How to check a laptop for a hidden miner: a step-by-step guide with a checklist

A hidden miner on a laptop is like a silent thief who steals not money from your wallet, but the resources of your device. You may not realize for years that someone is using your processor or video card to mine cryptocurrency until the laptop starts to overheat, slow down, or run out of charge within an hour. According to Kaspersky, in 2023, every fifth user will encounter mining malware at least once - and this is only official statistics.

The problem is that modern miners know how to disguise themselves as legitimate processes, and their activity is often attributed to “heavy” programs or viruses. But there is good news: you can detect the parasite without complex technical skills. In this article - 7 proven methods that work on Windows 10/11, macOS and Linux, including analyzing tasks, network traffic and hidden folders. You will learn what signals should alert you, how to distinguish a miner from a normal load, and what to do if your suspicions are confirmed.

Signs of hidden mining: when to sound the alarm

The first step is to pay attention to indirect signs. Mining is loading CPU And GPU by 80–100%, even when you did not run resource-intensive applications. Here are the key symptoms:

• 🔥 The laptop gets very hot and makes noise (the cooler is running at maximum) in idle mode.
• ⚡ The battery drains 2–3 times faster than usual (for example, from 6 hours to 1.5–2).
• 🐢 The system freezes when opening new browser tabs or simple programs (for example, Notepad).
• 📉 Performance in games or rendering has dropped sharply for no apparent reason.
• 🔌 Energy consumption has increased (the laptop became hot even while charging).

It is especially suspicious if these problems appear suddenly — for example, after installing pirated software, browser extensions, or connecting to public Wi-Fi. Mining viruses often penetrate through:

• 📥 Hacked programs (Adobe Photoshop, AutoCAD, games from torrents).
• 🌐 Fake browser or driver updates.
• 🔗 Phishing links in emails or messengers (for example, “Your account is blocked, download the patch”).

⚠️ Attention: If your laptop starts overheating after updating Windows or drivers, check first Task Manager to background processes NVIDIA/AMD. Sometimes legitimate services (for example, NVIDIA Container) give a false alarm.

Method 1: Check through Task Manager (Windows)

The fastest way to identify a miner is to analyze active processes. On Windows built-in is suitable for this Task Manager:

1. Click Ctrl + Shift + Esc or Ctrl + Alt + Del → select "Task Manager".
2. Go to the tab Details (in Windows 11 — Processes).
3. Sort processes by column CPU or GPU (click on the column header).

Please note:

• 🔍 Unknown processes with high load (for example, svchost.exe, but not from Microsoft).
• 🖥️ Processes consuming more than 50% CPU/GPU in idle mode.
• 📁 Suspicious names: miner.exe, xmrig, cpuminer, ethminer.

If you find a suspicious process - don't delete it right away. First:

1. Right click → Open file location.
2. Check the path: legitimate files are usually located in C:\Windows\System32 or Program Files.
3. Google the name of the process + “miner” (for example, “xmrig miner»).

Method 2: Monitor Network Traffic

Miners not only load the processor, but also actively exchange data with pool servers (for example, NiceHash, MinerGate). Check network activity:

On Windows:

1. Open Task Manager → tab Network.
2. See which programs are consuming traffic even when you don't use the Internet.
3. Use Resource Monitor (Win + R → enter resmon → tab Network).

On macOS:

1. Open Activity Monitor (Command + Space → enter a name).
2. Go to the tab Network.
3. Pay attention to processes with constant traffic (for example, send/recv > 100 KB/sec).

Suspicious signs:

• 📡 Unknown IP addresses in outgoing connections (check via whois on the website who.is).
• 🔄 Constant traffic to ports 3333, 5555, 7777 (popular with miners).
• 🌍 Connections to domains with words mine, pool, hash.

For in-depth analysis, use the following utilities:

• 🛡️ Wireshark (advanced packet analyzer).
• 🔍 GlassWire (traffic visualization for beginners).
• 📊 NetBalancer (traffic control by process).

⚠️ Attention: Some legitimate programs (for example, Steam, EpocGame, Telegram) also actively use the network. Mining is different permanent traffic (24/7) and connections to unfamiliar servers.

Method 3: Check startup and task scheduler

Miners are often registered in startup or launched according to a schedule in order to be activated after a reboot. How to check:

On Windows:

1. Autoload: Ctrl + Shift + Esc → tab Autoload. Look for unknown programs with high Startup Impact.
2. Task Scheduler: Win + R → taskschd.msc → Task Scheduler Library. Check tasks with triggers such as “When the computer starts” or “When idle”.

On macOS:

1. Open System Settings → Users and groups → tab Login objects.
2. Check the folders:

   /Library/LaunchAgents/
   ~/Library/LaunchAgents/
   /Library/LaunchDaemons/

   for suspicious files (for example, com.miner.plist).

Typical miner disguises:

• 📁 Names that imitate system processes: WindowsUpdate.exe, svchosts.exe (note the extra characters!).
• 🕒 Tasks that run outside of working hours (for example, from 3 to 5 am).
• 🔄 Processes that “hide” under legitimate ones (for example, GoogleUpdate.exe, but with a different path).

If you find a suspicious task:

1. Right click → Properties → check the file path.
2. Disable the task (but do not delete it immediately - it may be needed for analysis).

