How to remove a hidden crypto miner from Windows
Updated November 2, 2026 · 3 min read
Deleting a miner's file almost never works by itself. Miners install a "restarter" such as a scheduled task, a service or a startup entry that puts the file back within minutes. Removing a miner means removing all of the pieces, in the right order.
These steps are for Windows 10 and 11. If you have not confirmed that it is a miner yet, start with how to tell if your computer is mining crypto.
1. Write down what you found
In Task Manager, right-click the busy process, choose Open file location, and note the full folder path and file name. Take a phone photo if that is easier. You will need the path in the steps below.
2. Disconnect from the internet
Unplug the network cable or turn off Wi-Fi. This stops the miner from reporting in, and stops its restarter from downloading a fresh copy while you work.
3. Stop the process
In Task Manager, right-click the process and choose End task. If it reappears within seconds, something is restarting it; carry on with the next step and come back.
4. Remove what restarts it
Check each of these places for an entry that points at the folder you wrote down:
- Scheduled tasks. Open Task Scheduler, click Task Scheduler Library, and look at the Actions tab of anything unfamiliar. Right-click a task that runs the miner and choose Disable (you can delete it once you are sure).
- Services. Press Windows + R, type
services.msc, press Enter. Look for a service with a vague name whose Path to executable (double-click it) is in AppData, ProgramData or Temp. Set Startup type to Disabled and click Stop. - Startup apps. Task Manager > Startup apps (the Startup tab on Windows 10): right-click the entry and choose Disable.
- Run keys. For confident users only: in Registry Editor, check
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runand the same path underHKEY_LOCAL_MACHINE. Back up a key before deleting anything from it.
5. Delete the files
With the restarters disabled, restart the PC (still offline), confirm the miner did not come back, then delete its folder. Empty the Recycle Bin afterwards.
6. Undo what it did to your defenses
- Defender exclusions: Windows Security > Virus & threat protection > Manage settings > Exclusions. Remove anything you did not add yourself.
- Real-time protection: on the same page, make sure it is turned on. If the switch is greyed out with a note that settings are managed by your organization on a home PC, malware may have planted a policy to keep it off.
- Hosts file: some miners block antivirus update sites by editing
C:\Windows\System32\drivers\etc\hosts. On a home PC it normally contains only comment lines starting with#.
7. Run an offline scan
Reconnect to the internet, update Windows Security, then run Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline scan. It restarts the PC and scans before Windows (and anything hiding in it) loads. It takes about 15 minutes.
8. Ask how it got in
Most miners arrive bundled with something else: a cracked game or program, a fake browser update, a "free" download from an unofficial site. Uninstall anything from that period you do not trust. If the miner came alongside a remote-control tool, or you find user accounts you did not create, change your important passwords from a different device, and seriously consider resetting Windows (Settings > System > Recovery > Reset this PC; on Windows 10, Settings > Update & Security > Recovery). A reset is the only way to be fully certain.
9. Check again in a few days
Run the idle test from the first guide again after a few days of normal use. A miner that came back means one restarter was missed.