High CPU or GPU use, a hot case, loud fans, or a slow computer can indicate cryptomining, but none of those signs proves it. Games, video calls, browser tabs, updates, rendering and other legitimate work can create the same load. The reliable first check is to identify which process or browser activity is consuming resources, then see whether the load continues when your expected work has stopped.
What crypto mining on your computer means
Cryptojacking is the unauthorized use of a computer’s processor or graphics processor to mine cryptocurrency. The software may be installed as an unwanted application, hidden inside another download, or delivered through a web page that runs mining scripts while the page remains open. Microsoft describes potentially unwanted apps (PUAs) as software that can “secretly use your PC for cryptomining,” among other unwanted behavior.
As an Amazon Associate I earn from qualifying purchases.
Mining consumes electricity and computing capacity. You may notice increased fan noise, heat, battery drain, sluggish programs or unusually high activity in Task Manager or Activity Monitor. Those are clues about resource use, not a diagnosis. A miner can also be intermittent: malware documented by Microsoft in 2026 monitored user activity and paused GPU mining when the computer was busy, so a short, normal reading does not rule out compromise.
Free tools Windows power users keep installed
One-click scans. No signup required.
Start with the pattern, not the process name
Check the computer when it is supposed to be idle: close games, video editors, virtual machines, large file transfers and other intensive applications, then wait for background startup and update activity to settle. Record whether CPU or GPU use remains high and whether the behavior returns after a restart. A single spike is less informative than sustained or repeated activity with no obvious workload.
#1 Best Overall
- Spacious Design: Measuring 21.1" wide and 14.1" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy ergonomic support with the integrated cushioned wrist rest.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a sleek black carbon color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.8 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
| What you observe | What it can mean | How to interpret it |
|---|---|---|
| Short CPU or GPU spike while an app is opening or updating | Normal foreground or background work | Compare the spike with the task you started and whether usage falls when it finishes. |
| Sustained CPU use while the computer is idle | An active background process, update, indexing job or unwanted software | Identify the process and its location before deciding whether it is malicious. |
| High GPU use with no game, 3D application or video workload | A hidden graphics workload, including a possible GPU miner | Check GPU activity as well as CPU activity; a CPU-only check can miss it. |
| Load disappears after closing one browser tab | A page script or browser extension may have been responsible | This isolates a possible browser source but does not prove the rest of the computer is clean. |
| Usage returns after reboot or when the computer is idle | A startup item, scheduled task or persistent software component | Run security checks rather than repeatedly killing the process. |
Check a Windows PC with Task Manager
1. Create an idle baseline
- Save your work and close applications that normally use substantial CPU or GPU resources.
- Wait until expected startup, synchronization or update activity has finished.
- Press Ctrl+Shift+Esc to open Task Manager.
Microsoft’s Windows performance guidance recommends Task Manager for examining processes and resource use. In the Processes view, inspect the CPU and GPU columns and sort by each column in turn. Look for activity that remains high while you are doing nothing that should require it. Check both processors: a GPU-focused miner can consume graphics resources while appearing modest in a CPU-only view.
2. Examine the process in context
When you find sustained, unexpected activity, note the process name and consider what launched it, whether you knowingly installed the associated application and whether its location matches that application. Do not declare a process safe or malicious from its name, icon or resource percentage alone.
A familiar-looking name is not proof of safety. Microsoft’s May 26, 2026 campaign analysis describes process hollowing, in which malicious mining code ran under the identity of a legitimate, Microsoft-signed Windows utility. The same campaign used persistence mechanisms that could restore components after they were stopped. Treat the process identity as a clue to investigate, not as a verdict.
3. Test a possible browser source
If the load appears associated with a browser, close the suspected tab and observe whether CPU or GPU activity falls. Then quit the browser completely and check again. Microsoft explains that browser-based cryptojackers run mining scripts while the browser remains open on the affected site.
Rank #2
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
This is an isolation test only. A drop in usage shows that the page or browser session contributed to the load; it does not establish that no unwanted extension, downloaded program or persistent component remains. If the concern continues, perform the security steps below even when closing the browser appears to solve the symptom.
4. Allow for hidden or intermittent activity
Repeat the observation at different times, including shortly after startup and while the computer is idle. The 2026 campaign analyzed by Microsoft monitored user activity and reduced or paused mining when GPU use was high or the device was not idle. Deliberately quiet behavior can make a quick check look normal.
