HIGH_CPU_CRYPTOMINER

Unauthorized Background Cryptocurrency Miner (High CPU/GPU)

High Severity Category: Malware & Viruses

Description

This diagnosis identifies background mining scripts or binaries running under spoofed system process names (e.g. lsass.exe, svchost.exe), causing high CPU/GPU resource utilization, thermal throttling, and severe system slowdown.

Common Causes

  • Malicious utility bundles or drive-by scripts from unverified websites.
  • Compromised web browser extensions running background script loops.

Recommended Solutions

  • Solution: Check Task Manager for unusually high-utilization processes executing from Temp or AppData directories.
  • Solution: Terminate suspicious processes using Taskkill or Resource Monitor.
  • Solution: Download and execute a full clean scan using Microsoft Safety Scanner (MSERT).

Diagnostic Commands

  • tasklist /v
  • taskkill /f /im miner.exe

    • Understanding Severity: High Severity

    This issue is classified as High Severity because it represents a potential compromise of system security, background utility exploitation, or active disruption of the operating system defenses.

    Safety & Prevention

    When diagnosing and remediating malware or spyware, always follow safe computing guidelines. Boot into safe environments before executing removals, sever network linkages immediately, and avoid running unverified third-party executable clean-up utilities that are not officially signed by reputable security providers.

    Frequently Asked Questions

    Q: How can I determine if a high CPU process is a miner?

    You can check its folder location. Real system processes run from C:\Windows\System32, while miners often run from Temp or AppData.

    Q: What should I do if my antivirus is blocked?

    Boot into Safe Mode with Command Prompt and use command-line utilities to re-enable services, or execute Microsoft Defender Offline scan.

    Q: Is a hosts file modification dangerous?

    Yes, modifying the hosts file allows redirecting legitimate traffic (like update servers) to malicious sites or local addresses.

    Need more help?

    If these steps didn't resolve your issue, try searching our database for related symptoms or hardware components.

    Back to Search