Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Unexplained fan noise, heat, sluggishness, or high CPU/GPU use can indicate cryptomining, but none of these signs proves it. Games, video rendering, browser tabs, updates, and legitimate background tasks can create the same symptoms. The reliable first check is to identify which process or browser activity is consuming resources, then see whether the load continues when your expected work has stopped.
This guide shows how to investigate Windows and macOS systems, how to distinguish a browser page from an installed process, and what to do when Windows checks support the concern. It also explains why a normal reading or a familiar-looking process name does not necessarily mean the computer is clean.
What cryptojacking is—and what the symptoms can and cannot tell you
Cryptojacking is the unauthorized use of a computer’s CPU or GPU to mine cryptocurrency for someone else. The unwanted software may arrive as a potentially unwanted app, a malicious download, a browser script, or code hidden inside another process. Microsoft describes potentially unwanted apps as software that may secretly use a PC for cryptomining even when it is not classified as traditional malware.
Recommended Free Tools
Mining calculations keep hardware busy. That can produce a combination of high processor or graphics usage, increased temperature, louder fans, reduced battery life on laptops, and slower response. Those effects are useful clues, not a diagnosis. A demanding game, an export in a video editor, a browser page with an interactive application, an operating-system update, or a legitimate rendering task can look identical in a resource monitor.
#1 Best Overall
- Spacious Design: Measuring 21.1" wide and 14.1" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy ergonomic support with the integrated cushioned wrist rest.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a sleek black carbon color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.8 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
Start by comparing the resource use with what you are actually doing:
- Expected foreground work: A game, 3D application, video export, virtual machine, or large software update can legitimately use most of a CPU or GPU while it runs.
- Idle-time activity: Sustained high usage after those tasks have ended is more concerning, especially if it returns whenever the computer is left alone.
- One-off spike: A short burst may be indexing, updating, opening an application, or compiling code.
- Repeated or persistent load: A process that repeatedly consumes resources without an identifiable reason deserves investigation.
Do not rely on CPU alone. A miner designed for a graphics processor can leave CPU usage looking ordinary. Microsoft documented a 2026 campaign in which GPU mining was a central component, so inspect both measures where your operating system exposes them.
Use a simple evidence checklist before changing anything
Record what you see before terminating processes or uninstalling software. A short note of the time, the top process names, CPU percentage, GPU percentage, open applications, and whether the computer was idle makes it easier to spot a pattern and explain the problem to support staff.
- Close or pause applications that you knowingly expect to be intensive.
- Wait several minutes rather than judging a single instant.
- Check whether the load falls after a browser tab or the entire browser is closed.
- Note whether the same process returns after a restart or when the computer becomes idle.
- Look for related symptoms such as unexplained startup items, security notifications, changed exclusions, or remote-access software you did not install.
A process name that sounds familiar is not proof of safety. In its May 26, 2026 campaign analysis, Microsoft described mining code running through process hollowing under the identity of a legitimate Microsoft-signed Windows utility. Conversely, an unfamiliar name is not automatically malicious; many legitimate applications use helper processes with technical names.
How to check a Windows PC
1. Inspect CPU and GPU use in Task Manager
- Press Ctrl+Shift+Esc to open Task Manager.
- If the compact view appears, select More details.
- On the Processes tab, review the CPU and GPU columns. If a column is not visible, right-click a column heading and enable the available GPU-related columns.
- Close expected intensive applications, wait a few minutes, and watch whether one process keeps consuming substantial resources.
- Repeat the observation when the computer is idle. A sustained, unexplained load is more meaningful than a brief spike.
Task Manager is a troubleshooting tool, not a malware verdict. Microsoft’s Windows performance guidance recommends it for finding processes that consume resources, while also noting that ordinary software can account for high usage. Record the process name and, where available, its publisher and file location before taking action.
Rank #2
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
2. Test whether a browser page is responsible
Browser-based miners run scripts while the browser remains open on an affected site. If the top process is your browser or a browser tab is associated with the activity, close the suspect tab and observe the CPU/GPU graphs. If the load remains, exit the entire browser and check again.
A drop after closing the page is a useful diagnostic clue, but it does not prove that the computer is otherwise clean. A malicious extension, an unwanted installed program, or a second persistence mechanism could still be present. Run the security checks below if the behavior returns or you cannot explain it.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →3. Examine the process without assuming its name is trustworthy
Ask three questions:
- What launched it? Does it start only with an application you intentionally opened, or does it appear at every boot?
- Where is it located? A file in the expected installation directory is easier to explain than one in a randomly named folder in a user profile or temporary directory, but location alone is not conclusive.
- Does its activity fit its purpose? A document viewer that continuously drives the GPU while no document is open needs an explanation.
Do not delete a file merely because its name is unfamiliar, and do not assume a signed or familiar-looking utility is harmless. The 2026 campaign Microsoft analyzed used lookalike downloads, DLL sideloading, persistence, Defender exclusions, and code that hid behind trusted utilities.