Method 4: Scan with antivirus and specialized tools

It is difficult to detect a miner manually - many of them use rootkit technologiesto hide from Task Manager. Antiviruses and highly specialized utilities will help here.

Free solutions:

• 🛡️ Kaspersky Virus Removal Tool (portable version, does not require installation).
• 🔍 Malwarebytes Anti-Malware (good at finding hidden miners).
• 🖥️ AdwCleaner (removes miners built into browsers).
• 🔧 RogueKiller (specializes in rootkit infections).

Paid (with free trial period):

• 💰 ESET NOD32 (even detects stealth files).
• 🔐 Bitdefender Total Security (includes protection against cryptojacking).

How to scan:

1. Run your antivirus in safe mode (on Windows: reboot while holding F8 or through msconfig).
2. Select Deep Scan (not fast!).
3. Pay attention to the results marked:
   • 🚨 Trojan.Miner, RiskWare.CoinMiner.
   • ⚠️ PUP.Optional.Miner (potentially unwanted program).

If the antivirus does not find anything, but suspicions remain, use online scanners:

• 🌐 VirusTotal (upload suspicious files).
• 🔗 Hybrid Analysis (analysis of the behavior of files in the sandbox).

⚠️ Attention: Some miners block antiviruses or imitate their operation. If after installation Kaspersky or ESET They immediately “find viruses” and offer to buy a license - it could be a false antivirus (rogue software). Check its legitimacy on the official website.

Method 5: File System and Registry Analysis

Miners often leave traces in system folders and the registry. To check:

1. System folders:

Open Explorer and check:

• 📁 C:\Users\<Your_name>\AppData\Roaming\ - look for folders with random names (for example, kjsdflk234).
• 📁 C:\ProgramData\ - a hidden folder where miners often hide executable files.
• 📁 C:\Windows\Temp\ - temporary files with extensions .bat, .exe, .vbs.

2. Windows Registry:

1. Click Win + R → enter regedit.
2. Check out the branches:

   HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run

   Look for suspicious entries with paths to .exe-files in non-standard folders.

3. Hosts file:

Miners can block access to antivirus sites through hosts:

1. Open the file C:\Windows\System32\drivers\etc\hosts in Notepad (on behalf of the administrator).
2. Look for lines with IP addresses redirecting to 127.0.0.1 sites like kaspersky.com, virustotal.com.

If you find suspicious files:

• 📋 Write down their paths and names.
• 🔍 Check out VirusTotal.
• 🗑️ Delete only after creating a backup copy (in case of a false positive).

Method 6: Check your browser for hidden mining

Not all miners are installed as programs - some work directly in the browser through malicious extensions or scripts on websites. How to check:

1. Browser extensions:

• 🔍 B Chrome: go to chrome://extensions.
• 🔍 B Firefox: about:addons.
• 🔍 B Edge: edge://extensions.

Remove unknown extensions, especially those with names like:

• 🚫 AdBlock Pro (fake AdBlock).
• 🚫 Flash Player Update (Flash has not been supported for a long time!).
• 🚫 Crypto Miner Helper (openly states about mining).

2. Tabs with mining scripts:

Some sites mine cryptocurrency directly in the browser window (for example, through Coinhive). To detect:

1. Open Browser Task Manager (Shift + Esc in Chrome/Edge).
2. Look for tabs with high CPU consumption (eg. 50%+ in the background).
3. Use extensions to block miners:
   • 🛡️ MinerBlock.
   • 🔒 NoCoin.
   • 🚫 uBlock Origin (turn on filter EasyList).

3. Cache and cookies:

Mining scripts can be stored in a cache. Clear:

• 🗑️ Ctrl + Shift + Del → Select Cached Images and Files, Cookies.
• 🔄 B Firefox: about:preferences#privacy → “Clear data”.

⚠️ Attention: If after closing the browser the load on the CPU does not drop, the miner can be built into browser process (For example, browser_broker.exe in Chrome). In this case, only a complete reinstallation of the browser will help, deleting all data.

Method 7: Using specialized anti-mining tools

If standard methods do not help, use programs that specialize in finding miners:

How to use AntiMiner:

# Проверка процессов
top -c | grep -i "miner\|xmrig\|cpuminer"

# Мониторинг сетевых подключений
ss -tulnp | grep -i "pool\|stratum"

# Поиск подозрительных файлов
find / -name "*miner*" -o -name "*xmrig*" 2>/dev/null

1. Isolate the laptop:
   • 🔌 Disconnect from the Internet (unplug the Wi-Fi cable or turn off the router).
   • 📵 Disconnect all external devices (flash drives, hard drives).
2. Remove the miner:
   • 🗑️ Use an antivirus or manual method (see the section about the registry).
   • 🔍 Check folders Temp, AppData, ProgramData.
3. Restore the system:
   • 🔄 Go back to the restore point (Win + R → rstrui).
   • 🛠️ Reinstall your browsers and remove all extensions.
4. Update software:
   • 🔄 Update Windows/macOS to the latest version.
   • 🖥️ Update your drivers (especially for your video card).
5. Protect yourself from re-infection:
   • 🛡️ Install an antivirus with protection against miners (for example, Bitdefender).
   • 🔒 Use uBlock Origin in the browser.
   • 🚫 Do not download pirated software and games.