Monero Miner: what it is and how to remove it
Monero Miner is a malicious program that has been actively mining Monero cryptocurrency since 2016. In 2017, Monero virus has been updated and continued making virtual currency illegally by using affected computer's CPU.
Facts checked October 7, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
A free scan checks startup entries, tasks and hidden folders where processes like NsCpuCNMiner32.exe usually hide.
Do it yourself · free Remove Monero Miner yourself 6 steps, about 18 minutes, no software needed.
Start the steps
Monero Miner: summary
| Detection names | No Microsoft detection name is known |
|---|---|
| Distribution | Not recorded in the old report |
| Damage | Not recorded in the old report |
| Name | Monero Miner |
| Type | Cryptominer |
| Symptoms | An unknown process using the processor or graphics card |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 4 more facts
| Evidence | 8 write-ups by security sites; details still limited |
|---|---|
| Files | NsCpuCNMiner32.exe |
| First seen | 2 November 2017 |
| Facts checked | 7 October 2026 |
What Monero Miner does
From our report of Nov 2017 · not reviewed since
Monero Miner - malicious program used to mine cryptocurrencies behind users' back
Monero Miner is a malicious program that has been actively mining Monero cryptocurrency since 2016.
In 2017, Monero virus has been updated and continued making virtual currency illegally by using affected computer's CPU. Currently, JSMiner-C, Coinminer, Vatico Monero (XMR) CPU Miner, Shadowsocks Miner, Wise XMRig virus and other miners are spreading on the web.
Monero virus has mostly been spread as a Trojan horse and invaded systems with a help of software bundle. However, security experts have recently detected Coinhive JS miner which uses JavaScript library, injected in several popular websites and browser extensions, to spread around.
Gplyra Miner, Vnlgp Miner and CPU Miner are just a few of the cyber threats that stand alongside this threat virus. Their purpose is the same – mine cryptocurrency. While other miners focus on Bitcoins, Dash or Decred, Monero CPU Miner - as its title suggest itself - is based on mining Monero cryptocoins.
This malware occupies computers by stealth but still can be seen running as NsCpuCNMiner32.exe or Photo.scr in the system's Task Manager. In fact, the hackers create Botnets of such computers that all use Monero virus for the same purpose. Of course, their owners have no idea about such activity being carried out behind their back and they only notice something is up when their devices start acting strange.
The main issue caused by Monero virus and similar miners is their CPU usage - typically, they use so much system's capabilities that they clearly decrease computers' speed. In fact, all of this extra use of resources will not only slow your device but may also cause hardware damage due to overheating.
Frankly, Trojan creators do not care about your computer performance and only use it to generate profit for themselves. Luckily, you do not have to face all of these inconveniences. There is a way to stop and remove Monero virus from your computer. To be precise, automatic virus-fighting utilities like or can help you take care of that.
From our report of Nov 2017 · not reviewed since
Coinhive technology gets abused by cybercriminals
Coinhive is a JavaScript library for Monero Blockchain that it can be integrated into various websites.
This tool was launched only a few weeks ago, on September 14, but already managed to grab crooks' attention. Unscrupulous people took advantage of this tool to mine cryptocurrency using computer's CPU while a user browses particular websites. Besides, Coinhive JS miner was also spotted spreading via tech support scam campaign.
Researchers spotted Coinhive being integrated into SafeBrowse extension too. When users install this extension, Monero Miner virus was started running and using up to 50% of computer's CPU.
Due to this activity, a computer becomes sluggish and might be physically damaged due to working on high heat. The mining process keeps running until users close the browser. Therefore, this activity might take hours.
What is more, Coinhive was embedded in various websites that mimic popular social networks, for instance, Twitter. Indeed, there's a registered domain twitter.com.com which loads mining program as soon as a person mistypes Twitter's address and enters this site. It's possible that crooks registered numerous similar sites and currently profit from inattentive computer users.
Additionally, it a bunch of websites was reported of using in-browser miner secretly. Among such sites was The Pirate Bay, , showtime.com and showtimeanytime.com. . However, the latter websites stopped these activities as soon as it was spotted. Though, the online community discusses that owners of these sites may have earned hundreds of thousands of dollars.
From our report of Nov 2017 · not reviewed since
Update August 2017: Vatico Monero (XMR) CPU Miner hits the surface
The latest version malware is set to mine XMR, Monero and other digital currency.
As its former version, the malware also functions via a trojan. On the other hand, it can be detected as moloko.exe. The file name suggests that the malware might have originated or targeting Russian users. Unfortunately, mining trojans are a relevant issue in the country.
The Task Manager will identify it as Monero (XMR) CPU miner. The key indicator suggesting the presence of a miner virus is extremely high CPU usage. The malware will also connect to XMR mining pool at xmr-eu.dwarfpool.com:8050 and start its activity.
