Removing a cryptominer that uses your GPU without permission

An unauthorized cryptominer runs cryptocurrency-mining calculations on your computer, often by consuming the graphics processor (GPU). It may arrive through a trojan, cracked software installer, malicious browser extension, compromised website, or bundled adware. While the miner works, fans may run constantly, games may stutter, and the system can become unusually hot or slow.

Some mining activity is browser-based and stops when the affected tab closes. Other infections install background processes, scheduled tasks, startup entries, or system services that relaunch after every reboot. A sudden increase in GPU usage when no demanding program is open is a strong warning sign, especially when it is accompanied by unknown processes or excessive power consumption.

The safest response is to confirm the source, disconnect the device if other malware symptoms appear, and remove persistence mechanisms before deleting individual files. The steps below focus on Windows and macOS systems and can be adapted to different versions.

Recognize suspicious GPU activity

Open Task Manager on Windows with Ctrl+Shift+Esc, then sort processes by CPU or GPU usage. On macOS, open Activity Monitor and inspect the CPU and Energy tabs. A miner may use an unfamiliar name, imitate a legitimate Windows process, or appear only briefly when the system is idle. Search the exact process name online using a separate trusted device before taking action.

High GPU usage can also come from games, video editing, browser tabs, cloud applications, or driver problems. Check whether the load disappears after closing demanding programs. A process that continues mining while the computer is idle, returns after being terminated, or has a suspicious file location deserves closer inspection.

Record the process name, publisher, executable path, and digital signature when available. Do not assume that every process with a familiar name is safe; malware can use names similar to system components. Avoid deleting files from Windows or macOS system folders until a security scan identifies them.

Disconnect and investigate the entry point

If the computer shows signs of broader compromise, disconnect it from Wi-Fi or unplug the Ethernet cable. This can interrupt communication with a mining pool and prevent additional payloads from being downloaded. Do not use an infected device for banking, email, or password changes until it has been checked.

Review recently installed applications, browser extensions, downloaded archives, and software updates. Remove programs you do not recognize, especially utilities obtained from unofficial download pages. A browser hijacker may also redirect searches or inject scripts that run mining code; these browser cleanup steps can help when unwanted extensions or altered search settings are involved.

Check browser settings for unfamiliar extensions, notification permissions, and startup pages. Remove suspicious add-ons, clear site data, and update the browser. If the miner operates through a webpage, closing the tab may stop the symptoms, but it does not explain how the malicious page was reached or whether another infection remains.

Stop persistence on Windows and Mac

On Windows, inspect the Startup apps section in Task Manager and the Apps section of Settings. Also review Task Scheduler for tasks that launch unknown executables at login or at regular intervals. Look for unfamiliar services, entries in common startup locations, and recently created folders in AppData or ProgramData. Security software can often identify these entries more reliably than manual inspection.

On macOS, review Login Items under System Settings and check unfamiliar applications in the Applications folder. Persistent malware may use LaunchAgents, LaunchDaemons, configuration profiles, or login items to restart itself. Avoid removing system configuration files casually; document suspicious paths first and allow a reputable security tool to quarantine them.

A miner may run under a misleading process name and relaunch when its main process is closed. Terminating the visible process is therefore only a temporary measure. Persistence must be removed, followed by a restart and another GPU-usage check.

Sign	Possible explanation	Appropriate check
GPU stays busy while idle	Background miner, browser script, or driver issue	Review processes and close all demanding applications
Fans run constantly	High graphics load or thermal control response	Check temperatures, airflow, and GPU utilization
Unknown startup item returns	Persistence through a task, service, or login item	Inspect startup locations and run an antivirus scan
Usage stops when a tab closes	Browser-based mining or malicious advertising	Remove extensions, site permissions, and unwanted software
Security tools are disabled	Malware interference or administrative policy	Run an offline or Safe Mode scan

Scan in Safe Mode or recovery mode

Run a full scan with an updated, reputable anti-malware product. Use a second-opinion scanner if the first tool finds nothing but the behavior continues. Enable detection of potentially unwanted applications, riskware, and malicious browser extensions where that option is available.

Windows users can run Microsoft Defender Offline or start Windows in Safe Mode with networking only when a trusted tool requires it. Safe Mode loads fewer third-party components, which can prevent a miner from launching and make removal easier. On macOS, use a trusted security scanner and review system profiles, login items, and permissions after restarting.

Quarantine detected files rather than manually shredding them immediately. Then restart the computer, allow security definitions to update, and run another scan. If the miner reappears, investigate hidden persistence, compromised administrator accounts, or a malicious installer that is restoring the files.

Remove malware safely and protect accounts

After cleanup, update the operating system, GPU drivers, browser, and commonly exploited applications. Change important passwords from a separate, clean device, particularly if the infection included a trojan or credential-stealing component. Turn on multifactor authentication for email, cloud storage, financial services, and administrator accounts.

Inspect browser extensions and saved credentials. Remove passwords stored in a browser if the system may have been compromised, then replace them with unique credentials. Check email forwarding rules and cloud account sessions for changes you did not make.

Cryptominers sometimes arrive alongside ransomware, remote-access tools, or information stealers. If encrypted files or ransom notes are also present, avoid downloading random “decryptors” and follow reputable recovery guidance, such as this ransomware recovery guide. Preserve a copy of affected files before attempting recovery.

Prevent another unauthorized miner

Good prevention reduces the chance that a malicious installer or drive-by download can regain access. Keep standard daily work separate from administrator activity, download software from official sources, and treat cracks, key generators, and suspicious browser notifications as high-risk.

Pay attention to system temperature, battery drain, fan noise, and idle GPU use after installing new software. A sudden performance change is often an early warning, even when no obvious pop-up appears.

Practical protection steps

• Keep real-time anti-malware protection enabled and schedule regular full scans.
• Review startup apps, browser extensions, and installed programs every few weeks.
• Use browser permissions carefully, especially for notifications, downloads, and background activity.
• Install operating system and graphics-driver updates promptly from trusted sources.
• Maintain offline or cloud backups so a related malware incident does not become a data-loss event.

If GPU usage remains abnormal after these checks, preserve scan reports and suspicious file details, then use a professional security tool or qualified technician for deeper analysis. Clean the system before returning to sensitive accounts, demanding applications, or cryptocurrency services, and monitor resource usage for several restarts to confirm that the miner has stayed gone.