I Need Help to remove this virus: Trojan:MSIL/CoinMiner.ACM!MTB

Open Windows Security → Virus & threat protection → Protection history, select the Trojan:MSIL/CoinMiner.ACM!MTB alert, and choose Remove or Quarantine—never Allow on device.

Remove the detected threat

1. Temporarily disconnect the computer from Wi-Fi or unplug its Ethernet cable.
2. Open Start → Windows Security → Virus & threat protection → Protection history.
3. Expand the alert named Trojan:MSIL/CoinMiner.ACM!MTB. Administrator permission may be required.
4. Follow the action matching its status:
   • Threat found – action needed: select Actions → Quarantine.
   • Threat quarantined: select Remove to delete it.
   • Threat blocked: Defender has already blocked and removed it; no removal action is required.
   • Remediation incomplete: expand the alert and complete the displayed instructions, including restarting if requested.
   Do not select Restore or Allow on device. Those actions can permit the detected file to run again.^1^

Run an offline scan

Save open work first because this scan restarts the computer.

1. Open Windows Security → Virus & threat protection.
2. Under Current threats, select Scan options.
3. Select Microsoft Defender Antivirus (offline scan).
4. Select Scan now.
5. After Windows restarts and the scan finishes, return to Protection history and remove or quarantine anything else detected.

The offline scan runs outside normal Windows, making it harder for persistent malware to hide or defend itself.^2^

Also check Virus & threat protection → Manage settings and ensure Real-time protection, Cloud-delivered protection, and Tamper protection are enabled.^2^

Verify that it is gone

1. Reconnect to the internet.
2. In Windows Security → Virus & threat protection, install available protection updates.
3. Open Scan options, select Full scan, and start it. A full scan examines every file and program.^2^
4. Restart Windows once more.
5. Check Protection history again. If there is no new detection after the restart and the full scan reports no active threats, the cleanup has succeeded.

Delete the original download, email attachment, installer, or USB file that introduced the detection. Do not reinstall or reopen it.

If Defender detects it again

A repeated detection after reboot can mean that another hidden component is reinstalling it. Microsoft specifically recommends Defender Offline for recurring malware.^3^

If the offline scan did not stop it:

1. Download the latest Microsoft Safety Scanner from Microsoft.
2. Open it and run a Full scan.
3. Review the displayed results. Detailed results are stored in %SYSTEMROOT%\debug\msert.log.

Safety Scanner is a manually triggered malware-removal tool and expires 10 days after download, so obtain a fresh copy before each later scan.^4^

Do not download a generic fixlist.txt or run an FRST repair script created for somebody else. Those scripts are customized to that computer and can remove legitimate files or settings.

If Defender remains disabled, removal repeatedly fails, or the detection continues after both offline and Safety Scanner scans, back up personal documents—but not unknown executables, scripts, or installers—and reset or reinstall Windows. Prefer a backup created before the infection; Microsoft notes that backups present during an infection may also have been modified.^3^

Because trojans can capture passwords and sign-in details, after cleanup change important passwords from a different, known-clean device and review those accounts for unfamiliar activity.^5^

References

1. Protection History in the Windows Security App | Microsoft Support
2. Virus and Threat Protection in the Windows Security App | Microsoft Support
3. Troubleshoot problems with detecting and removing malware | Microsoft Support
4. Microsoft Safety Scanner Download
5. Trojans