How do I know if my computer is infected with a crypto miner?

Your computer might have an unwanted crypto miner if it stays unusually busy, hot, or noisy when you are not doing much. Those signs alone do not prove an infection: the strongest clues are a process you cannot explain, activity that keeps returning, and a security scan that identifies mining software you did not approve.

Look for a pattern, not just a loud fan

A crypto miner uses your computer’s processing power to help run a cryptocurrency network and earn rewards. When someone does that without your permission, it is often called cryptojacking.

Watch for several signs together:

• Your fans run hard while your computer should be idle.
• Your laptop feels unusually hot or its battery drains faster.
• Everyday tasks become slow for no obvious reason.
• Security software reports a miner or a suspicious download.
• The same unexplained activity returns after restarting.

Updates, video calls, games, and photo tools can cause similar symptoms. Some unwanted miners also slow themselves down to avoid attention, so a quiet computer is not a guarantee that everything is fine.

Check what is using your computer

Save your work, close demanding apps, and give your computer a few minutes to settle.

On Windows, open Task Manager with Ctrl + Shift + Esc. On macOS, open Activity Monitor through Spotlight. Sort the processes—the programs and background tasks currently running—by CPU, your computer’s main processor. Check GPU activity too, where available; the GPU is the chip that handles graphics and some other calculations.

Look for a process that stays busy without a clear reason. Monero mining mainly uses the CPU, so normal GPU activity does not rule it out.

Before stopping or deleting anything:

• Note the process name and its file location.
• Check whether it belongs to an app you installed.
• Check its publisher or digital signature, if available.
• Search for information from reputable security sources.

A strange name is not proof of malware, and a familiar-looking name is not proof of safety. Do not delete system files just because they look unfamiliar.

Separate browser activity from a lasting infection

Close all browser windows, then check your system monitor again. Some browsers keep background processes running, so confirm those have stopped too.

If the heavy activity disappears, reopen your browser without restoring every tab. Open sites one at a time and review your extensions. Remove extensions you do not recognize or no longer need.

A webpage can run unwanted mining code while it is open without installing a lasting infection. If the activity continues after the browser fully closes, another app or background task may be responsible.

Mining you deliberately started is different from infection. Even then, you should be able to stop it, and the service should clearly explain its resource use.

Confirm it with a security scan

Update your operating system and trusted security software, then run a full scan. On Windows, Microsoft Defender Offline can help check for threats that hide while Windows is running.

Let your security tool quarantine detected threats. Avoid pop-ups offering a “miner cleaner,” and never disable antivirus because a mining site tells you to.

If detections return, disconnect from the internet and get help from a trusted technician. Repeated removal failures can mean another program is reinstalling the miner.

The bottom line

Heat and slowdowns are clues, not a diagnosis. Check which process is responsible, test whether closing your browser stops it, and use a trusted scan to confirm whether the activity is unwanted.