Hidden crypto miner: how to find and remove it from your computer

What a hidden miner is

A hidden miner is malware that secretly uses your GPU or CPU to mine cryptocurrency for an attacker. The computer’s owner gets the noise, heat, slowdowns and electricity bills, while the money goes to someone else’s wallet.

Most often a miner arrives together with:

• cracked games and software — repacks, cracks, activators;
• cheats and “free” mods for games;
• paid software downloaded from dubious websites;
• email attachments and files sent through messengers.

Signs of a hidden miner

• The fans are loud and the computer is hot even though you have not started anything.
• The GPU or CPU sits at 50–100% load while idle.
• The load drops sharply when you open Task Manager and comes back when you close it.
• Task Manager closes by itself or will not open; the antivirus is disabled and cannot be turned on.
• Antivirus websites will not load.
• Games have started to stutter and FPS has dropped for no obvious reason.
• The laptop battery drains quickly; the computer no longer goes to sleep.

One sign alone is no reason to panic: Windows updates, file indexing or an antivirus scan also cause high load. But if several match, investigate.

How to find a miner, step by step

1. Task Manager

Press Ctrl + Shift + Esc and open the “Processes” tab. Sort by the “CPU” and “GPU” columns (if there is no GPU column, right-click the table header and enable it). Suspicious signs:

• unfamiliar processes with high load;
• processes with system names — svchost.exe, explorer.exe, dllhost.exe, csrss.exe — running from unusual folders.

Right-click the process and choose “Open file location”. Windows system files live in C:\Windows\System32, not in AppData, Temp or ProgramData.

2. If the miner hides

Many miners stop as soon as they see Task Manager and start again when it closes. To catch them:

• Download Process Explorer from Microsoft’s official site (the Sysinternals suite) and rename the file before running it — some miners look for it by name. Process Explorer shows the process tree and digital signatures, and can check files on VirusTotal (Options → VirusTotal.com → Check VirusTotal.com).
• Watch the GPU temperature and fan speed while idle — for example, in HWiNFO. If the temperature is high on an empty desktop, something is loading the card.

3. Startup, scheduled tasks and services

If the miner returns after a reboot, it is registered to start automatically. Check the “Startup” tab in Task Manager, Task Scheduler (taskschd.msc) and Services (services.msc): look for tasks and services with meaningless names that launch files from AppData, Temp or ProgramData.

The most convenient tool is Autoruns from Microsoft Sysinternals: it shows every autostart location at once. Enable Options → Hide Microsoft Entries to hide system entries, and turn on the VirusTotal check.

4. Network connections

A miner connects to a mining pool. TCPView (also Sysinternals) shows which process connects to which address. Watch for addresses containing pool, xmr or mine, and connections to ports 3333, 4444, 5555, 7777 or 14444, which pools often use.

5. Antivirus scanners

Run a Microsoft Defender Offline scan (Windows Security → Virus & threat protection → Scan options → “Microsoft Defender Offline scan”). It runs before Windows starts, so the miner has nowhere to hide. Then check the computer with free on-demand scanners such as Malwarebytes or ESET Online Scanner. Download them only from their official websites.

How to remove a hidden miner

1. Disconnect from the internet so the miner cannot download itself again.
2. Run a Microsoft Defender Offline scan and one of the scanners, and remove everything they find.
3. Check autostart in Autoruns and delete any remaining suspicious tasks and services.
4. If the miner prevents removal, boot into Safe Mode (hold Shift and click “Restart” → Troubleshoot → Advanced options → Startup Settings) and repeat the steps.
5. Check the hosts file (C:\Windows\System32\drivers\etc\hosts): miners add antivirus addresses there so you cannot open their sites. Delete the extra lines.
6. Change your passwords for email, Steam and banking — from another, clean device: a password stealer often comes along with a miner.
7. If nothing helps, reinstall Windows from an official Microsoft image.

How to avoid getting infected again

• Do not download cracks, repacks or cheats — they are the main source of miners.
• Buy games from official stores: Steam has frequent sales, and you can even pay with what your PC earns — see “From mining to Steam”.
• Never disable your antivirus because an installer asks you to.
• Keep Windows, your browser and drivers up to date.
• Check suspicious files on VirusTotal before running them.

Honest mining: what is the difference?

Mining itself is not malware — it all comes down to the owner’s consent and who gets the money.

Antivirus software sometimes flags legitimate miners as “potentially unwanted programs” too — precisely because such programs get planted on other people’s computers. If you want your computer to earn for you rather than for an attacker, read “How to make money with your PC”.

Bottom line