PureMiner is a cryptocurrency mining malware that hijacks Windows computers to generate digital currency for attackers, all while draining your system resources and driving up your electricity bill. First identified in late 2017, this threat has evolved through multiple variants that combine aggressive propagation tactics with sophisticated defense-evasion techniques. Unlike ransomware that makes its presence immediately obvious, PureMiner works quietly in the background—your computer simply runs slower, your fans spin louder, and you wonder why your once-responsive machine now feels like it's stuck in molasses.
Threat Profile
| Attribute | Value |
|---|---|
| Threat Name | PureMiner |
| Threat Type | Cryptocurrency Miner (Cryptojacking) |
| Target Platform | Windows (all versions) |
| File Format | Windows PE executable |
| First Observed | November 2017 |
| Distribution Method | EternalBlue exploit, phishing emails, bundled software, malicious ads |
| Primary Payload | XMRig/Monero mining software |
| Typical Detection Rate | 40-60% by major AV engines (moderate polymorphism) |
| Network Communication | Mining pool connections, C2 check-ins |
| Persistence Mechanism | Registry run keys, scheduled tasks, WMI event subscriptions |
| Severity Rating | High (resource theft, potential hardware damage, lateral movement capability) |
| Common AV Aliases | Trojan:Win32/CoinMiner, RiskWare.BitCoinMiner, Trojan.CryptoMiner |
How It Spreads
PureMiner gained notoriety for weaponizing the EternalBlue exploit—the same NSA-developed vulnerability that powered the WannaCry ransomware outbreak. This allows the malware to spread laterally across networks without any user interaction, scanning for vulnerable SMB ports and automatically infecting other Windows machines on the same network. A single infected computer in an office can quickly become a building-wide infestation.
Beyond worm-like propagation, PureMiner arrives through multiple infection vectors that exploit human behavior and software vulnerabilities. The malware operators have shown adaptability over the years, updating their distribution methods as old techniques get blocked.
- EternalBlue exploit (CVE-2017-0144): Automated scanning and infection of unpatched Windows systems via SMB protocol
- Phishing emails: Malicious attachments disguised as invoices, resumes, or shipping notifications
- Software bundling: Hidden in free software installers from sketchy download sites
- Malicious advertisements: Drive-by downloads from compromised ad networks on legitimate websites
- Fake software updates: Fake Flash Player or codec update prompts on streaming sites
- Cracked software: Bundled with pirated programs, game cracks, and key generators
What It Does On Your Machine
Once PureMiner establishes itself on your computer, it immediately begins mining Monero (XMR)—a privacy-focused cryptocurrency that's nearly impossible to trace. The malware typically configures the mining software to use 50-80% of your CPU capacity, leaving just enough resources that casual users might not immediately notice. Power users and gamers will spot the problem right away when their frame rates tank or applications fail to launch.
The malware doesn't just mine—it fortifies itself against removal. PureMiner creates multiple persistence mechanisms so that deleting one component simply triggers the others to reinstall the miner. It monitors its own processes and restarts them if they're terminated. Advanced variants include watchdog processes that run with SYSTEM privileges, making them difficult to kill even from Task Manager. Some versions modify Windows Defender exclusions to whitelist their own directories, effectively neutering your built-in protection.
The continuous CPU strain causes real physical damage over time. Processors running at maximum capacity 24/7 generate excessive heat that degrades thermal paste, strains cooling fans, and can eventually lead to thermal throttling or permanent silicon degradation. We've seen laptops with warped chassis, desktop computers with failed cooling systems, and blown capacitors on motherboards—all from sustained cryptomining infections.
Manual Removal — Step by Step
Disconnect from Network
Immediately disconnect from the internet—either unplug the Ethernet cable or disable Wi-Fi. This prevents the malware from receiving commands, updating itself, or spreading to other computers on your network. If you're on a business network, notify your IT administrator before proceeding so they can isolate the threat.
Boot into Safe Mode with Networking
Restart your computer and repeatedly press F8 (or Shift+F8 on Windows 10/11) during boot. Select "Safe Mode with Networking" from the advanced boot options menu. This loads Windows with minimal drivers and prevents most malware from starting automatically. If F8 doesn't work, you may need to access Safe Mode through Windows Settings → Update & Security → Recovery → Advanced Startup.
Check Running Processes
Open Task Manager (Ctrl+Shift+Esc) and look for suspicious processes consuming high CPU. PureMiner often disguises itself with names like "audiodg.exe," "svchost.exe," or "csrss.exe"—legitimate Windows processes that the malware impersonates. Right-click suspicious processes, select "Open file location," and note the path. Legitimate Windows processes run from C:\Windows\System32, not from AppData or ProgramData folders.
Run Malwarebytes and ESET Online Scanner
Download and install Malwarebytes (reconnect to internet briefly in Safe Mode if needed). Run a full Threat Scan—this typically catches 70-80% of PureMiner variants. After Malwarebytes finishes, download ESET Online Scanner for a second opinion. Many cryptominers use rootkit techniques that require multiple specialized tools to fully eliminate. Quarantine or delete everything both scanners flag.
