# How to Find and Remove Cryptominer Malware in Windows 11

URL: https://www.mytechnician.tech/tips/remove-cryptominer-malware-windows-11/
Published: 2026-08-07 | Author: Ankit Kumar
Tags: Windows 11, Security, Fix, Troubleshooting, Performance
Summary: Fans loud, CPU or GPU pinned when idle, and usage drops the moment you open Task Manager? That is a cryptominer. Here is how to find it and remove it for good.
Recommended app: Ultimate PC Repair Tool — https://www.mytechnician.tech/apps/my-technician/ (Microsoft Store: https://apps.microsoft.com/detail/9PH863L9C6HC?hl=en-us&cid=mytechnician-web). Optional; every step below uses built-in Windows tools.

## The Problem
A **cryptominer** is malware with an unusual goal: it does not want your files or your passwords, it wants your electricity. It runs your CPU or GPU flat out to mine cryptocurrency for someone else, and the only symptoms are heat, noise, a slow PC, and a higher power bill.

Miners are built to hide. The most common trick is watching for Task Manager and Process Explorer and pausing the moment either opens — so you look, see 5% CPU, and conclude the fans are just dusty.

The two flavours differ in how you remove them:

* **In-browser miners** — JavaScript on a page or in a rogue extension. Stops when you close the tab.
* **Installed miners** — a real process with a scheduled task or service keeping it alive. These need proper removal.

> **Genuinely just a hot PC?** Rule out the boring cause first: [CPU overheating and thermal throttling](https://www.mytechnician.tech/tips/fix-cpu-overheating-thermal-throttling/) and [loud fan noise](https://www.mytechnician.tech/tips/fix-loud-fan-noise-windows-11/).

## Symptoms
* Fans at full speed with nothing open, especially minutes after boot or when the PC is left idle.
* CPU or GPU usage high in the background but **dropping to normal the second Task Manager opens**.
* Games stutter and frame rates are far below what the hardware should deliver — see [low FPS and stuttering](https://www.mytechnician.tech/tips/fix-low-fps-stuttering-games-windows-11/).
* A process with a plausible name — `svchost`, `winlogon`, `nvidia`, `Runtime Broker` — running from `%AppData%`, `%Temp%`, or `ProgramData` instead of `C:\Windows\System32`.
* Network activity to a mining pool even when nothing is open.

## The Fix: Step-by-Step

### Step 1: Measure the Load Without Being Seen
Because miners watch for Task Manager, use something that logs instead.

1. `Win + R` → `perfmon` → **Performance Monitor** → add the **% Processor Time** counter.
2. Leave the PC alone with the window minimised for ten minutes.
3. Come back and read the graph.

A miner shows as a flat plateau near 100% that dips only when you interact. Alternatively, watch the fan noise and touch the exhaust vent — sustained heat with an idle-looking Task Manager is the tell.

### Step 2: Find the Real Process and Its Path
Task Manager can still find it if you know what to look for.

1. `Ctrl + Shift + Esc` → **Details** tab.
2. Right-click the column header → **Select columns** → tick **Command line** and **Image path name**.
3. Sort by CPU. Look at the **path**, not the name.

Legitimate Windows processes live in `C:\Windows\System32` or `C:\Windows`. Anything called `svchost.exe` running from `C:\Users\You\AppData\Roaming\...` is malware, full stop. A command line containing a pool address (`stratum+tcp://`), a wallet string, or long random arguments is conclusive.

For GPU miners, switch to the **Performance** tab → **GPU** and check the **Compute** graph rather than 3D.

### Step 3: Check What It Is Talking To
In **Terminal (Admin)**:

```
netstat -abno | findstr ESTABLISHED
```

The `-b` flag names the executable behind each connection. Mining pools use ports like 3333, 4444, 5555, 7777, and 14444, and hostnames containing `pool`, `xmr`, `nanopool`, or `minexmr`. Cross-reference the PID with Task Manager's Details tab.

### Step 4: Cut the Network, Then Kill It
Disconnect Wi-Fi or unplug the Ethernet cable. This stops the miner phoning home and stops any second-stage download while you work.

Then in **Terminal (Admin)**, using the PID from Step 2:

```
taskkill /PID 4812 /F
```

If it reappears within seconds, something is restarting it — that is Step 6.

### Step 5: Run a Full Scan and Then an Offline Scan
1. **Settings** → **Privacy & security** → **Windows Security** → **Virus & threat protection** → **Scan options** → **Full scan**.
2. When that finishes, run **Microsoft Defender Offline scan**. The PC restarts into a minimal environment where the miner is not running and cannot hide.

The offline scan is the step that matters. A miner with a driver or a running process can evade a scan performed while it is active.

Full detail on both is in [remove virus and malware](https://www.mytechnician.tech/tips/remove-virus-malware-windows-11/).

### Step 6: Remove What Keeps Restarting It
Killing the process is not removal. Check all four persistence points:

1. **Startup apps** — `Ctrl + Shift + Esc` → **Startup apps**. Disable anything with a blank or unrecognised publisher.
2. **Scheduled tasks** — `Win + R` → `taskschd.msc`. Look for tasks with random names, tasks set to run every few minutes, and any task whose action points into `%Temp%`, `%AppData%`, or `ProgramData`.
3. **Services** — `Win + R` → `services.msc`. Sort by name and look for entries with no description or a gibberish display name.
4. **Run keys** — `Win + R` → `regedit` → `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and the same path under `HKLM`.