Even if you do not have a habit to check the Task manager once in a while, you will notice the deteriorated PC processes. In case you encountered this cyber misfortune, eliminate it right away.
Elaborating on the modus operandi of Monero Miner, it is important to note that this infection enters the computer as a Photo.scr file which then drops copies of the same file on all of the infected computer drives. Eventually, the Trojan extracts the executable NsCpuCNMiner32.exe which is responsible for the mining process.
This file will be placed in the %Temp% folder and operates from it. This process will also initiate automatically every time the computer is booted. Fortunately, the hackers are helpless if your device is disconnected from the Internet because all of the mining processes need a network connection to perform properly. Thus, it is also recommended to carry out the Monero Miner removal while offline.
From our report of Nov 2017 · not reviewed since
November 2nd, 2017: Malicious Monero Miners found in Google Play Store
Once again, Google Play Store proved to be an untrustworthy "official app" store.
It seems that all the latest malware tendencies successfully reach this app platform and start attacking Android users straight away. This time, researchers spotted malicious apps hiding cryptocurrency-mining scripts in them. The malicious Android Monero Miner virus is usually recognized as ANDROIDOS_JSMINER or ANDROIDOS_CPUMINER.
The JSMiner, one of Monero virus versions, was detected in "Recitiamo Santo Rosario Free" (an app for religious mobile users) and "SafetyNet Wireless App" (an app promising great deals and coupons for watching videos and taking surveys).
Not surprisingly, these apps take advantage of Coinhive technology (described above) to mine digital currency. The JavaScript code executes itself within apps' webview; however, the victim won't notice anything suspicious except for the following issues:
The CPUMiner was detected as "Car Wallpaper HD:
- mercedes
- ferrari
- bmw
- audi" application
This group of malicious applications configures legitimate versions of apps and infects them with cryptocurrency-mining libraries such as cpuminer (the criminals use an updated 2.5.1. version of it).
Later on, these are repacked and distributed. Analysis from TrendMicro shows that this type of malware is capable of mining several cryptocurrencies (not exceptionally Monero).
The code responsible for mining gets a config file from criminals' servers. The file contains data about the mining pool via Stratum mining protocol.
- Shorter battery life;
- Slow performance of the device;
- App crashes.
From our report of Nov 2017 · not reviewed since
Monero Miner versions and processes associated with them
ShellExperienceHost.exe and MicrosoftShellHost.exe.
These processes might show up in the Windows Task Manager after the Trojan horse infiltration. The malicious program creates ShellExperienceHost.exe which is launched automatically at system startup. This process also launches MicrosoftShellHost.exe which is responsible for mining Monero cryptocurrency by using affected computer's CPU processing power.
Booster.exe. This trojan horse might enter the system with the help of adware bundles. Once inside, it configures Windows settings in order to launch at system startup.
In the Task Manager, Booster.exe file is described as VsGraphics Desktop Engine. However, it uses up to 25% computer's CPU which is a clear indicator of mining virtual currency.
Wise XMRig virus. The Wise Miner is a Trojan horse that can create two processes on the affected device in order to mine Monero currency - AudioHD.exe and winserv.exe. When this Trojan enters the system, it immediately creates the AudioHD.exe miner that starts running when a user turns on his/her computer. In the task manager, this process has a description of XMRig.
Another file associated with Wise Miner is winserv.exe which has a description of the WindowsHub. Both of these processes use lots of computer's CPU power and makes the system sluggish.
Shadowsocks Miner. This trojan horse is known for creating and launching service.exe or websock.exe processes on the affected device. Users can see them in the Windows Task Manager using lots of computer's resources.
Malware often arrives on the system in software bundles. Additionally, it might bring other spyware or potentially unwanted apps to the system too.
Vatico Monero (XMR) CPU Miner. This Trojan horse gets inside the system pretending to be a useful program. However, once it gets inside the system, it launches an autorun process moloko.exe. Thus, every time a victim boots Windows, the miner starts using up to 80% computer's CPU to mine Monero.
Adylkuzz Miner virus. This Monero virus gets inside the system using the EternalBlue exploit and DoublePulsar backdoor. Malware connects affected computer to the mining botnet and starts using its CPU to mine cryptocurrency. Connecting affected computers into network helps to generate more crypto-money than usual.
Coinhive Miner. Authors of the miner took advantage of the legit Coinhive tool that allows website owners mining crypto-currency. Crooks took placed a mining code into malicious browser extensions and hacked websites. Additionally, criminals spread this virus via tech support scams or corrupted sites that are impossible to open without forcing the browser to quit.