4. Account for intermittent or deliberately hidden mining
A clean-looking snapshot can miss activity that pauses when you move the mouse or open Task Manager. Microsoft’s 2026 report describes a GPU miner that monitors user activity and pauses when GPU use is high or the device is not idle. Check at several times: immediately after startup, during normal use, and after leaving the machine untouched for 10–15 minutes.
Intermittent behavior is not proof of mining, but it changes how you interpret a normal reading. Look for a repeated pattern rather than relying on one observation.
Rank #3
- Note: Not suitable for MacBooks released after 2023 or devices with a protruding front camera; Not applicable to full-screen or notch-style tempered glass screen protectors; Do not use on the rear camera of the phone.
- 💻 Why Do You Need a Webcam Cover Slide? — Safeguard your privacy by covering your webcam with our reliable webcam cover when not in use. Don't let anyone secretly watch you. Stay protected!
- ✅ Thin & Stylish — Enhance your laptop's functionality and aesthetics with our 0.027" ultra-thin webcam covers. Seamlessly close your laptop while adding a touch of sophistication.
- ✅ Fits Most Devices — Compatible with laptops, phones, tablets, desktops! Keep your privacy intact on Ap/ple, Mac/Book, iPh/one, iP/ad, H/P, L/novo, De/ll, Ac/er, As/us, Sa/msung devices.
- ✅ 365 Days Protection — Our upgraded 3.0 adhesive ensures a strong hold that won't damage your equipment. Experience reliable, long-term privacy protection day in and day out.
How to check a Mac
1. Use Activity Monitor
- Open Activity Monitor from Applications > Utilities, or find it with Spotlight.
- Use the CPU view to sort processes by processor use and compare the list with the applications you knowingly opened.
- Inspect the GPU-related activity available in Activity Monitor and watch for sustained use when no graphics-intensive task is running.
- Observe the Mac while your expected work is closed and again after it has been idle for several minutes.
Apple documents Activity Monitor as the way to see CPU/GPU activity and identify processes using resources. High usage alone does not establish that a process is a miner. System services, indexing, synchronization, backups, browser tabs, and creative applications can all be legitimate causes.
2. Quit cautiously
If you can reasonably identify a process as belonging to an unwanted application, you can select it and use Activity Monitor’s stop control. Apple warns that Force Quit ends a process immediately; unsaved data may be lost, and other applications that depend on that process can be affected. Save work first and avoid terminating unfamiliar system components simply to make a graph fall.
There is no single Apple-published cryptominer-removal workflow established for this guide. If suspicious activity persists on macOS, follow current Apple security guidance or obtain qualified support rather than deleting system files or changing protections at random.
Linux: what can be said safely
The available official material does not establish one Linux-specific consumer workflow or a universal set of miner process names. Linux distributions differ in desktop environment, service manager, package system, and security tooling.
Use the distribution’s trusted process monitor to inspect CPU and GPU use while expected work is closed. Then consult the distribution’s own security and support documentation for investigating an unknown service, package, startup entry, or scheduled task. Avoid copying commands from an unverified forum or killing a process solely because its name appears in a generic “miner list.”
Rank #4
- Anti-Slip Surface - Transform your laptop into a mobile workstation with the AboveTEK portable laptop lap desk. The anti-slip surface provides a strong grip for laptops up to 15.6 inches(Diagonal), while the double rubber strip on the bottom ensures a stable display or typing experience on your lap, couch, or bed.
- Retractable Mouse Pad - Retractable laptop mouse pad extends on both directions for the left/right handed with elevation along the edges for stopping mouse from falling off. The size of laptop tray is 14" X 9.7" and the size of mouse pad is 7.4" X 6.1".
- Effective Heat Shield - The effective heat shield made of sturdy and thick material protects your laptop from overheating. Prioritizes your comfort and safety, an ideal lap pad or board for working anywhere.
- EASY to Carry and Store - With an ergonomic and simplistic design, the lap desk is portable to store in a backpack. Only 15" in size, 2.2 lb of weight and with slim 0.6 inch thickness, it is ready to be easily carried around.
- Widely Applicable - The smooth platform accommodates laptops and tablets up to 15.6 inches(Diagonal), making it a versatile accessory and one of the best gifts for mom, dad, students and professionals. Perfect for use as a laptop bed tray or tablet holder anywhere at home, library, or park.
Windows response when the evidence supports concern
1. Update Defender and run a full scan
- Open Windows Security.
- Go to Virus & threat protection and check for protection or security-intelligence updates.
- Install current updates, then choose Scan options and start a Full scan.
- Leave the computer powered and connected as the scan runs. Review the result and follow Windows Security’s recommended action for each detection.
Microsoft recommends updated antivirus protection and a full scan when unwanted software is suspected. A scan is evidence, not a mathematical guarantee that every component has been found.
