# MinerSearch scans for miners once and quits, and it will probably trip your antivirus > MinerSearch is a C# tool that searches a Windows machine for hidden cryptominers, quarantines what it finds and writes a detailed log. It is explicitly not an antivirus, it has no resident protection, and the README warns up front that antivirus software may classify it as malware. **BlendLog/MinerSearch** — Program designed for search and kill silent miners - Repository: https://github.com/BlendLog/MinerSearch - Website: https://blendlog.github.io/ - Stars: 1,499 · Forks: 55 - Language: C# - License: NOASSERTION - Published: 2026-10-16 · Updated: 2026-10-16 · Language: en - Canonical page: https://hysenlabs.com/projects/blendlog-minersearch ## It is a one-shot scanner, not resident protection The README states two things in the first paragraph that decide whether this tool applies to you. It is designed to find and destroy hidden miners. And it is an auxiliary tool for searching suspicious files, directories, processes and similar, and is not an antivirus. That second sentence is a real constraint on how you use it. There is no file system filter, no on-access scanner and no resident process watching for threats as they appear. You run the scan, you read the report, you act, and then the tool is finished until you run it again. The scanning surface is wide, which is what compensates for the lack of live protection. Launch parameters exist to check processes, system registry, firewall rules, scheduler tasks, services, user profiles, WMI integrity and event subscriptions, the hosts file, and rootkit presence. The v1.4.9.5 notes also mention scanning of COM autostart components and an expanded list of detectable malicious services, which are the two persistence mechanisms miners have used that a simple file scan misses. There is a reporting option on first run: the program offers to send scan results to the author, at your discretion. That is a decision to make deliberately, and it is the only outbound behaviour the README describes. ## Antivirus may flag it, and the README asks you not to file issues The caution notice is the second thing in the README and it is unusually blunt: antivirus may mistakenly treat this application as malware, and please do not create issues about this. There is a reason for it. A tool that enumerates every process, opens every scheduled task, reads the registry and removes objects without confirmation has the same observable behaviour as malware, and heuristic engines are trained on exactly that behaviour. A quarantining cleaner that deletes files is not distinguishable from a malicious cleaner by signature. So the practical consequence is procedural. Before you run it you may need to allow the binary in your antivirus, and the v1.4.9.5 notes mention eliminating endless attempts to remove unwanted Windows Defender exclusions, which tells you the interaction with Defender's own configuration is an ongoing source of friction. Two other constraints come early in the document. NET Framework 4.8 is required, so this is a Windows-only tool on a specific runtime. And Windows 7 is described as outdated with MinerSearch development for that OS discontinued, so there is no expectation of new detection coverage there. The project ships a custom licence in LICENSE.MD that GitHub cannot classify, and the program has an End-User License Agreement that the `-a` flag accepts. Read both before installing it in a managed environment, since the licence is not one you can assume from the name. ## The v1.4.9.5 changelog is mostly about false positives Reading the release notes for v1.4.9.5 tells you what this tool actually gets wrong in practice, which is more useful than a feature list. Several entries are about accuracy and false alarms. Improved accuracy of digital signature verification of files, elimination of false access errors during file analysis, and elimination of false positives on a legitimate system process, conhost, which is the console host process and a common source of noise in process-based scanning. Four entries are about analysis being interrupted. There is added handling of read errors for corrupted files, fixed analysis errors for files locked by other processes, restored WMI integrity check, and a fix to the display of file paths in the log, which is the kind of bug that makes a report hard to act on. Persistence detection got most of the attention: improved detection of suspicious scheduled tasks, expanded heuristics for scheduled tasks, and the new COM autostart scan. Windows version detection was updated, which is what tells you the tool branches its behaviour by OS build. Two entries are about the tool's own behaviour. Background mode with `--silent` was fixed, and the attempts to remove unwanted Windows Defender exclusions were stopped, which reads as a decision to leave Defender's configuration alone. One entry affects your workflow: SHA1 hashes of unsigned files are now recorded at all scanning stages, so a report can name the exact file even when it carries no valid signature. ## Threat Review applies recommended actions when you close the window The interactive flow is a short report after the scan, with a Show Log button, a Quarantine button, and a Threat Review window if unknown threats were found. Threat Review is where the decisions are made. Each item gets one of six actions: Cure, Quarantine, Delete, Terminate, Disable or Skip. There is a Set to all control to apply one action to everything, and Set recommended to restore what the analyzers suggested. The default behaviour is the part to understand carefully. If the window is closed without clicking Apply, the recommended actions are applied after confirmation. So closing the window is not a neutral act, and automatic acceptance of decisions for unknown threats can be enabled in the settings or with the `-norev` parameter. Quarantine is reversible for the things it covers. The Quarantine Manager can completely delete or restore a file, and the same manager also handles quarantined scheduled tasks, services and registry entries. That is a wider surface than a file quarantine, and it means a wrong decision can remove a scheduled task or a service you actually need. Cure and Quarantine are different things, and the distinction matters: quarantine moves something where it cannot run and can be restored, while cure repairs it. Delete is permanent. ## The parameter table is the real documentation The launch parameters are documented in a