How to Remove a Cryptominer From Windows

What Causes This?

A cryptominer infection happens when malware gets onto your PC and secretly uses your CPU or GPU to mine cryptocurrency for someone else. It often arrives through fake software installers, cracked apps, malicious browser extensions, phishing attachments, or bundled downloads from untrusted sites. Some cryptominers also create scheduled tasks, startup entries, or hidden processes so they keep running after a reboot.

Common Symptoms

• CPU or GPU usage stays unusually high even when you are not doing much
• Fans run loudly all the time and the PC feels hotter than normal
• Windows becomes slow, laggy, or freezes during basic tasks
• Battery drains quickly on a laptop
• Unknown processes, browser extensions, or scheduled tasks keep reappearing

How to Fix It Manually

1. Check for suspicious processes in Task Manager

   • Open Task Manager with Ctrl+Shift+Esc.
   • Click More details if needed.
   • On the Processes tab, sort by CPU and then Memory.
   • Look for unknown apps using a lot of resources when your PC should be idle.
   • Right-click a suspicious process and choose Open file location. Make note of the folder path.
   • If it clearly looks malicious or unrelated to software you installed, right-click it and choose End task.

2. Disable suspicious startup items

   • In Task Manager, open the Startup apps tab.
   • Look for unknown entries, especially with no publisher name or strange names.
   • Right-click suspicious items and choose Disable.
   • Restart your PC and check whether CPU usage drops.

3. Scan Windows with Microsoft Defender

   • Open Start, type Windows Security, and press Enter.
   • Go to Virus & threat protection.
   • Click Scan options.
   • Run a Full scan first.
   • If the issue continues, run Microsoft Defender Offline scan. This restarts the PC and checks for malware before Windows fully loads.

4. Remove suspicious apps and browser extensions

   • Open Settings > Apps > Installed apps.
   • Sort by Install date and uninstall anything unfamiliar or recently added before the problem started.
   • Then check your browser extensions:
     • Chrome/Edge: Open the browser menu, then Extensions
     • Remove anything you do not recognize or did not intentionally install
   • Cryptominers sometimes run through malicious extensions, especially if high usage starts only when the browser is open.

5. Check Task Scheduler for persistence

   • Open Start, type Task Scheduler, and press Enter.
   • Click Task Scheduler Library.
   • Review tasks with random names, strange triggers, or actions that launch files from AppData, Temp, or unusual folders.
   • Right-click suspicious tasks and choose Disable or Delete.

6. Delete leftover files from suspicious locations

   • Press Win+R, type %AppData%, and press Enter.
   • Also check %LocalAppData% and %Temp%.
   • Look for folders or executable files tied to the suspicious process you found earlier.
   • Delete them if you are sure they are not part of legitimate software.
   • Empty the Recycle Bin afterward.

7. Update Windows and change important passwords

   • Go to Settings > Windows Update and install all available updates.
   • If you downloaded malware through a fake installer or browser hijack, change passwords for important accounts, especially email and banking.
   • This helps close security gaps and limits damage if the infection included more than just mining.

Fix It Automatically with Kudu

Kudu can help find suspicious files, startup entries, and other junk that keeps a cryptominer running in the background. It gives you a faster way to reduce system strain, clean up unwanted persistence points, and get your PC back to normal without digging through every Windows folder yourself.

Download Kudu Free →