Why does my antivirus flag XMRig as a virus?

Your antivirus may flag XMRig because it is mining software, and criminals often use mining software to run up someone else’s electricity bill without permission. A warning does not automatically mean your copy is a virus, but you should check where it came from and whether you chose to install it before allowing it to run.

Why legitimate mining software gets flagged

XMRig is an open-source mining program, meaning its source code is publicly available for inspection. You can use it to mine Monero with your CPU, your computer’s main processor.

The problem is that attackers also use XMRig for cryptojacking: secretly mining on someone else’s device. They may bundle it with a fake download, install it through a security weakness, or disguise it as a background service.

Antivirus tools therefore sometimes flag the miner itself, even when it is an authentic copy. The same program can be legitimate when you install it knowingly and unwanted when someone installs it behind your back.

That makes “false positive” only part of the story. Your antivirus may correctly recognize mining software while being unable to tell whether you gave permission.

What the warning actually tells you

Look at the full detection name and the location of the flagged file. Different antivirus products use different labels, but common examples include:

• CoinMiner or Riskware: The tool recognizes mining software or software that could be misused. This alone does not prove an infection.
• Potentially unwanted application: The program may consume resources or arrive bundled with something you did not ask for.
• Trojan: A more serious warning that may indicate disguised malicious software. Still, the label alone cannot establish exactly what your file does.

A flag inside the folder where you deliberately extracted XMRig is different from a miner you discover unexpectedly in a temporary folder. Neither location proves safety or danger, but it helps you understand what happened.

If you downloaded XMRig yourself

Leave the file quarantined—isolated by your antivirus—until you have checked it.

Confirm that you obtained it from the official XMRig project, rather than an advertisement, a message attachment, or a “preconfigured profit booster.” If the release provides a checksum, a digital fingerprint of the download, compare it with your file. A match helps confirm that the file matches that release; it does not guarantee safety.

You can also review a reputable multi-engine scanning service’s results. Several generic miner detections are not the same as clear evidence of added malicious code. Equally, a clean result is not a guarantee.

Only consider a narrowly scoped antivirus exception after you trust the source and understand the warning. Do not disable your antivirus or exclude your entire Downloads folder. A guide that demands broad exclusions without explaining why is a warning sign.

If you did not install it

Treat an unexpected XMRig detection as a possible compromise, not a harmless nuisance.

• Keep it quarantined and run a full security scan.
• Update your operating system and security software.
• Check recently installed programs and unexpected startup items.
• Get trusted technical help if the miner returns after removal.

Removing the miner may not remove whatever installed it. On a work or school computer, contact your IT team rather than changing security settings yourself.

The bottom line

XMRig gets flagged because legitimate mining and unauthorized mining can use the same software. Your safest decision depends on where the file came from, whether you approved its installation, and what your security tools found—not simply whether the filename says “XMRig.”