table. Running with parameters requires an elevated command prompt, and the documented procedure is to open cmd as administrator, hold Shift and right-click the application to Copy as path, then paste and add the parameters. The ones that matter first are the scanning scope controls. `-nrc` skips the rootkit check, `-nwmi` skips WMI integrity and event subscription checks, `-nse` skips services, `-nst` skips scheduler tasks, `-nsu` skips user profiles, `-nsr` skips the system registry, `-nch` skips the hosts file, `-nfw` skips firewall rules, `-nr` skips process scanning entirely, and `-nss` skips file signature scanning. Each of these exists because you are running on a machine where that check is slow, unavailable or producing noise. Two parameters extend the scan. `-fs` adds all other local drives for signature scanning, and `-d=` sets the maximum search depth, default 8 with a maximum of 16, so `-d=5` searches shallower. Four change what the program does with what it finds. `-so` displays malicious or suspicious objects without performing any treatment, which is the parameter to use on a machine you are not ready to modify. `-p` pauses before cleanup so you can interrupt. `-f` suppresses confirmation prompts for potentially dangerous functions. `-ret` removes a task from Task Scheduler when the application file it points to no longer exists. Two modes change the environment. `-w` starts scanning in WinPE mode, skipping processes, registry, firewall rules, services and scheduler tasks, which is how you scan a machine you cannot boot normally. `-si` enables silent background mode with no dialogs, where messages still go to the log, and it is incompatible with `--select` and `--winpemode`. Quarantine can also be managed from the console. `-q` opens the Quarantine Manager, `-q -cm` lists the contents, and `-res= 1,2,3` restores or `-del= 1,2,3` deletes items, with restore requiring `-f`. ## Reading the log is most of the skill The log has its own notation, and the legend is a good indicator of how the tool communicates severity. Four markers form a ladder. `[!]` is a minor warning, `[!!]` is a warning worth paying attention to, `[!!!]` is a threat detected, and `[!!!!]` is a rootkit detected. Three markers describe the outcome of an action. `[+]` means a successful completion of an action such as treatment or removal, `[x]` is an error, and `[xxx]` is a critical error, with the example given being a sandbox environment. Four markers are informational. `[Reg]` shows scanning of registry keys, `[#]` is a status, `[.]` is a description, and `[_]` relates to unblocking a directory,. Two flags change what you see. `-nl` stops logs being written to a file at all, and `-v` adds detailed process information to the console while disabling the filter for lines with files not recognised as malicious, which the README notes may increase the log file size. The filtered output is worth understanding: by default the log does not include every unrecognised file, and `-v` turns that filter off. That is the difference between a short report and a full inventory when you are investigating rather than cleaning. Update news has moved to a Telegram channel linked in the README, with a download button pointing at the latest release. ## Where MinerSearch is the wrong tool Three cases. If you need ongoing protection, this does not provide it. There is no resident scanner, so a miner installed after your scan runs until you run the tool again. Use a recognised antivirus or endpoint product for that, and use this for a one-off investigation. If you cannot disable or work around your endpoint protection, you will not get to run it. The README asks you not to report the resulting detection, which means the intended workflow includes an exception in your security tooling. On a managed corporate machine that is a change request, not a task. If your machine is Windows 7, development has been discontinued, so new detection coverage is not coming. There is one more practical constraint that shapes everything: the tool needs administrator rights, which means it is being trusted with the ability to remove services, scheduled tasks and registry entries on a machine you may not be able to rebuild. That is why reading the log rather than accepting the recommended actions is the right habit, and why `--scan-only` exists. On the project itself, releases are frequent and versioned in four parts: v1.4.9.3 on 2026-09-13, v1.4.9.4 on 2026-09-21 and v1.4.9.5 on 2026-10-05, with the last push on 2026-10-15. The language is set by creating or editing a `language.cfg` file with `RU` or `EN`. ## Conclusion Adopt MinerSearch on a Windows machine you suspect is mining, run it once as administrator with `--scan-only` first, then apply the recommended actions. Skip it if you need continuous protection or a tool with a recognised antivirus signature, since this is a one-shot scanning tool with a custom licence. Verify first that .NET Framework 4.8 is present, and read the log rather than accepting every action, because the program applies recommended actions automatically when the Threat Review window is closed without Apply. ## FAQ ### What does MinerSearch need to run? NET Framework 4.8 is required, and the program must be launched with administrator rights, including for its launch parameters, which the README describes using an elevated command prompt with Copy as path. Development for Windows 7 has been discontinued. ### Why does my antivirus flag MinerSearch? The README carries an explicit caution that antivirus may mistakenly treat the application as malware and asks that issues not be filed about it. A tool that enumerates processes, scheduled tasks, services and the registry and then removes objects behaves much like malware from a heuristic engine's point of view. ### How do I scan without letting the program delete anything? Use the `--scan-only` or `-so` parameter, which displays malicious or suspicious objects without performing treatment. Combined with `--verbose` to disable the filter for unrecognised files, you get a full report to read before deciding what to do. ## Sources - [BlendLog/MinerSearch on GitHub](https://github.com/BlendLog/MinerSearch) - [Issues](https://github.com/BlendLog/MinerSearch/issues) - [Project website](https://blendlog.github.io/) - [README](https://github.com/BlendLog/MinerSearch/blob/master/README.md) - [Releases](https://github.com/BlendLog/MinerSearch/releases) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/blendlog-minersearch