6

A desktop gadget I am using indicates 100% CPU usage. But every time I open Task Manager to find the cause, it suddenly drops to 10-15%. If i close it, it spikes back to 100%.

Also Command Prompt is not working as expected. When I launch it, it closes by itself within a second.

Dr.Web CureIt! and Malwarebytes do not detect anything.

What's the problem?

4
  • analyze CPU usage with WPRUI/WPA so that you don't need to open taskmgr Commented May 30, 2018 at 14:22
  • 1
    Ii would run GMER to find most rootkits....gmer.net
    – Moab
    Commented May 30, 2018 at 16:37
  • 2
    Almost sounds like a crypto-mining trojan.
    – qasdfdsaq
    Commented May 30, 2018 at 18:48
  • 1
    I have exactly the same problem! It's the setup.exe which will suspend itself after open taskmanager (you can see it working in resource manager), also chrome seems to not working as expected, it will close itself when I open exactly this page, I don't know what's the cause of this, please let me know if you could work it out, even the windows defender won't find anything
    – Sijav
    Commented Jan 29, 2019 at 10:45

1 Answer 1

5

These that you explain are signs of malware infection. The results from Dr. Web CureIt! (whatever it is) and Malwarebytes AV (I know this one) are not airtight certificates of clearance. A rootkit can subvert your Windows kernel and mask itself. (Of course, thanks to recent advancements in technology and improved user educations, we are seeing significantly less rootkits these days.)

There are a couple of things you can do:

  • You can try alternatives to Task Manager, such as Sysinternals Process Explorer, or Process Hacker. (Both are free and reliable.) I strongly recommend you create a new user account and run them from there.

  • A rootkit can only be effectively eradicated with an offline scan. