High CPU from suspicious process: real fix for hidden miner malware

You walk away from your PC for ten minutes, come back, and the fans are screaming. Open Task Manager — CPU sits at 98%, and the top process is something like svchost.exe, wmiprvse.exe, or a random name like okhujkf.exe. You kill it, CPU drops. Five minutes later, it's back. What you're seeing is almost certainly a cryptocurrency miner dropped by a downloader — usually from a fake software crack, a pirated game installer, or a malicious browser extension.

Root cause: a self-restarting miner hiding behind a trusted name

The malware's core trick is persistence through scheduled tasks or WMI event subscriptions. The miner binary itself is small — often less than 2 MB — and lives in a temp folder like %TEMP%\~RandomName.exe or a user's AppData folder with a name mimicking a real Windows process. What keeps it alive isn't the binary itself; it's a scheduled task set to run every minute. When you kill the process, the task sees it missing and relaunches it. Some variants also use a second process that monitors the first — kill one, the other spawns it again. A few newer strains even inject miner code into a legitimate process like explorer.exe or chrome.exe, making detection trickier.

Step 1: Identify the true process name and location

Don't trust Task Manager's process name alone. Malware authors love naming their process svchost.exe, but the real svchost.exe lives in C:\Windows\System32. If the file path shown in Task Manager (right-click the process, 'Open file location') is anything else — %TEMP%, %APPDATA%, %LOCALAPPDATA% — you've found the imposter.

If you can't see the path, run Command Prompt as Administrator and use:

wmic process where "name='svchost.exe'" get processid,executablepath,name

Replace svchost.exe with whatever the suspicious name is. Note the PID and the full path.

Step 2: Stop the process and lock the binary

Open an elevated Command Prompt. Kill the process by PID:

taskkill /F /PID 1234

Now, before the scheduled task can restart it, rename or remove the binary. Renaming is safer because a file that doesn't exist can't be restarted, but the task might throw an error and keep trying. Use:

takeown /F "C:\Full\Path\To\Malware.exe"
icacls "C:\Full\Path\To\Malware.exe" /grant Administrators:F
rename "C:\Full\Path\To\Malware.exe" "malware.exe.bak"

The takeown and icacls steps force ownership — the malware often locks its own file with permissions that prevent deletion.

Step 3: Find and delete the scheduled task or WMI subscription

This is the step most guides miss. The miner will just redownload or recreate itself if you don't kill the trigger. Open Task Scheduler (taskschd.msc), look through the task library for anything with a trigger set to 'At system startup' or 'Every 1 minute' with an action pointing to a suspicious path. Common names: UpdateTask, GoogleUpdate, WindowsCache, or random GUIDs. Disable and delete them.

But the craftier miners use WMI event subscriptions instead of scheduled tasks. Check with:

wmic /NAMESPACE:\root\subscription PATH __EventFilter GET * /FORMAT:list

wmic /NAMESPACE:\root\subscription PATH __FilterToConsumerBinding GET * /FORMAT:list

Look for any filter with a query like SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_Process'. That's a miner restart if the process dies. Delete the filter and binding using wmic with the DELETE command — but be careful not to delete legitimate Windows WMI filters.

Step 4: Check for injected code in legitimate processes

If after steps 1–3 the CPU usage is gone but your browser or explorer still acts sluggish, the miner might have injected code into a real process. Download Process Explorer from Sysinternals. Run it as Administrator, sort by CPU, and inspect any high-CPU process whose properties show a 'Strings' tab with URLs like pool.minexmr.com or eth.2miners.com. That's a process running miner code. Restart the process (or reboot) — injection doesn't survive a clean restart if the source binary is gone.

Step 5: Block the miner from phoning home

Even if the binary is gone, a leftover script could try to download a new copy. Open the hosts file (C:\Windows\System32\drivers\etc\hosts) with Notepad as Administrator and add lines at the bottom:

0.0.0.0 pool.minexmr.com
0.0.0.0 eth.2miners.com
0.0.0.0 monero.crypto-pool.fr

This redirects common mining pool domains to localhost, breaking the miner's connectivity even if it somehow comes back.

If it still fails

Some miners write to the registry Run keys, not just scheduled tasks. Check:

reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Delete any entry pointing to a .exe in %TEMP% or AppData. Also scan with Malwarebytes or HitmanPro — these tools catch miners that Windows Defender sometimes misses (Windows Defender's real-time protection is good, but its on-demand scan can be slow to detect new miner variants). Run a full offline scan with Microsoft Defender Offline or a boot-time scan. If the CPU still peaks after all that, the miner is probably in a firmware-level bootkit — at that point, backup your personal files and reinstall Windows from a clean USB. It's rare, but it happens with high-end coinminer campaigns targeting gaming PCs with UEFI implants.