2. Remove software you do not need
- Open Settings > Apps > Installed apps (the label can vary by Windows version).
- Sort by installation date if the timing of the problem is known.
- Uninstall applications you do not recognize or no longer need, after confirming they are not required by your organization or another application.
- Restart and recheck Task Manager.
Do not remove system files merely because a process name is unfamiliar. If a program was installed by an employer, school, game, driver package, or remote-support provider, verify its purpose before uninstalling it.
3. Understand potentially unwanted app actions
Windows Security can detect a potentially unwanted app (PUA). Microsoft’s PUA guidance distinguishes between blocking a detection and taking an action: a detected PUA can remain blocked until you select an action and start it. Open the Windows Security notification or the protection-history entry and complete the recommended removal or quarantine action; simply seeing “blocked” does not necessarily mean the software has been removed.
4. Turn on PUA protection
In Windows Security, open the settings for App & browser control and the reputation-based protection options. Enable blocking for potentially unwanted apps and, where offered, unwanted downloads. Microsoft’s documented Windows 10 settings flow notes that download blocking works with Microsoft Edge; labels and defaults can differ in newer Windows releases. Treat the setting as a prevention layer, not a substitute for a scan.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
5. Run Microsoft Defender Offline if the software persists
If detections return after a restart, a process recreates itself, or normal scans cannot remove the unwanted component, use the Microsoft Defender Offline option in Windows Security. It restarts the PC and scans outside the normal Windows session, which can make it harder for persistent software to interfere with removal. Save files and close applications before starting because the restart interrupts open work.
Best Value
- Spacious Design: Measuring 21.1" wide and 12" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy laptop support with the integrated device ledge.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a blush pink color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.14 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
Download and persistence risks to check
Microsoft’s May 26, 2026 campaign analysis describes attackers poisoning search results and operating lookalike download sites that impersonated utilities such as CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, and PDFgear. The observed packages used DLL sideloading, installed GPU-mining components, created persistent ScreenConnect remote access, and changed security settings, including Defender exclusions.
This was one observed campaign, not evidence that every download of those legitimate utilities is compromised and not a measurement of how common infection is. The practical lesson is about acquisition and verification:
- Download software from the publisher’s official site or a trusted app store, not from a search advertisement or a lookalike domain.
- Check the spelling of the domain and the publisher information before running an installer.
- Keep Windows, your browser, drivers, and installed applications updated.
- Review Windows Security notifications, protection history, exclusions, and unfamiliar remote-access tools.
- Be suspicious of an installer that asks you to disable protection, add an exclusion, or run an additional “fix” from a second download.
Persistent remote access changes the problem from “why is my PC slow?” to a broader security incident. If you find unexplained remote-access software, recurring detections, altered protection settings, or access that returns after removal, disconnect the computer from sensitive accounts and contact qualified technical or organizational security support.
How to interpret the evidence
| Observation | What it suggests | What it does not prove | Next step |
|---|---|---|---|
| High CPU while a known export, update, or game is running | Likely an expected workload | That the system is free of unwanted software | Recheck after the task finishes |
| High GPU while a 3D application is open | Normal graphics work is possible | That a GPU miner is absent | Close the application and observe idle use |
| Browser usage falls when one tab closes | The page or its scripts may be responsible | That no extension or installed malware remains | Close the browser, then scan if concern remains |
| A familiar signed process consumes resources | It may be legitimate, or code may be hiding behind it | That the process is safe because of its name or signature | Inspect origin and run security checks |
| Normal usage during one brief check | No high load was present at that moment | That intermittent mining is impossible | Check at startup and during idle periods |
| Defender reports a PUA as blocked | Windows prevented an action | That the detected app has been removed | Open protection history and take the offered action |
When to get help
Seek qualified support when the resource use is persistent and unexplained, detections recur, the process returns after removal, security settings keep changing, or you discover an unknown remote-access component. On a work or school computer, contact the organization’s IT or security team before wiping files or changing management software. On a personal computer, preserve the scan results and process notes so a technician can see what happened.
Do not assume that replacing the computer, buying a cooling accessory, or installing a paid scanner is the first solution. The built-in Windows and macOS tools can identify the immediate resource consumer, and Windows Defender’s current intelligence, full scan, and Offline scan provide a sensible response path. Hardware temperature and fan noise are consequences to monitor, not proof of who or what caused the load.
What a clean, useful conclusion looks like
You have stronger evidence of cryptojacking when a process or browser activity repeatedly consumes CPU or GPU resources while the computer is otherwise idle, cannot be tied to software you knowingly installed, survives ordinary closure or restart, or appears alongside security detections and persistence. You have weaker evidence when the load matches a visible task and disappears when that task ends.
Use that distinction to choose the next action: identify the workload, test the browser, inspect both CPU and GPU, scan with current security intelligence, remove confirmed unwanted software, and escalate persistent or broader access problems. No single graph, process name, or scan result should be treated as absolute proof by itself.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
