How to Find and Remove Cryptominer Malware in Windows 11

The Problem

A cryptominer is malware with an unusual goal: it does not want your files or your passwords, it wants your electricity. It runs your CPU or GPU flat out to mine cryptocurrency for someone else, and the only symptoms are heat, noise, a slow PC, and a higher power bill.

Miners are built to hide. The most common trick is watching for Task Manager and Process Explorer and pausing the moment either opens — so you look, see 5% CPU, and conclude the fans are just dusty.

The two flavours differ in how you remove them:

In-browser miners — JavaScript on a page or in a rogue extension. Stops when you close the tab.
Installed miners — a real process with a scheduled task or service keeping it alive. These need proper removal.

Genuinely just a hot PC? Rule out the boring cause first: CPU overheating and thermal throttling and loud fan noise.

Symptoms

Fans at full speed with nothing open, especially minutes after boot or when the PC is left idle.
CPU or GPU usage high in the background but dropping to normal the second Task Manager opens.
Games stutter and frame rates are far below what the hardware should deliver — see low FPS and stuttering.
A process with a plausible name — svchost, winlogon, nvidia, Runtime Broker — running from %AppData%, %Temp%, or ProgramData instead of C:\Windows\System32.
Network activity to a mining pool even when nothing is open.

The Fix: Step-by-Step

Step 1: Measure the Load Without Being Seen

Because miners watch for Task Manager, use something that logs instead.

Win + R → perfmon → Performance Monitor → add the % Processor Time counter.
Leave the PC alone with the window minimised for ten minutes.
Come back and read the graph.

A miner shows as a flat plateau near 100% that dips only when you interact. Alternatively, watch the fan noise and touch the exhaust vent — sustained heat with an idle-looking Task Manager is the tell.

Step 2: Find the Real Process and Its Path

Task Manager can still find it if you know what to look for.

Ctrl + Shift + Esc → Details tab.
Right-click the column header → Select columns → tick Command line and Image path name.
Sort by CPU. Look at the path, not the name.

Legitimate Windows processes live in C:\Windows\System32 or C:\Windows. Anything called svchost.exe running from C:\Users\You\AppData\Roaming\... is malware, full stop. A command line containing a pool address (stratum+tcp://), a wallet string, or long random arguments is conclusive.

For GPU miners, switch to the Performance tab → GPU and check the Compute graph rather than 3D.

Step 3: Check What It Is Talking To

In Terminal (Admin):

netstat -abno | findstr ESTABLISHED

The -b flag names the executable behind each connection. Mining pools use ports like 3333, 4444, 5555, 7777, and 14444, and hostnames containing pool, xmr, nanopool, or minexmr. Cross-reference the PID with Task Manager's Details tab.

Step 4: Cut the Network, Then Kill It

Disconnect Wi-Fi or unplug the Ethernet cable. This stops the miner phoning home and stops any second-stage download while you work.

Then in Terminal (Admin), using the PID from Step 2:

taskkill /PID 4812 /F

If it reappears within seconds, something is restarting it — that is Step 6.

Step 5: Run a Full Scan and Then an Offline Scan

Settings → Privacy & security → Windows Security → Virus & threat protection → Scan options → Full scan.
When that finishes, run Microsoft Defender Offline scan. The PC restarts into a minimal environment where the miner is not running and cannot hide.

The offline scan is the step that matters. A miner with a driver or a running process can evade a scan performed while it is active.

Full detail on both is in remove virus and malware.

Step 6: Remove What Keeps Restarting It

Killing the process is not removal. Check all four persistence points:

Startup apps — Ctrl + Shift + Esc → Startup apps. Disable anything with a blank or unrecognised publisher.
Scheduled tasks — Win + R → taskschd.msc. Look for tasks with random names, tasks set to run every few minutes, and any task whose action points into %Temp%, %AppData%, or ProgramData.
Services — Win + R → services.msc. Sort by name and look for entries with no description or a gibberish display name.
Run keys — Win + R → regedit → HKCU\Software\Microsoft\Windows\CurrentVersion\Run and the same path under HKLM.

The full method, including what a legitimate entry looks like, is in remove malicious scheduled tasks and startup persistence.

Step 7: Clean the Browser Side

In-browser miners live in extensions and hijacked pages.

Browser → Extensions → remove anything you did not deliberately install.
Reset the browser: Settings → Reset settings.
Check Settings → On startup and your homepage for a page you did not set.

See remove malicious browser extensions and remove a browser hijacker and search redirect.

Step 8: Verify the Machine Is Actually Idle

Reconnect the network. Leave the PC untouched for 15 minutes with Performance Monitor logging. CPU should sit in single digits and the fans should be quiet.

If usage is still high but nothing suspicious is running, the cause may be legitimate — Windows Update, indexing, or an antivirus scan. Check 100% CPU usage in Windows 11.

Step 9: Change Passwords From a Clean Device

Miners are often bundled with infostealers by the same delivery chain. Assume anything saved in the browser was taken. From a phone or another PC, change your email password first, then banking, then everything else — and check exposure with check if your email was in a data breach.

Where It Came From

Almost always one of: a cracked game or "activator", a pirated software installer, a fake driver-updater from a search ad, a browser extension that changed hands, or a malicious mod pack. See avoid malware from fake downloads to close the route.

What Not to Do

Do not just end the task and move on. Without removing the scheduled task or service, it returns within minutes.
Do not trust the process name. Miners deliberately impersonate svchost.exe, dwm.exe, and GPU vendor processes. Path and command line are what identify them.
Do not install a random "miner remover" found by searching the symptom. That search result is itself a common infection route — see remove fake antivirus and scareware.

FAQ

Can a cryptominer damage my hardware?

Not directly, but sustained maximum load for months runs the CPU and GPU hot, ages thermal paste and fan bearings faster, and stresses the power supply. The real cost is electricity and a PC that feels permanently slow. Once removed, check temperatures return to normal.

Why does CPU usage drop when I open Task Manager?

That is deliberate evasion. The miner watches for taskmgr.exe and similar tools and suspends itself while they are open. It is one of the clearest signs you are dealing with a miner rather than a badly behaved legitimate app.

Will Windows Defender catch a cryptominer?

Often yes, particularly with cloud-delivered protection on — miners are widely signatured. The ones that survive arrive with cracked software where people have already added an antivirus exclusion for the folder. Check Virus & threat protection settings → Exclusions and remove anything you did not add deliberately.

Is a browser miner as serious as an installed one?

Less so — closing the tab stops it and there is no persistence. But a page or extension able to run a miner can usually run other scripts too, so treat the extension as compromised and remove it rather than just navigating away.

How do I tell a miner from normal high CPU usage?

Legitimate load has a cause you can name and an end: an update finishes, an export completes, a game closes. A miner's load is constant, resumes after every restart, and continues with no applications open. Perfmon logging over 30 idle minutes settles it.

Do I need to reinstall Windows after finding one?

Usually not, if the offline scan comes back clean and no persistence entries remain. Reinstall if the miner arrived bundled with a cracked activator, if a rootkit is suspected, or if it keeps returning — see remove a rootkit or bootkit and reinstall Windows without losing data.

Still Not Working?

If the load returns after every clean scan and you have cleared all four persistence points, suspect something below Windows — a rootkit or a malicious driver. Work through remove a rootkit or bootkit, and enable Memory Integrity afterwards to block the driver route it used.