dots and choose Block, Edit or Remove options:

Block, Edit or Remove

Remove Push Notifications on Firefox

Step 1: Go to Firefox Options.


Step 2: Go to “Settings”, type “notifications” in the search bar and click "Settings":


Step 3: Click “Remove” on any site you wish notifications gone and click “Save Changes”

remove push notifications firefox

Stop Push Notifications on Opera

Step 1: In Opera, press ALT+P to go to Settings


Step 2: In Setting search, type “Content” to go to Content Settings.

content settings

Step 3: Open Notifications:


Step 4: Do the same as you did with Google Chrome (explained below):

three dots

Eliminate Push Notifications on Safari

Step 1: Open Safari Preferences.


Step 2: Choose the domain from where you like push pop-ups gone and change to "Deny" from "Allow".

Leave a Comment

Your email address will not be published. Required fields are marked *