How to Check for Cryptominers

Step 1: High CPU Usage

top -b -n1 | head -20

Step 2: Look for Miner Processes

ps aux | grep -E "xmrig|minerd|cpuminer|stratum|nicehash"

Step 3: Check for Unusual Network Traffic on Mining Ports

sudo netstat -an | grep -E ":3333|:5555|:7777|:14444"

Step 4: Scan for Miner Files

sudo find / -name "*xmrig*" -o -name "*miner*" 2>/dev/null

Step 5: Monitor CPU Usage Over Time

sar -u 1 10

Step 6: Remove and Clean

sudo pkill -f xmrig
sudo rm -rf /opt/miner
sudo crontab -r