Sefnit is a form of Tor-based malware that managed to infect millions of computers and turn them into zombies for click fraud and bitcoin mining. Microsoft updated definitions for its anti-malware suites and new signatures allowed Microsoft Security Essentials, Windows Defender, Microsoft Safety Scanner and other tools to detect and remove the malware. But, contrary our original report, it left the Tor clients behind. Microsoft Malware Protection Center has protections to remove the services started by the malware, but it does not uninstall Tor, remove any Tor binaries, or prevent users from using Tor, said Microsoft.”]
Source: https://www.coindesk.com/markets/2014/01/22/microsoft-destroys-bitcoin-mining-botnet-sefnit/