Trojan:PowerShell/CoinStealer Virus – How to Remove it?

Step 1. Uninstall Trojan:PowerShell/CoinStealer related malicious programs using Control Panel

1. Press Win + R keys at the same time to launch Run box >> Then input: “Control Panel” and click OK

2. In Control Panel, click on Uninstall a program

3. In the Programs and Features window, right click on apps that may be related with Trojan:PowerShell/CoinStealer, then click Uninstall/Change. Then select Uninstall option.

---

Step 2. Remove Trojan:PowerShell/CoinStealer related malicious extension from Microsoft Edge/ Chrome/Firefox

–  On Microsoft Edge

• Click More (…) on the address bar and select Extensions
• Select extensions that may be related with Trojan:PowerShell/CoinStealer and click Uninstall button

–  On Chrome

• Click the Extensions button on the Chrome browser toolbar.
• Click Manage Extensions.
• Click the trash can icon to delete extensions that may be related with Trojan:PowerShell/CoinStealer.
• A confirmation dialog appears, click Remove.

– On Firefox

• Click the Extensions button on the Firefox browser toolbar.
• Click Manage Extensions.
• Click (…)  button of the malicious extension and select Remove button

---

---

Step 3. Find and remove nasty registry files related with Trojan:PowerShell/CoinStealer:

1. Open Registry Editor first:

• Press Win [Windows key] + R on your keyboard.
• Type regedit in the Run box and hit OK

2. Find out and remove all harmful registry files that may be related with Trojan:PowerShell/CoinStealer:

(Do Not Delete Any Registry File If You’re Not Familiar with It)

Wrong operation in Registry Editor might harm your computer.If you are not able to locate and identify the nasty registry files, we recommend using SpyHunter Anti-malware and see if it will find out unsafe registry files of infection for you. This may save you hours and avoid risks. Download SpyHunter For Win OS (Free Trial)  *OFFER – The SpyHunter Trial version includes, for one device, a one-time 7-day Trial period for SpyHunter 5 Pro (Windows) or SpyHunter for Mac. Check Terms & Conditions of SpyHunter Free Trial , EULA and Privacy/Cookie Policy.

 

---

Step 4. Reset Microsoft Edge, Chrome, Firefox and IE to remove Trojan:PowerShell/CoinStealer

Reset Microsoft Edge

1. Select More (…) on the address bar, then click Settings

2. Select “Privacy, search and services” at the left side menu

3. Click “Choose what to clear”

4. Select all the options and then click Clear now button

Reset Chrome

1. Open Chrome, then click “Customize and control Google Chrome” button >> click Settings

2. Type “reset” into the search box;

3. Scroll down to the bottom, then click on Reset settings;

4. A message box will pop up to inform that your browser settings will be restored to their original defaults, click Reset settings button when it appears.

Reset Firefox

1. Open Firefox, then click on Firefox button, then Click on Help button, then Click on More Troubleshooting Information

2. At the Troubleshooting Information page, click on Refresh Firefox

3. A message box will pop up to let you confirm that you want to reset Firefox to its initial state, click Refresh Firefox button when it appears.

---

Note: If problems remain after you completing manual removal steps, please scan your PC with Spyhunter to solve all issues:

Download SpyHunter For Win OS (Free Trial)

 *OFFER – The SpyHunter Trial version includes, for one device, a one-time 7-day Trial period for SpyHunter 5 Pro (Windows) or SpyHunter for Mac. Check Terms & Conditions of SpyHunter Free Trial , EULA and Privacy/Cookie Policy.

 

---

STEP 1 Delete malicious apps from Mac

– Select Finder on dock:

Select Applications >> Right-lick on unwanted or suspicious apps that may be related with Trojan:PowerShell/CoinStealer >> Click Move to Trash

Go to Dock  >> Right-click on Trash icon and click Empty Trash.

---

STEP 2 Uninstall Unwanted or Suspicious Extension that May Be Related with Adware:

On Safari:

Launch Safari and Click Preferences

Select Extensions tab >> Find unwanted or suspicious extension that may be related with Trojan:PowerShell/CoinStealer >> Click Uninstall

On Chrome:

Launch Chrome  >> Select More Tools  >> Click Extensions:

Find unwanted or suspicious extension that may be related with Trojan:PowerShell/CoinStealer >> Click Trash icon to uninstall it.

On Firefox:

Launch Firefox >> Click Add-ons:

Select Extensions tab >>  Find unwanted or suspicious extension that may be related with Trojan:PowerShell/CoinStealer >> Click Remove

---

STEP 3 Remove malicious files and folders related with adware or malware.

Click the Finder icon from the menu bar. Choose Go, and click Go to Folder…

1. In the Go to Folder… bar, type: /Library/LaunchAgents/

2. Check the “LaunchAgents” folder to find and delete malicious files related with Trojan:PowerShell/CoinStealer:

3.In the Go to Folder... bar, type: ~/Library/Application Support/

4. Check the “Application Support” folder to find and delete malicious files related with Trojan:PowerShell/CoinStealer:

5. In the Go to Folder… bar, type: ~/Library/LaunchAgents/

6. Check the “LaunchAgents” folder to find and delete malicious files related with Trojan:PowerShell/CoinStealer:

7. In the “Go to Folder…” bar, type: /Library/LaunchDaemons/

8. Check the “LaunchDaemons” folder to find and delete malicious files related with Trojan:PowerShell/CoinStealer:

Looking for malicious files and folders related with malware is a lengthy and complicated process. If you want to do it easily and avoid risks, our security researchers recommend using  SpyHunter For Mac to detect and remove all malicious items on your machine: Download SpyHunter For Mac OS (Free Trial)  *OFFER – The SpyHunter Trial version includes, for one device, a one-time 7-day Trial period for SpyHunter 5 Pro (Windows) or SpyHunter for Mac. Check Terms & Conditions of SpyHunter Free Trial , EULA and Privacy/Cookie Policy.