A lightweight PowerShell toolkit to detect, block, and remove cryptocurrency miners from Windows systems.
ProtectMiner provides two scripts that work together to protect your machine from unwanted crypto-mining activity — both at the system level and in your browser.
Runs as a continuous background monitor and performs the following checks every 5 minutes:
| Step | Action |
|---|---|
| 1 | Blocks known mining domains by adding entries to the Windows hosts file |
| 2 | Terminates suspicious processes (xmrig, minerd, cpuminer, ethminer, nicehash, kms-pico, cryptobot) |
| 3 | Scans %APPDATA% and %LOCALAPPDATA% for malicious .exe files and deletes them |
| 4 | Monitors CPU usage — if above 85%, clears the Temp folder to remove portable miners |
| 5 | Removes scheduled tasks that point to suspicious AppData locations |
Force-installs the NoMiner browser extension on:
- Google Chrome — via Group Policy registry key
- Microsoft Edge — via Group Policy registry key
- Mozilla Firefox — via policy registry key
- Windows 10/11
- PowerShell 5.1+
- Administrator privileges (required to modify the
hostsfile, kill system processes, and write toHKLMregistry)
# Run the system protection script as Administrator
.\antiminer.ps1
# Deploy browser extensions (one-time, run as Administrator)
.\nocoinnavegador.ps1- In PAD, add the "Run PowerShell Script" action.
- Paste the full script code.
- In the action's Advanced properties, increase or disable the timeout (since
antiminer.ps1runs in an infinite loop). - Launch PAD as Administrator — otherwise Windows will block host file edits and registry writes.
Note: Browser extensions only take effect after all browser windows are closed and reopened. You can force this by running:
Stop-Process -Name "chrome", "msedge", "firefox" -Force
MIT