How Monero Miner spreads and got on your PC
From our report of Nov 2017 · not reviewed since
Mostly, Monero Miner is distributed via various suspicious domains and fraudulent websites.
In reality, they download an infected file, which immediately starts spreading the virus throughout the computer preparing for the mining process.
It is especially important to check your computer for malware regularly, especially if you frequently download software online. It is also advisable to keep track of the programs that are entering your PC and additionally check them with reliable antivirus scanners.
On September 2017, malware has been noticed spreading via SafeBrowse extension too. Therefore, Google Chrome users are advised to stay away from this extension. This version of malware is extremely dangerous to the computer because it uses lots of computer's CPU.
In the Task Manager users can see that Chrome uses up to 50% of CPU. However, if you open Chrome Task Manager, you will find out that the problem is the SafeBrowse extension.
Check your PC for Monero Miner
- File:
NsCpuCNMiner32.exe
How to remove Monero Miner
Miners hide when Task Manager opens and add Defender exclusions.
The steps deal with both, then remove the files.
Step 1: Check where NsCpuCNMiner32.exe runs from and stop it
NsCpuCNMiner32.exeis the part you can see, and its location tells you whether it belongs there. Right-click it on the Processes page of Task Manager and choose Open file location, then right-click the file > Properties > Digital Signatures to see who signed it.An unsigned file, or one in a user folder such as
%AppData%, is the one to remove: end the task, then delete the file.Note the folder name, because the same folder usually holds its other files. This is the same in Windows 11 and Windows 10.
Full procedure with screenshots: Close a frozen app (Task Manager, Force Quit) On uGetFix
Step 2: Delete scheduled tasks that bring it back
Open Task Scheduler from the Start menu and click Task Scheduler Library. Select each task you do not recognise and read the Actions tab:
- a task that starts a file in
%AppData%or%Temp% - runs
powershellwith a long encoded line - opens a web address belongs to Monero Miner or a similar program
Right-click such a task and choose Delete, and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
- a task that starts a file in
Step 3: Remove it from startup
Whatever Monero Miner installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 4: Turn Microsoft Defender back on and remove its exclusions
Monero Miner turns protection off or adds exclusions so that Defender ignores it. In Windows Security > Virus & threat protection, open Manage settings and switch Real-time protection, Cloud-delivered protection and Tamper Protection back on.
Then open Add or remove exclusions at the bottom of that page and remove whatever you did not add yourself, for example a folder in
%AppData%or an entire drive. These pages look the same in Windows 11 and Windows 10.Full procedure with screenshots: Turn off Microsoft Defender protection for a moment On uGetFix
Step 5: Delete the folders left behind
What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items), and go through
%LocalAppData%,%AppData%, %ProgramData% and the two Program Files folders.Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold
.exe,.dll, .js or .ps1 files are the strongest sign.Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 6: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Access your website securely from any location
When you work on the domain, site, blog, or different project that requires constant management, content creation, or coding, you may need to connect to the server and content management service more often. The best solution for creating a tighter network could be a dedicated/fixed IP address.
If you make your IP address static and set to your device, you can connect to the CMS from any location and do not create any additional issues for the server or network manager that needs to monitor connections and activities. VPN software providers like can help you with such settings and offer the option to control the online reputation and manage projects easily from any part of the world.
Recover files after data-affecting malware attacks
While much of the data can be accidentally deleted due to various reasons, malware is one of the main culprits that can cause loss of pictures, documents, videos, and other important files.
More serious malware infections lead to significant data loss when your documents, system files, and images get encrypted. In particular, ransomware is is a type of malware that focuses on such functions, so your files become useless without an ability to access them.
Even though there is little to no possibility to recover after file-locking threats, some applications have features for data recovery in the system. In some cases, can also help to recover at least some portion of your data after data-locking virus infection or general cyber infection.
From our report of Nov 2017 · not reviewed since
Remove Monero Miner Trojan instantly using professional guidelines
Though Monero Miner virus is a bit more complex than the browser hijackers, adware, and similar lightweight infections, it can be eliminated from the infected computers nearly effortlessly.
As we have already mentioned, you can remove Monero Miner automatically. You only need to select a trusted anti-virus utility for the job, for instance or .
We should remind you that the Monero virus removal will be more successful if you execute it offline, using the Safe Mode.
Besides, if you have installed (or it came in software bundle) SafeBrowse Chrome extension, you have to uninstall it as well. As we have mentioned in the article, it is closely related to the malware and puts your computer in danger due to high usage of CPU.
[GI=method-1]Reboot the system and launch the cyber security utility to eliminate Monero Miner trojan.
Questions about Monero Miner
Can NsCpuCNMiner32.exe damage my computer?
