How to detect cryptojacking and remove a miner from your PC

CPU at 90% with no program open. A laptop that runs hot all day. The fan spinning up while you edit a text document. Those signs can mean someone is using your processor to mine cryptocurrency — without authorization, without warning and, in most cases, without you noticing for months.

What cryptojacking is

Cryptojacking is the unauthorized use of someone else's hardware to mine cryptocurrency. The attacker profits from the coin generated; you pay the electricity bill, deal with degraded hardware and never understand why the system is slow.

The word combines cryptocurrency with hijacking. It's a category of malware that, unlike ransomware or keyloggers, doesn't destroy data or steal passwords directly — the goal is to stay invisible for as long as possible so it can keep using your resources.

How it works technically

There are two main infection routes:

• Browser-based script: you visit a compromised or malicious site that loads JavaScript running mining in the background. Closing the site ends the problem — though some scripts keep going via a hidden pop-under window. No file is installed at all.
• Malware installed on the system: a file downloaded from an untrusted source, a malicious browser extension or pirated software with a miner bundled in. This type persists even after you restart the computer.

Cryptojackers' cryptocurrency of choice is Monero (XMR). Unlike Bitcoin, Monero is designed to be mined by an ordinary CPU, doesn't require a powerful GPU and is hard to trace on the blockchain. That combination of low hardware requirements and anonymity makes it ideal for this kind of attack.

Signs your PC may be affected

What are the main symptoms of cryptojacking?

Persistently high CPU, a slow system and hardware running hot for no apparent reason are the three most common signs. Other indicators:

• Laptop fan at maximum with only a few browser tabs open
• Battery draining far faster than normal
• The PC stuttering on simple tasks like editing text or browsing
• An unknown process consuming 30–80% of the CPU in Task Manager
• A spike in CPU usage when you open certain specific web pages
• An electricity bill climbing with no change in how you use appliances

The important detail: attackers usually calibrate usage to 30–50% of the CPU, not 100%, precisely so it's less noticeable. Constant usage at a middling level is more suspicious than sporadic spikes.

How to detect it on Windows

Start with Task Manager:

Ctrl + Shift + Esc → "Processes" tab → click the "CPU" column to sort

Suspicious processes tend to have generic names (svchost.exe with abnormally high usage, update.exe from an unknown vendor) or names that mimic legitimate Windows processes. The most popular miner, XMRig, sometimes shows up under its own name or disguised as a system service.

To investigate a suspicious process, right-click it → "Open file location". If the path isn't C:\Windows\System32 or the folder of a program you intentionally installed, that's a warning sign.

It's also worth checking scheduled tasks, since miners often use them to restart themselves:

Win + R → taskschd.msc → Task Scheduler Library

Look for tasks with no clear description or with commands pointing at temporary folders (%AppData%, %Temp%).

How to detect it in the browser

If the problem only appears when the browser is open, the miner is probably script-based. In Chrome, press Shift + Esc to open the browser's own task manager and see which tab is consuming a disproportionate share of the CPU.

Extensions that block mining scripts:

• uBlock Origin — free, blocks mining domains by default alongside ads
• NoCoin — a blocklist focused specifically on cryptocurrency miners
• MinerBlock — detects mining scripts in real time with a visual indicator

If CPU usage drops sharply once you install one of these, the site you were visiting was mining on your hardware.

How to remove an installed miner

If the problem persists even with the browser closed, the miner is installed as malware. Follow this sequence:

1. Run Malwarebytes Free in a full scan — it detects XMRig and its variants without a permanent installation
2. Check installed programs: Settings → Apps → look for software you don't recognize
3. Review scheduled tasks (taskschd.msc) and startup entries: Win + R → msconfig → Startup tab
4. If the miner resists, reboot into Safe Mode and repeat the scan — in Safe Mode, persistence services don't load

If the problem survives all of that, consider a clean reinstall of the system. It's the most drastic option, but it's definitive.

How to protect yourself

• Keep the OS and browser updated — most drive-by installs exploit known vulnerabilities that already have a patch available
• Install uBlock Origin (it handles malicious ads and browser miners at the same time)
• Avoid pirated software — it's the main vector for locally installed miners
• Review your browser extensions regularly, especially any that ask for permission to "read and change data on all sites"
• Use a DNS with malware filtering such as NextDNS, which blocks cryptojacking domains at the network layer, before the script even reaches the browser
• Monitor CPU usage regularly — five minutes a week in Task Manager saves you months of degraded hardware

Is it a crime?

Yes, in essentially every jurisdiction with computer-crime legislation. Using someone else's computing resources without authorization falls under unauthorized-access and criminal-damage statutes — in the United States, the Computer Fraud and Abuse Act; in the UK, the Computer Misuse Act; in Brazil, articles 154-A and 163 of the Penal Code, added by Law 12.737/2012, with sentences from 1 to 5 years plus damages for the harm to the equipment and the electricity bill.

Conclusion

Cryptojacking is rarely detected because attackers calibrate CPU usage to avoid drawing attention. Thirty percent of constant usage is less noticeable than a hundred, but multiplied across thousands of infected machines it's lucrative enough. If your PC is slow with no clear explanation, ten minutes in Task Manager and installing uBlock Origin already eliminate most browser-based cases. For installed malware, Malwarebytes in Safe Mode resolves the majority. If you want to understand other threats that operate just as quietly, the article on how to detect keyloggers on your system shows a very similar pattern of concealment.