Bitmain publishes a free Windows utility — the Antivirus / Immunization Tool — that scans a range of Antminers over the network, flags any unit running tampered firmware, and reflashes a clean, signed image to kill the infection. It is the fastest way to clean a shelf of older miners that have been hijacked to redirect hashrate or rewrite pool worker names, without pulling a single control board. This guide covers exactly how to run it, how to read every result state it returns, and what to do when it can’t finish the job.
What the tool actually does
The utility does three things in sequence. It discovers miners on your LAN by sweeping an IP range, runs firmware detection over each miner’s SSH (port 22) service to check the on-device firmware fingerprint against Bitmain’s known-good versions, and on any infected unit downloads the matching clean image and performs a one-click reflash that overwrites the tampered firmware. It is not a background scanner — it is a point-in-time detect-and-reflash pass you run deliberately against a batch.
Only download the tool and its firmware from Bitmain’s official support portal. Never run an “antivirus” or “unlock” binary handed to you in a Telegram group or forum thread — that is the exact vector that gets these miners infected in the first place. Genuine cleaning firmware is signed by the manufacturer.
Supported miner models
The immunization tool targets the older generations that are actually vulnerable to the known worms:
- S17 Pro, S17, T17
- S15, T15
- S9 (C5), S9, S9i, S9j, S9k, S9 SE, T9, T9+, S11
- L3+, L3++
- Z11, Z11e, Z11j
- D5, B7, DR3, DR5, X3
Newer signed-firmware miners (S19-class and up) close SSH by default and reject unsigned images, so they fall outside this tool’s scope — a model that isn’t on the supported list is reported as Not supported, not as clean.
Before you start
- Run it on Windows 7 or newer. Windows XP and macOS are not supported. The interface auto-selects its language from your OS.
- Decompress the archive and run the tool from the extracted folder — not from inside the zip.
- The PC must be on the same subnet as the miners. Plug into the same switch/VLAN the miners answer on, or the IP sweep finds nothing.
- If your browser or endpoint AV flags the download, that is a common false positive on network tools of this kind — provided you pulled it from Bitmain’s portal, it is safe.
- Let each detect/kill pass run to completion. Pausing mid-scan or mid-reflash is not supported and can leave a board in a half-written state.
Step by step: scan, detect, disinfect
- Sweep for miners. Enter the IP range for your mining LAN, then click Start Scan. The tool lists every reachable Antminer it finds.
- Run firmware detection. Select the miners you want to check and click Firmware Detection. Each unit returns one of four states (see below).
- Disinfect the poisoned units. For anything flagged infected, choose Firmware Antivirus → One-click download to pull the clean image, then Continue Antivirus once the download finishes. The tool reflashes the miner.
- Confirm the result. On success the tool reports Operation Completed — Antivirus Succeed. Each unit also shows a per-miner running status.
Reading the firmware-detection results
- Normal — firmware matches a known-good version; the miner is clean.
- Poisoned — tampered firmware detected. The offending file is named in the error details. This unit needs disinfection.
- Secure Firmware — the miner already runs hardened firmware with SSH (port 22) closed. Nothing to clean.
- Not supported — the model isn’t covered, or SSH failed / authentication was rejected. This does not mean “clean” — it means the tool couldn’t inspect it.
Reading the disinfection results
- Kill Success — clean firmware written; the infection is gone.
- Kill Error — the reflash failed part-way. Retry; if it keeps failing, drop to SD-card or serial-port recovery.
- Not support — the unit can’t be cleaned by this method; use a recovery method instead.
- None — nothing was actioned on that miner (it wasn’t flagged, or was skipped).
Heads-up on old firmware: if a miner is running a very old firmware version, its saved configuration (pool URLs, worker names, static IP, frequency) can be wiped when the clean image is written. Have your pool details on hand and reconfigure the unit afterward.
Harden the miner so it stays clean
Reflashing removes the infection but not the door it walked in through. Close it, or you’ll be running this tool again:
- Change the default credentials immediately. A freshly reset Antminer ships with
root/root. Set a strong, unique password in the miner’s web UI, under its administration/security settings, before it goes back online. Default credentials are how these worms spread. - Keep the mining LAN off the open internet. Put miners on an isolated VLAN or a router with no inbound port-forwarding to their web UI or SSH. These older units were never meant to face the public internet — treat any exposed management port as a live infection risk.
- Run only official signed firmware. Pull images from the manufacturer’s portal, never from a third party promising overclocks or “free” performance. Unsigned firmware is the payload.
- Re-scan the batch after hardening to confirm every unit reads Normal or Secure Firmware.
Common mistakes
- Running the PC on a different subnet than the miners — the scan returns empty and the tool looks broken.
- Treating Not supported as “clean.” It only means the tool couldn’t reach or read that miner.
- Interrupting a reflash — a half-written flash can brick the control board.
- Cleaning the miners but never changing the default password — guaranteed reinfection.
When the tool can’t finish the job
If a miner comes back Kill Error or Not supported, the network reflash can’t reach it — usually deeper firmware damage or a model outside the tool’s range. Fall back to SD-card or serial-port SD recovery, which rewrite the control board directly and clean infections the network pass can’t. If a unit still won’t hold clean firmware, it’s a bench job.
Related: For the full menu of recovery routes — SD-card, batch tool, and serial-port — see Methods for Treating Antminer Anti-Virus Issues. To lock down a farm against reinfection and factory-reset a hijacked unit, read Preventing and Removing Viruses, Malware, and Remote Attacks on Antminer. When a board won’t take clean firmware, start a repair and let the bench handle it.