Scan and clean a Windows PC
Update security intelligence and run a full scan
Open Windows Security, update Microsoft Defender Antivirus security intelligence, and start a Full scan. Current signatures improve the chance of recognizing unwanted software, and a full scan examines more than the files immediately active in memory. Do not treat one clean scan as mathematical proof that the machine has never been compromised; use the result together with the resource pattern and any recurring detections.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Remove software you do not need
Review installed applications in Settings > Apps. Uninstall software you do not recognize or no longer need, but do not delete system files merely because a process name is unfamiliar. If you are unsure what an application does, identify its publisher and installation source first, or ask qualified technical support.
Rank #3
- Note: Not suitable for MacBooks released after 2023 or devices with a protruding front camera; Not applicable to full-screen or notch-style tempered glass screen protectors; Do not use on the rear camera of the phone.
- 💻 Why Do You Need a Webcam Cover Slide? — Safeguard your privacy by covering your webcam with our reliable webcam cover when not in use. Don't let anyone secretly watch you. Stay protected!
- ✅ Thin & Stylish — Enhance your laptop's functionality and aesthetics with our 0.027" ultra-thin webcam covers. Seamlessly close your laptop while adding a touch of sophistication.
- ✅ Fits Most Devices — Compatible with laptops, phones, tablets, desktops! Keep your privacy intact on Ap/ple, Mac/Book, iPh/one, iP/ad, H/P, L/novo, De/ll, Ac/er, As/us, Sa/msung devices.
- ✅ 365 Days Protection — Our upgraded 3.0 adhesive ensures a strong hold that won't damage your equipment. Experience reliable, long-term privacy protection day in and day out.
Take action on potentially unwanted app detections
Check Windows Security notifications and complete the available action for a detected PUA. Microsoft notes that a detection can remain blocked without being removed until the user chooses an action and starts it. A notification that says an app was blocked is therefore not the same as confirmation that every related file or persistence mechanism has been removed.
Turn on potentially unwanted app protection
In Windows Security, open the settings for App & browser control and review reputation-based protection options for blocking apps and downloads. Microsoft’s documented Windows 10 settings flow includes download blocking with Microsoft Edge; labels and defaults can vary by Windows version. Enable the available PUA protections that match your edition and keep them enabled unless a trusted administrator has a documented reason to change them.
Use Microsoft Defender Offline when unwanted software persists
If detections return, a suspicious process reappears after removal, or normal scans cannot clean the computer, run Microsoft Defender Offline. It restarts the PC and scans outside the normal Windows environment, which can prevent some persistent components from hiding while Windows is running. Save work and follow the restart prompts; the computer will be unavailable during the offline scan.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsCheck download and installation history
Think back to when the symptoms began. A new utility, codec pack, hardware monitor, driver tool or “free” installer is relevant even if the program itself looks legitimate. Download software from the official publisher or a trusted store, not from an advertisement, a lookalike domain or an unverified recommendation.
Rank #4
- Anti-Slip Surface - Transform your laptop into a mobile workstation with the AboveTEK portable laptop lap desk. The anti-slip surface provides a strong grip for laptops up to 15.6 inches(Diagonal), while the double rubber strip on the bottom ensures a stable display or typing experience on your lap, couch, or bed.
- Retractable Mouse Pad - Retractable laptop mouse pad extends on both directions for the left/right handed with elevation along the edges for stopping mouse from falling off. The size of laptop tray is 14" X 9.7" and the size of mouse pad is 7.4" X 6.1".
- Effective Heat Shield - The effective heat shield made of sturdy and thick material protects your laptop from overheating. Prioritizes your comfort and safety, an ideal lap pad or board for working anywhere.
- EASY to Carry and Store - With an ergonomic and simplistic design, the lap desk is portable to store in a backpack. Only 15" in size, 2.2 lb of weight and with slim 0.6 inch thickness, it is ready to be easily carried around.
- Widely Applicable - The smooth platform accommodates laptops and tablets up to 15.6 inches(Diagonal), making it a versatile accessory and one of the best gifts for mom, dad, students and professionals. Perfect for use as a laptop bed tray or tablet holder anywhere at home, library, or park.
Microsoft’s May 26, 2026 campaign report describes poisoned search results and imitation sites promoting utilities such as CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack and PDFgear. In that observed campaign, the package used DLL sideloading, installed GPU-mining components, established persistent ScreenConnect remote access, added Defender exclusions and used persistence mechanisms. The report concerns one campaign; it does not show that legitimate copies of those utilities are generally compromised or provide an infection rate.
