An infected Antminer is a control-board problem, not a hashboard problem. Mining malware lives in the flash and ramdisk of the control board — it never touches the ASIC hashboards — so the fix is always the same: isolate the miner, confirm the infection, then wipe and reflash the control board with a clean, officially signed image. Below: how to spot an infected unit, contain it before it spreads, and the three cleanup paths — batch antivirus tool, SD-card recovery, and serial-port SD recovery.
How to Tell a Miner Is Infected
Antminer malware keeps you hashing while it quietly diverts value or spreads. Classic symptoms:
- Pool settings that change on their own — a wallet or pool URL you never entered appears, or a hidden third pool entry shows up under your two real ones.
- Configuration that reverts after every reboot — you correct the pool, save, restart, and the rogue entry is back, because the malware rewrites config from flash on boot.
- Firmware upgrades that silently fail or are blocked — infected units often reject the official upgrade file to protect the payload.
- A web UI that is missing pages, loops on login, or shows an altered dashboard.
- Healthy reported hashrate but short pool-side accepted shares — the tell of hashrate theft.
- Neighbouring miners infected in sequence. Documented Antminer worms scan the local subnet and self-replicate to any peer still on default credentials; some variants have deliberately disabled fan control to damage hardware. Cross-infection on one LAN means a worm, not a one-off.
None of these are hashboard faults — a unit that under-hashes on a clean, stable config has a hardware problem, not an infection.
Step 1: Isolate Before You Touch Anything
Containment comes first. Because the common threat is a self-spreading worm, working on an infected unit while it shares a subnet with healthy miners undoes everything you fix.
- Pull the suspect miner off the shared mining LAN onto an isolated segment or dedicated switch with no path to your other units.
- Block its route to the internet. Malware that can phone home re-pulls its payload after you clean it. A mining LAN should never have unrestricted outbound access — a VLAN or firewall rule is the long-term fix.
- Record the current pool config to confirm nothing rogue survives the reflash.
Step 2: Change the Default Credentials First
Nearly every Antminer infection enters through the factory login left at root / root. Change the root/admin password as part of the cleanup — a cleaned miner put back on the network with default credentials is simply reinfected by the next scan.
Step 3: Choose a Cleanup Method
All three overwrite the compromised control-board software with a clean, manufacturer-signed image. These control boards can be forced to boot from an SD card, which is why SD-card recovery is the universal fallback — it bypasses whatever the malware did to on-board flash.
Method A — Batch Antivirus Tool (fastest, do this first)
Bitmain’s mining-pool batch antivirus utility scans and disinfects multiple miners over the network in one pass — the right starting point for a small fleet. It covers the S17/T17, S15/T15, the full S9 family (S9i/S9j/S9k/S9 SE), L3+/L3++, the Z11 series, and D5/B7/DR3/DR5/X3. Any unit it cannot clean goes to Method C. Full walkthrough in the Bitmain antivirus software guide.
Method B — SD-Card Recovery (universal, per-unit)
SD-card recovery reflashes one control board at a time and reaches units the batch tool cannot. Write the official recovery image to a microSD card, set the miner to boot from it, and let it rewrite the control-board program. Use only the signed image for your exact model, from Bitmain’s support portal:
- A3, D3, L3/L3+, X3: recovery article
- S9 family (S9j, S9i), T9, T9+: recovery article
- Z9, Z9 mini, V9: recovery article
- S17/S17 Pro/S9 SE/S9k/Z11 (custom-password program): recovery article
- S17e/T17e/S17+/T17+ (control-board program): recovery article
- S19, S19 Pro (control-board program): recovery article
Method C — Serial-Port SD Recovery (stubborn infections)
When a 15- or 17-series unit carries a variant the other methods cannot clear, serial-port SD recovery forces a low-level reflash over the control board’s UART. It is the most involved path — single-unit, needs a USB-to-serial adapter and comfort with a terminal — but it reaches infections the others miss. Follow Bitmain’s serial-port SD recovery article for the S17 Pro/S17/T17 and S15/T15.
Step 4: Verify the Miner Is Clean
- Confirm the firmware version string matches the official image you wrote — nothing older or unfamiliar.
- Re-enter your pool config, reboot, and check it holds. A rogue entry that reappears means the reflash did not take — repeat with Method B or C.
- Compare pool-side accepted shares to reported hashrate over an hour; they should track.
- Confirm the new password sticks and the web UI is complete before returning the unit.
Common Mistakes
- Reconnecting to the shared LAN before every infected unit is reflashed. One missed worm-carrier reinfects the batch. Clean the whole group, then reintroduce.
- Leaving credentials at default after cleanup — the number-one cause of instant reinfection.
- Grabbing a “firmware” file from a forum or search result. Only signed images from the manufacturer’s portal are trustworthy; an unofficial image is how miners get infected in the first place.
- Treating an under-hashing but config-clean miner as infected — that is a hardware symptom, so diagnose the chains, not the software.
When to Escalate
If none of the three methods clears the infection, a unit won’t boot after a serial reflash, or a fan-killing variant has already cooked a board, it needs bench-level attention. Start a repair and D-Central can flash, test, and validate the control board and check the hashboards for damage.
Related: Once cleaned, lock units down with our guide to preventing viruses, malware, and remote attacks on Antminers. For symptoms that look like hardware rather than infection, use the ASIC Fault Finder.