The full method, including what a legitimate entry looks like, is in [remove malicious scheduled tasks and startup persistence](https://www.mytechnician.tech/tips/remove-malicious-scheduled-tasks-startup-persistence-windows-11/).

### Step 7: Clean the Browser Side
In-browser miners live in extensions and hijacked pages.

1. Browser → **Extensions** → remove anything you did not deliberately install.
2. Reset the browser: **Settings** → **Reset settings**.
3. Check **Settings** → **On startup** and your homepage for a page you did not set.

See [remove malicious browser extensions](https://www.mytechnician.tech/tips/remove-malicious-browser-extensions-windows-11/) and [remove a browser hijacker and search redirect](https://www.mytechnician.tech/tips/remove-browser-hijacker-search-redirect/).

### Step 8: Verify the Machine Is Actually Idle
Reconnect the network. Leave the PC untouched for 15 minutes with Performance Monitor logging. CPU should sit in single digits and the fans should be quiet.

If usage is still high but nothing suspicious is running, the cause may be legitimate — Windows Update, indexing, or an antivirus scan. Check [100% CPU usage in Windows 11](https://www.mytechnician.tech/tips/fix-100-percent-cpu-usage-windows-11/).

### Step 9: Change Passwords From a Clean Device
Miners are often bundled with infostealers by the same delivery chain. Assume anything saved in the browser was taken. From a phone or another PC, change your email password first, then banking, then everything else — and check exposure with [check if your email was in a data breach](https://www.mytechnician.tech/tips/check-if-your-email-was-in-a-data-breach/).

## Where It Came From
Almost always one of: a cracked game or "activator", a pirated software installer, a fake driver-updater from a search ad, a browser extension that changed hands, or a malicious mod pack. See [avoid malware from fake downloads](https://www.mytechnician.tech/tips/avoid-malware-fake-downloads/) to close the route.

## What Not to Do
* **Do not just end the task and move on.** Without removing the scheduled task or service, it returns within minutes.
* **Do not trust the process name.** Miners deliberately impersonate `svchost.exe`, `dwm.exe`, and GPU vendor processes. Path and command line are what identify them.
* **Do not install a random "miner remover"** found by searching the symptom. That search result is itself a common infection route — see [remove fake antivirus and scareware](https://www.mytechnician.tech/tips/remove-fake-antivirus-scareware-windows-11/).

## FAQ

### Can a cryptominer damage my hardware?
Not directly, but sustained maximum load for months runs the CPU and GPU hot, ages thermal paste and fan bearings faster, and stresses the power supply. The real cost is electricity and a PC that feels permanently slow. Once removed, check temperatures return to normal.

### Why does CPU usage drop when I open Task Manager?
That is deliberate evasion. The miner watches for `taskmgr.exe` and similar tools and suspends itself while they are open. It is one of the clearest signs you are dealing with a miner rather than a badly behaved legitimate app.

### Will Windows Defender catch a cryptominer?
Often yes, particularly with cloud-delivered protection on — miners are widely signatured. The ones that survive arrive with cracked software where people have already added an antivirus exclusion for the folder. Check **Virus & threat protection settings** → **Exclusions** and remove anything you did not add deliberately.

### Is a browser miner as serious as an installed one?
Less so — closing the tab stops it and there is no persistence. But a page or extension able to run a miner can usually run other scripts too, so treat the extension as compromised and remove it rather than just navigating away.

### How do I tell a miner from normal high CPU usage?
Legitimate load has a cause you can name and an end: an update finishes, an export completes, a game closes. A miner's load is constant, resumes after every restart, and continues with no applications open. Perfmon logging over 30 idle minutes settles it.

### Do I need to reinstall Windows after finding one?
Usually not, if the offline scan comes back clean and no persistence entries remain. Reinstall if the miner arrived bundled with a cracked activator, if a rootkit is suspected, or if it keeps returning — see [remove a rootkit or bootkit](https://www.mytechnician.tech/tips/remove-rootkit-bootkit-windows-11/) and [reinstall Windows without losing data](https://www.mytechnician.tech/tips/reinstall-windows-without-losing-data/).

## Still Not Working?
If the load returns after every clean scan and you have cleared all four persistence points, suspect something below Windows — a rootkit or a malicious driver. Work through [remove a rootkit or bootkit](https://www.mytechnician.tech/tips/remove-rootkit-bootkit-windows-11/), and enable [Memory Integrity](https://www.mytechnician.tech/tips/enable-core-isolation-memory-integrity-windows-11/) afterwards to block the driver route it used.

Related: [remove virus and malware](https://www.mytechnician.tech/tips/remove-virus-malware-windows-11/), [100% CPU usage in Windows 11](https://www.mytechnician.tech/tips/fix-100-percent-cpu-usage-windows-11/), [how to read Event Viewer](https://www.mytechnician.tech/tips/how-to-read-event-viewer-find-crash-cause/).

---
Source: https://www.mytechnician.tech/tips/remove-cryptominer-malware-windows-11/ — My Technician, free Windows 10/11 troubleshooting guides.
Related tool: Ultimate PC Repair Tool (Ultimate PC Repair Tool is a Windows diagnostic and repair toolkit with system analysis, automated troubleshooting, and hardware checks for Windows 10/11.) — https://www.mytechnician.tech/apps/my-technician/
More guides: https://www.mytechnician.tech/llms.txt