A miner does not usually destroy files, but running the processor or graphics card at full load for weeks raises temperatures, wears out fans and shortens laptop batteries. It also makes the PC slower and raises the electricity bill.
The bigger risk is what came with it: miners are often installed by loaders or bundled with cracks that also drop password stealers. That is why removing NsCpuCNMiner32.exe should be followed by a full offline scan, and, if the PC shows other signs, by changing the passwords saved in your browsers.
I ended NsCpuCNMiner32.exe but it came back. Why?
Ending a process in Task Manager only stops it until something starts it again. Programs like NsCpuCNMiner32.exe keep a restart entry:
- a scheduled task
- a service
- a Run key in the registry
- a shortcut in the Startup folder
Some also have a second watcher process that relaunches the first. Find the entry first (Settings > Apps > Startup, Task Scheduler, services), disable or delete it, then end the process and delete its folder. A Microsoft Defender Offline scan run afterwards catches the parts that hide while Windows is running.
Can I just delete NsCpuCNMiner32.exe?
You can, but it is rarely enough. NsCpuCNMiner32.exe is the visible part of Monero Miner; a scheduled task, a service or a startup entry usually starts it again, and some versions restore the file within minutes. Deleting it while it runs may also fail.
Run the Microsoft Defender offline scan instead, which removes the file and its startup entries before Windows loads. Then check Task Scheduler and Startup apps for anything still pointing to the old location. Restart afterwards and confirm the file does not return.
How much electricity does a miner use?
It depends on the hardware and how hard the miner runs, so there is no single figure. A miner that keeps a desktop processor or graphics card busy around the clock can noticeably raise a household power bill over a month, and laptops lose battery life fast.
Some miners limit themselves to part of the available power to stay unnoticed, which lowers the cost but also hides the problem longer. Removing it is the only fix. Afterwards, idle use should fall back to a few percent.
Should I scan my other computers too?
It is a good idea, even for malware that does not spread by itself. The same download, USB stick or loader may have been used on other PCs in the household, and shared folders can carry files between them.
Run a full scan followed by the Microsoft Defender offline scan on each Windows PC that shared drives or files with the infected one. Do not copy programs or installers from the infected PC until it is clean, and change Wi-Fi and router passwords if they were saved on it.
Can I just delete the file Windows Security found?
Let Windows Security handle it instead. When it finds Monero Miner, choose Remove or Quarantine; the scanner also removes related startup entries and tasks that a manual delete would miss. Deleting a running file by hand often fails, and many threats restore themselves from a second copy.
After the removal, run the Microsoft Defender offline scan, which works before Windows starts and catches parts that hide while Windows runs. Then check Task Scheduler for leftovers. Restart afterwards and check that the detection does not return.
Should I reset my PC because of Monero Miner?
Only if the signs point to deeper access. Reset when you see NsCpuCNMiner32.exe using the processor or graphics card at full load again after removal, when Windows Security cannot start or update, when remote access tools you did not install keep appearing, or when you simply cannot trust the PC any more.
Otherwise, the plan in this guide plus an offline scan is enough. If you do reset, choose Remove everything and Cloud download for a fresh copy of Windows, restore only documents and photos, and reinstall programs from their official sites. Change important passwords from the clean system afterwards.
What is Monero Miner?
From the reports we have, Monero Miner is a cryptominer. The one sign people describe is NsCpuCNMiner32.exe using the processor or graphics card at full load, and that pattern fits malware that runs hidden on Windows for someone else's benefit.
No sample has been analysed in public yet, so we do not name a family or a coin and we do not guess at extra features. What matters for you is that it is not a Windows component and not something you installed on purpose.
The steps in this guide remove it whatever the details turn out to be: find what starts it, remove that, scan offline and check what may have arrived with it. We update this page when an analysis appears.
How did Monero Miner get on my computer?
The route for Monero Miner is not documented yet. Malware that shows NsCpuCNMiner32.exe using the processor or graphics card at full load usually arrives with something you ran yourself:
- a cracked program or game cheat
- a free tool from a mirror site
- a fake installer found through a search ad
- a file on a USB drive
Some infections are dropped later by a loader that was already on the PC. To find your source, sort Installed apps by install date and look at the Downloads folder for the days before the sign appeared. Remove that item as well; otherwise the same infection may come back after the clean-up.
Will Fortect remove Monero Miner?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Monero Miner, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- News: Malware Alert: Hackers Stealing Computing Power to Mine Monero (read October 7, 2026)
- Digital Trends: Visited Showtime Online recently? It allegedly mined virtual coins on your PC (read October 7, 2026)
- The Verge: Showtime websites secretly mined user CPU for cryptocurrency (read October 7, 2026)
- FTC: How to recognize, remove and avoid malware (read October 7, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 7, 2026)