How do I remove XMRig that was installed by a virus?

If a virus installed XMRig on your computer, you need to remove both the miner and the malware that put it there. Deleting the XMRig file alone may not work because the malware can restart it or download it again. XMRig itself is legitimate mining software, but running it on your device without your permission is unauthorized use.

Stop the mining and isolate your computer

Disconnect the affected computer from Wi-Fi and unplug its network cable. This interrupts mining connections and limits the malware’s ability to contact whoever controls it.

Save essential work, then use your system’s process viewer to look for unusual CPU use. The CPU is your computer’s main processor:

• Windows: Open Task Manager with Ctrl + Shift + Esc.
• macOS: Open Activity Monitor.
• Linux: Open your system monitor, or use top if you are comfortable with the terminal.

A process named xmrig is a clue, but malware can rename it. High CPU use alone does not prove an infection.

If possible, note the suspicious process’s file location before stopping it. Ending the process can reduce heat and noise, but it does not remove the infection. If this is a work or school computer, contact your IT team before changing anything.

Scan for the malware, not just XMRig

On Windows, open Windows Security → Virus & threat protection → Scan options. Run a full scan and then Microsoft Defender Offline scan, which restarts your computer and checks for threats outside your normal Windows session.

Update your security software first if you can do so safely. If necessary, use a clean device to download a trusted scanner or its updates from the vendor’s official website. Avoid “XMRig removal tools” promoted through pop-ups or unfamiliar download sites.

On macOS or Linux, use a reputable security scanner that supports your system. If you cannot confidently investigate the infection, get help from a trusted technician.

Let the scanner quarantine detected files. Quarantine isolates them so they cannot run. Do not restore a detection just because XMRig also has legitimate uses.

Find what keeps bringing it back

Malware often creates persistence: a way to launch again after you restart or sign in. Check these areas, preferably with your security software or a technician’s help:

• Windows: Startup apps, Task Scheduler, and services.
• macOS: Login Items, LaunchAgents, and LaunchDaemons.
• Linux: Scheduled jobs called cron jobs, systemd services, and desktop autostart entries.

Look for entries pointing to the suspicious file location. Do not delete unfamiliar system entries at random.

Remove suspicious recently installed apps and browser extensions. Check that antivirus protection is enabled and review exclusions—settings that tell antivirus software to skip certain files. Malware may have added its folder there.

Protect your accounts and verify the cleanup

A miner infection may arrive alongside password-stealing malware. From a different, clean device, change important passwords, sign out other sessions, and enable two-factor authentication, which adds another check when you log in.

After cleanup, restart and scan again. Check whether suspicious processes or startup entries return, then install operating-system and browser updates.

If the infection returns, security tools remain disabled, or you cannot establish what changed, reinstall the operating system using trusted installation media. Back up personal documents first, but avoid restoring unknown programs, scripts, or a full infected-system backup.

The bottom line

Stopping XMRig stops the workload, not necessarily the virus. Remove the malware and its restart mechanisms, protect your accounts, and verify the cleanup—or use a clean reinstall when you cannot trust the system.