Movian SecurityHow to Identify and Remove a Bitcoin Miner Virus
A Bitcoin miner virus is more accurately known as cryptojacking malware. It uses your processor or graphics card to mine cryptocurrency without permission, often hiding in cracked software, fake installers, malicious advertisements, browser extensions or a compromised website. Mining proceeds continue in the background, and the attacker receives the rewards through their own digital wallet.
Unlike ransomware, this malware usually does not lock your files or demand a payment. Instead, it quietly consumes processing power, electricity and bandwidth, making Windows slow, hot and noisy. Identifying and removing it means checking active processes, startup locations and scheduled tasks, then confirming that mining activity has stopped after cleanup.
| What you notice | Common alternative | What to inspect |
|---|---|---|
| CPU stays near 100% while idle | Antivirus scan or demanding app | Task Manager process and CPU history |
| GPU “Compute” use is high | Video editing or a game | GPU engine, process and driver |
| Fans are loud and the case is warm | Dust, poor ventilation or overclocking | Temperature, fan speed and power use |
| Windows or the browser stutters | Hardware fault or too many open tabs | Event Viewer, disk activity and extensions |
| Unknown startup entry or scheduled task | Legitimate updater or sync tool | File path, publisher and Task Scheduler |
Spot the warning signs of hidden mining
Open Task Manager with Ctrl+Shift+Esc and leave the PC idle for ten minutes. A miner often keeps one process near 100% CPU use, but a browser tab, video call, antivirus scan or creative application can do the same. Compare the idle reading with the view after those tasks are closed. In Performance, watch CPU, memory, disk, network and GPU separately instead of judging only by overall speed.
Watch for fans running hard, a warm case, sudden lag, stuttering games, browser crashes and a larger power draw. Aussie users may say the PC is “running flat out” or has become a “space heater”; those descriptions fit when a workstation in a Sydney or Melbourne home office heats the room or adds measurably to an electricity bill. Mining can continue after the internet is disconnected, so a fall in network traffic is not proof that the machine is clean.
Confirm the source with Windows tools
Resource Monitor, opened by typing resmon in Run, shows which process owns CPU, network or disk activity. Expand a suspicious entry and note its executable path, publisher, command line and parent process. A file in a temporary folder, a random name or an unsigned publisher deserves closer inspection. Genuine Microsoft and graphics-driver components should also have a plausible path and digital signature.
On the GPU tab, a persistent “Compute” workload is a stronger clue than high “3D” use, which commonly comes from games or video. Compare the active process with the same applications closed. Microsoft Sysinternals Process Explorer can reveal the company that signed a running file and whether it is running from an unusual location; use the official Microsoft download rather than a third-party copy.
Australia’s NBN connections often use carrier-grade NAT, so abnormal inbound traffic may not be visible on a home router. That can make a network-based check misleading. Look for the miner’s sustained local CPU or GPU load, unusual outbound connections in Resource Monitor and persistence entries within Windows. If you need help, give the technician the process name, executable path and Task Manager screenshot rather than describing only an internet problem.
Remove the miner and stop it coming back
First, disconnect Ethernet or Wi-Fi and eject external drives. Turning off the router may pause network activity, but do not assume it stops mining already running on the PC. Copy important documents and photos to known-clean storage, avoiding executables, cracked applications and unknown browser profiles. If sensitive business or tax records are involved, ask a local data-recovery professional how to contain the infection before restoring files.
Boot into Windows Safe Mode with Networking disabled, then run a Microsoft Defender Offline scan from Windows Security. Update Defender and the operating system first when possible, and use a reputable second-opinion scanner afterwards. Safe Mode reduces the number of startup programs and services, making hidden activity easier to expose. If Defender reports the same miner repeatedly, or Activity Monitor shows persistence returning after a restart, a clean Windows installation may be the safest route.
Remove the offending program rather than deleting a process that belongs to a core Windows service. Uninstall its parent application, then review Startup apps, Task Scheduler, Services and browser extensions. Delete only entries whose path and purpose you can verify. After a full scan and restart, watch Task Manager while idle: a single busy core, high GPU compute use or an unexplained process path means the removal is incomplete. Changing display names alone will not stop malware whose installer or scheduled task remains active.
Clean up the wider infection
Browser-based miners can exist as extensions, injected scripts or fake update pages. Remove unfamiliar extensions, reset affected browser settings and avoid pages that demand a mining permission. Clear the browser cache and download history, then reinstall the browser from its official site if it remains unstable. Search installed programs for remote-access tools, download managers, unwanted utilities and other software that arrived with the original installer.
If the attacker had remote access, change important passwords from a clean device and enable multi-factor authentication for email, banking and cloud storage. Update the router firmware, review connected devices and change its administration password if evidence points to router compromise. Reconnecting external drives before the host is clean can spread the malware again, so scan them before use.
Check Windows Update history, browser updates and security software status, then look for strange Event Viewer entries, disabled Defender protections or unfamiliar firewall rules. These signs may indicate that the miner was only one part of a broader compromise. For a machine containing client files, financial records or family data, professional malware removal should include a documented cleanup plan and a verified backup. If clean scans cannot restore normal performance, back up essential data and reinstall Windows rather than living with uncertain persistence.
Build a defence that lasts
Install Windows and browser updates promptly, turn on automatic updates and keep Microsoft Defender active. Download software only from official stores or vendor sites, and treat cracked games, licence activators, “free” premium tools and email attachments as high-risk. Australians often rely on a mix of family, work and home devices; separate user accounts and a standard, non-administrator account for everyday browsing limit what malicious software can change.
The Australian Signals Directorate’s Australian Cyber Security Centre provides guidance at cyber.gov.au, while Scamwatch warns about scam installers and misleading tech-support messages. Report a compromised device through the ACSC reporting service and contact your bank promptly if banking sessions or credentials may have been exposed. Avoid cold calls claiming to detect Bitcoin mining; a legitimate Australian technician should explain the diagnostic process, privacy safeguards and likely costs before gaining remote control.
If you prefer hands-on support, Movian Security can inspect Windows processes, remove malicious software, tune performance and check backup options without the guesswork involved in manually deleting system files. Local repair shops may quote diagnostics separately from cleanup or reinstallation, so ask for an itemised, GST-inclusive price and a clear explanation of what the quote covers. Regular updates, trusted downloads and verified backups together provide the strongest defence against a repeat infection.