Remove Persistence Mechanisms
Press Win+R, type "regedit," and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Look for unfamiliar entries, especially those pointing to executable files in AppData, ProgramData, or Temp folders. Delete suspicious entries, but photograph or note them first in case you need to restore a legitimate program.
Check Scheduled Tasks and Services
Open Task Scheduler (type "taskschd.msc" in Start) and review the Task Scheduler Library. PureMiner creates scheduled tasks to restart itself hourly or at system boot. Delete any tasks that reference unfamiliar executables. Then open Services (type "services.msc") and look for suspicious services with generic names—disable and delete anything that points to files you've already identified as malicious.
Delete Malicious Files Manually
Navigate to the file locations you noted in step 3. Delete the executable files, then check these common hiding spots: C:\ProgramData\, C:\Users\[username]\AppData\Roaming\, C:\Users\[username]\AppData\Local\Temp\, and C:\Windows\Temp\. Some files may be locked—use Unlocker or FileASSASSIN utilities to force deletion if needed.
Reset Network Settings and Hosts File
Open an elevated Command Prompt (right-click Start, select "Command Prompt (Admin)") and run these commands: "ipconfig /flushdns" followed by "netsh winsock reset" and "netsh int ip reset". Then navigate to C:\Windows\System32\drivers\etc\, open the "hosts" file with Notepad, and remove any entries below the default localhost lines—malware sometimes redirects security domains here.
Update Windows and Patch EternalBlue
Before reconnecting to your network, ensure Windows is fully patched. Go to Settings → Update & Security → Windows Update and install all available updates. The MS17-010 security patch closes the EternalBlue vulnerability that PureMiner exploits for propagation. If you're running Windows XP, Vista, or 7 without extended support, you're permanently vulnerable—consider upgrading to Windows 10 or 11.
Monitor System Performance
Reboot normally and monitor your system for 48 hours. Keep Task Manager open and watch CPU usage—it should drop to 5-15% at idle. Check your startup programs (Ctrl+Shift+Esc → Startup tab) and disable anything suspicious. If high CPU usage returns or you notice network connections to mining pools (use TCPView from Sysinternals to check), the infection may have reestablished itself through a persistence mechanism you missed.
Prevention
- Keep Windows Updated: Enable automatic updates and install security patches immediately. The vast majority of PureMiner infections exploit vulnerabilities that Microsoft patched years ago—unpatched systems are sitting ducks.
- Use reputable antivirus software: Windows Defender is adequate for basic protection, but consider dedicated solutions like Kaspersky, Bitdefender, or ESET that offer enhanced cryptominer detection. Keep real-time protection enabled at all times.
- Block SMB ports at the firewall: If you don't need file sharing, disable SMBv1 entirely (go to Control Panel → Programs → Turn Windows features on or off → uncheck "SMB 1.0/CIFS File Sharing Support"). Configure your router to block incoming connections on ports 139 and 445.
- Practice safe browsing: Avoid downloading software from anywhere except the official vendor's website. Never click "Yes" on unexpected security warnings or download prompts. Use an ad blocker like uBlock Origin to prevent malicious advertisements from loading.
- Scrutinize email attachments: Never open attachments from unknown senders. Even if an email appears to come from someone you know, verify through a separate communication channel if you weren't expecting an attachment—compromised email accounts frequently spread malware to entire contact lists.
- Monitor CPU usage regularly: Get in the habit of periodically checking Task Manager. Sudden sustained spikes to 80-100% CPU usage when you're not running demanding programs is the earliest warning sign of cryptominer infection.
- Implement network segmentation: For businesses, isolate critical systems on separate network segments with strict firewall rules. A single infected laptop shouldn't be able to compromise your entire infrastructure through lateral movement.
- Disable unnecessary services: If you don't use Remote Desktop, Windows Remote Management, or file sharing, disable these services completely. Every enabled service represents a potential attack surface for exploit-based malware.
Bring It In
Cryptominer infections like PureMiner require thorough analysis to ensure complete removal. While the manual steps above work for straightforward cases, advanced variants use rootkit techniques, UEFI persistence, or fileless execution that evade standard removal procedures. Our technicians at Computer Repair Roswell have specialized forensic tools and years of experience identifying hidden persistence mechanisms that home users typically miss. We've seen too many DIY removal attempts that eliminated the visible miner but left the dropper component that reinstalled everything three days later.
Located right here in Roswell, Georgia, we offer same-day malware removal service for most infections. Bring your computer to our shop at [Address] or call us at (770) 679-9930 to schedule a diagnostic. We'll scan your system with enterprise-grade tools, remove all malware components, patch your vulnerabilities, and verify your computer is mining-free before returning it to you. Don't let cryptominers continue stealing your electricity and degrading your hardware—let's fix this today.