Because that activity included persistent remote access as well as mining, repeated detections or unexplained access software should be treated as a broader security incident. Contact qualified technical support or your organization’s IT/security team if protection settings keep changing, detections recur or you cannot account for persistent software.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Distinguish a browser miner from installed malware
Signs that point toward a browser page
- Resource use begins after visiting one page and falls when that tab and the browser are closed.
- The computer is normal after a full browser exit and becomes busy again only when the same site is opened.
- No unfamiliar installed application or startup behavior appears during the initial check.
Even in this pattern, remove suspicious browser extensions, update the browser and run a security scan if the page was unexpected or the behavior returns. A malicious page can be only one part of a larger compromise.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallSigns that point toward an installed or persistent component
- High CPU or GPU use continues with every browser closed.
- The same activity returns after a restart or when the computer is idle.
- Defender reports a PUA or other detection, or security settings and exclusions change without your consent.
- An unfamiliar application, scheduled startup item or remote-access component appeared around the time symptoms began.
These signs justify the Windows scan, application review and, when necessary, Defender Offline procedure. Do not rely on repeatedly ending one process; persistence can relaunch it.
Best Value
- Spacious Design: Measuring 21.1" wide and 12" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy laptop support with the integrated device ledge.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a blush pink color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.14 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
Check a Mac with Activity Monitor
1. Compare CPU and GPU activity with your workload
- Open Activity Monitor from Applications > Utilities, or find it with Spotlight.
- Inspect the CPU view and sort by the resource column to see which processes are consuming processing time.
- Inspect GPU activity as well, then compare both views with the applications and tasks you intentionally started.
Apple documents Activity Monitor as the built-in way to view CPU and GPU activity and identify processes using resources. Check while expected intensive work is closed, then repeat after a restart if the pattern is intermittent.
2. Quit cautiously
Quit only a process you can reasonably identify as unwanted. Apple warns that Force Quit ends a process immediately and can cause data loss or affect other applications that depend on it. A high CPU figure or an unfamiliar name alone is not enough reason to terminate a system process.
The available Apple guidance establishes how to inspect and stop a troublesome process, but not a single Apple-published cryptominer-removal workflow. If suspicious activity persists, keep macOS and installed software current, follow Apple’s current security guidance, and seek qualified support rather than deleting unfamiliar system components.
What to do on Linux
The official consumer workflow in the available guidance does not establish Linux-specific commands or universal process names for identifying a cryptominer. Use your distribution’s trusted system monitor to inspect CPU and GPU activity while expected workloads are closed, and consult that distribution’s security and support documentation for scanning, package verification, startup services and removal.
A process name or a high resource value is not a universal Linux indicator. Avoid copying commands from an untrusted forum or deleting system files until you have confirmed what package owns the process and what it does on your distribution.
Common mistakes that produce false alarms
- Checking only CPU: GPU mining may be missed. Always inspect both where the operating system exposes both metrics.
- Assuming heat proves mining: dust, blocked vents, a warm room, a demanding application or failing cooling hardware can also raise temperature.
- Ending a process and stopping there: a scheduled task, startup item or persistence mechanism can relaunch unwanted software.
- Trusting a familiar process name: process hollowing can make malicious code appear under a legitimate signed utility’s identity.
- Calling a browser test conclusive: closing a tab can remove one source of load without proving that installed software is safe.
- Removing system files impulsively: deleting components you do not recognize can damage Windows or macOS and may destroy evidence needed for support.
- Downloading a “miner detector” from an advertisement: lookalike utility sites were part of the 2026 campaign Microsoft documented. Use official publishers or trusted stores.
A practical decision path
- Stop expected intensive work. Close games, editors, browsers and other demanding applications, then wait for normal background activity to settle.
- Inspect both processors. Use Task Manager on Windows or Activity Monitor on macOS and identify sustained CPU or GPU use.
- Isolate the browser. Close the suspected tab and then the entire browser; note whether the load changes.
- Check persistence. Restart and repeat the idle test. Recurring activity deserves a security investigation.
- Scan Windows systems. Update Defender security intelligence, run a full scan, review PUA actions and uninstall unwanted applications.
- Escalate if necessary. Use Defender Offline when unwanted software persists, or obtain qualified support if detections recur, settings change or remote access is unexplained.
No single fan-noise observation, process name or scan result can establish the complete security state of a computer. Confidence comes from correlating resource use with your workload, checking CPU and GPU, testing browser involvement, looking for persistence and responding to security-tool findings.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
