XMRig is a legitimate cryptocurrency mining tool that is developed by the same-named team. It is designed to mine Monero (XMR) cryptocurrency, using the hardware of your computer. By design, it is 100% safe, and does not violate your security in any way. But there are a lot of cases when cybercriminals hijack this program or its name for outlaw purposes.
Is XMRig a virus?
It is hard to say clearly without checking the details. The easiest situation is when you have never touched crypto mining, and suddenly discover an instance of XMRig running on your computer. It cannot appear out of the blue, and Windows does not carry one in the standard distribution. Hence, if you know that no mining tools like XMRig program can be present – you definitely have a deal with a virus.
One more sign of a malicious variant of XMRig is CPU consumption. For sure, it will consume your CPU power even when it is legit. But the legit program does not take a lot of processor power by default. Meanwhile, the virus does not think about your comfort – and takes up to 90%, making your system impossible to use.
How do I know if XMRig is legit?
In all cases it requires a bit more precise check-up. First of all, it is important to check if the process you spectate in your Task Manager is legit at all. The original XMRig process has the name “xmrig” and a specific logo. Fraudulent processes can also be called the same, but will likely have no logo. But the more often case is when the process has just a similar name, not the same. Here are the most typical names of the malicious copies:
- wup.exe
- xmrig99new.exe
- xmrig3.exe
- xmrig.exe
- xmrig-notls.exe
- winloading.exe (with logo)
- fw4.exe (with logo)
- x.exe (with logo)
- xxx.exe (with logo)
- system.exe (with logo)
Checking the file location
If you are not certain about the file name of the file you see, check its location on your disk. For this purpose, click it in the Task Manager with a right mouse button, then choose “Open file location”. The directory that appears after this action is, exactly, the place where this file is stored. If it lies somewhere in C:\Users\%your_username%\temp, it is likely a virus1. Overall, seeing it away from C:\Program Files is suspicious, excepting the cases when you installed it into another directory by yourself.
What is cryptomining?
Cryptomining is a process of calculating the cryptocurrency transaction hash. Certain amounts of the transactions (differs from one cryptocurrency to another) form the block – a structure part of the blockchain. Calculating the hash is not an easy task – it requires serious multi-thread calculating power. And the result (mining premium) depends on the speed of your calculations. That’s why professional miners almost exclusively use so-called cryptomining farms – dozens of computer systems with a specific – ideal for mining – configuration.2
Fraudsters, on the other hand, decided not to spend thousands of dollars purchasing these mining computers. Their idea is to infect hundreds and thousands of computers with mining software, connect them into a single network, and receive all of the profit from this operation. Monero is one of the best coins for fraudsters, because of the calculation simplicity and relatively high price. XMRig, correspondingly, is just a suitable tool for this purpose. They can take any other program which can mine Monero, or develop their own.
