How do I check whether XMRig on my PC was installed by me or by malware?

You can check whether XMRig was installed by you by tracing where it runs from, how it starts, and what mining settings it uses. XMRig is a legitimate Monero mining program, but malware can install it without your permission—so its name alone does not tell you whether it is safe.

Start with what you recognize

Ask yourself whether you ever installed XMRig, followed a mining guide, or allowed mining software on this PC. Check your downloads, browser history, and any folders where you keep mining tools.

If you knowingly installed it, look for settings you remember choosing:

• A mining pool—the service that combines miners’ work and distributes payments.
• A wallet address—the destination used to receive mining payments.
• Limits on how much of your processor the miner can use.

An unfamiliar wallet address is a warning sign, but not proof of malware. Some mining services use their own payment arrangements. Compare the settings with your original setup notes or service instructions.

If this is a work or shared PC, ask its owner or administrator before changing anything.

Find the running file and its instructions

On Windows, open Task Manager with Ctrl + Shift + Esc. Find the suspected process, right-click it, and choose Open file location. Malware may rename XMRig, so do not rely only on finding “xmrig.exe.”

In Task Manager’s Details tab, right-click a column heading, choose Select columns, and enable Command line. This shows the instructions used to launch the program.

Look for:

• The program’s full folder path.
• A configuration file, often called config.json.
• A pool address and wallet or account details.
• Another program or script that launches the miner.

Read configuration files with a text editor; do not run unfamiliar scripts. A temporary folder, misleading filename, or hidden directory deserves scrutiny, but legitimate mining tools can also live outside Program Files.

Avoid sharing full configuration files publicly. They may contain account details or passwords.

Check whether it starts without your knowledge

Look in Task Manager → Startup apps and Windows Task Scheduler. Also check the Services app for unfamiliar entries. Inspect their file paths and launch instructions rather than judging by their names.

Stronger warning signs include:

• The miner returns after you stop it.
• A scheduled task repeatedly downloads or relaunches it.
• Antivirus protection was disabled or exclusions were added without your approval.
• It runs under an unfamiliar account or alongside other suspicious programs.

Heavy processor use, heat, and fan noise only show that something is working hard. They do not establish who installed it. File dates are clues too, not reliable proof.

Verify it and respond safely

Scan the file and your PC with an updated security product. On Windows, consider a full Microsoft Defender scan followed by Microsoft Defender Offline, which checks for threats after restarting.

A detection labeled “coin miner” or “potentially unwanted application” may flag legitimate mining software. Read the detection details and weigh them against the installation evidence.

Even a file matching an official XMRig release could have been installed by malware. Authentic software does not prove your consent.

If you suspect an unauthorized installation, disconnect from the internet and let security software quarantine it. Do not simply delete the executable: a separate malicious program may reinstall it.

The bottom line

The key is whether XMRig’s location, settings, and startup method match something you authorized. If they do not, treat it as suspicious and investigate the whole PC—not just the miner.