Guides

How to tell if your computer is secretly mining cryptocurrency

Updated November 2, 2026 · 4 min read

A hidden crypto miner is a program that uses your computer's processor or graphics card to earn cryptocurrency for someone else. You pay for it in electricity, heat, noise and a slower, shorter-lived PC. Miners rarely steal files or lock your screen, so many people live with one for months without knowing.

Here is how to tell, using tools already built into Windows 10 and 11.

The warning signs

• The fans roar when you are not doing anything. A PC that sits on the desktop should be quiet. A miner works hardest when you are away.
• Everything feels slow, even simple things like opening the Start menu or typing in a browser.
• The case or laptop feels hot at idle, or a laptop's battery drains much faster than it used to.
• The power bill went up with no new appliance to blame. A gaming PC mining around the clock can draw several hundred watts, day and night.
• The noise stops the moment you open Task Manager. Many miners are written to pause when they see Task Manager or other monitoring tools, then start again when you close them. If the PC is loud until you look, and quiet while you look, that is a strong clue.

None of these signs proves a miner on its own. Windows updates, antivirus scans and dust-clogged fans cause some of them too. The checks below separate the two.

Check 1: Task Manager at idle

1. Close every program, including the browser.
2. Press Ctrl + Shift + Esc to open Task Manager. If it opens in the small view, click More details.
3. On the Processes page, click the CPU column header to sort by usage. Right-click any column header and turn on GPU too; miners often use the graphics card.
4. Wait two minutes without touching anything, then look again.

With nothing open, total CPU use should settle well under 10 percent. Anything taking 30 percent or more for minutes at a time, with no window open, deserves a closer look.

Check 2: Where the busy program lives

Right-click the busy process and choose Open file location. Genuine Windows programs live in C:\Windows or C:\Program Files. Miners hide in places like:

• C:\Users\you\AppData\Roaming or AppData\Local\Temp
• C:\ProgramData in a folder with a random or official-sounding name
• A folder named after a Windows component, but outside C:\Windows

Be suspicious of names that imitate Windows with one letter off (svch0st.exe, scvhost.exe, WindowsDefender.exe), and of any file named xmrig.exe, the most common mining program.

Check 3: The idle test the miner cannot see

Because some miners pause while Task Manager is open, use a quieter method:

1. Close Task Manager and every other program.
2. Walk away for ten minutes. Listen when you come back, before you touch the mouse.
3. If the fans are loud, press Ctrl + Shift + Esc and watch the CPU graph on the Performance page for the first few seconds. A miner that is pausing shows a cliff: high usage that drops sharply right after Task Manager opens.

Check 4: Connections to mining pools

Miners send their work to a "mining pool" server over the internet. To see what your PC is talking to:

1. Press the Windows key, type resmon, and press Enter to open Resource Monitor.
2. Open the Network tab and expand TCP Connections.
3. Look for a program you do not recognize holding a steady connection, especially to remote ports such as 3333, 4444, 5555, 7777 or 14444. Those ports are commonly used by mining pools, although some miners use ordinary web ports to blend in.

Check 5: What starts it again after a reboot

A miner that only ran once would not be much of a business. Look for what brings it back:

• Task Manager > Startup apps (the Startup tab on Windows 10): anything you do not recognize, especially with no publisher listed.
• Task Scheduler (search for it in Start): open Task Scheduler Library and look for tasks with odd names that run a program from AppData, ProgramData or Temp.
• Windows Security > Virus & threat protection > Manage settings > Exclusions: miners often add their own folder here so Defender stops looking. You should recognize everything on that list.

Do not forget the browser

Some websites and browser extensions mine in the background while a tab is open. If the fans only spin while the browser runs, close tabs one at a time, then disable extensions you did not deliberately install.

If you find a miner

Do not just delete the file: the task or service that started it will download it again. Follow our step-by-step removal guide. And treat the miner as a symptom: whatever installed it may have installed something else, such as a remote-control tool. Here is how to check for that.