Is it safe to add XMRig to my antivirus exclusions?
Adding XMRig to your antivirus exclusions can be reasonable, but only if you installed it deliberately, checked its source, and understand why it was flagged. An exclusion creates a blind spot in your protection, so you should not add one just because a mining guide tells you to.
Why antivirus software flags XMRig
XMRig is an open-source mining program, meaning its source code is available for inspection. It can use your computer’s processor to mine Monero. It runs as a separate program, not as ordinary code inside a browser page.
Attackers also use XMRig to mine on other people’s computers without permission. Because of that, antivirus tools may flag even an unmodified copy as a “coin miner” or “potentially unwanted application.” That label does not automatically mean your download contains a virus.
But the opposite is also true: seeing “XMRig” in a warning does not prove the file is harmless. A malicious package can include a real miner alongside software that steals passwords or gives someone remote access.
Check the file before allowing it
Before you make an exception, pause and check:
- Did you install it yourself? If XMRig appeared unexpectedly, do not exclude it. Let your antivirus quarantine it and investigate how it arrived.
- Where did you get it? Use the official XMRig project’s release source. Avoid copies from ads, private messages, video descriptions, or “preconfigured profit boosters.”
- Can you verify the download? Where the project provides a checksum, compare it with your file’s checksum. This is a digital fingerprint used to check that files match. Get the reference from a trusted project source, not just the same unknown download page.
- What exactly was detected? Read the full alert. A generic mining classification is different from a warning about password theft or another malicious component.
A checksum match helps confirm that you have the expected file. It does not guarantee that software is risk-free. If the warning remains unclear, ask your antivirus vendor to review the detection rather than guessing.
Keep any exception as narrow as possible
If you decide to proceed, use the smallest exception your antivirus supports.
Prefer an exception for the verified executable over excluding an entire folder. Some products support exceptions tied to a file’s fingerprint; others allow only file paths. A path-based exception may also trust a different file that later replaces the original.
Avoid excluding:
- Your Downloads folder or a whole drive.
- Broad folders where other programs can save files.
- Every program classified as a miner.
Do not turn off antivirus protection globally. Avoid running XMRig with administrator privileges unless you understand the specific reason. Recheck replacement files after updates, and remove the exception when you stop using the miner.
Watch what happens afterward
An antivirus exception does not make mining itself harmless. Mining can increase electricity use, heat, fan noise, and system slowdowns. Limit processor use and monitor temperatures.
Check that XMRig’s settings point to the mining service and payout address you intended. Treat unexplained changes, unexpected startup behavior, or requests for your wallet’s recovery phrase as warning signs. Mining software does not need that phrase.
The bottom line
Only exclude a verified XMRig copy that you intentionally installed on a device you own or are authorized to manage. Keep the exception narrow, leave other protections active, and never dismiss an unexplained warning just because miners are commonly flagged.
