Why is XMRig running on my PC without my permission?

XMRig is running because something on your PC started it: a program you installed, a background startup entry, or possibly malware. XMRig is a legitimate mining tool, but if you did not agree to run it, treat it as suspicious until you find out where it came from.

What XMRig is doing on your PC

XMRig uses your computer’s processor, or CPU, to mine cryptocurrency such as Monero. Mining means doing calculations that help secure a cryptocurrency network in return for a chance to earn coins.

That work can make your PC slower, hotter, and noisier. It also uses electricity. If someone installed it secretly, any mining rewards may go to their wallet—not yours. This unauthorized use is often called cryptojacking.

However, the name alone does not prove an infection. A legitimate mining app may include XMRig, and a file with a different purpose could be renamed “xmrig.exe.”

How it may have arrived

Common explanations include:

• A bundled installation. Another app included mining software, perhaps behind an unclear or easily missed setting.
• An old mining setup. Someone previously configured this PC to mine, and a startup entry still launches it.
• Another person’s installation. Someone with access to your PC installed it without asking you.
• Malware. A malicious download, fake update, cracked program, or compromised account installed a hidden miner.

Ordinary browser mining does not require a separate XMRig process on your PC. If you see xmrig.exe running outside your browser, simply closing a mining website may not stop it.

What you should do now

If this is your personal PC, take these steps:

1. Pause sensitive activity. Avoid banking or entering important passwords while you investigate. If you suspect malware, disconnect from the internet to interrupt mining connections and possible attacker access.
2. Record what you see. On Windows, open Task Manager, find the process, and note its name and CPU use. Right-click it and choose Open file location, if available. Record the folder without opening unfamiliar files.
3. Stop the process. Choose End task. This stops that instance, but does not remove whatever launched it.
4. Check installed apps and startup apps. Look for unfamiliar entries or software installed around the time the problem began. A strange folder or filename is a clue, not proof.
5. Run security scans. Update your trusted security software, then run a full scan. On Windows, Microsoft Defender Offline can check for threats outside your normal Windows session.

Do not disable antivirus protection or add an exception just because a popup tells you XMRig is safe. For a work or school PC, contact your IT team before changing or deleting anything.

Why it might keep coming back

If XMRig restarts after you stop or remove it, another component may be launching it. That could be a scheduled task, a background service, or malware that downloads it again.

Deleting only xmrig.exe may therefore miss the real problem. Let your security software remove related threats. If scans cannot resolve it, get help from a trusted technician; a clean operating-system reinstall may be appropriate.

If malware is confirmed, change important passwords from a different, trusted device.

The bottom line

XMRig itself is not automatically malware, but running it without your permission is not acceptable. Stop it, investigate its source, and remove the unwanted software that keeps launching it—not just the visible mining process.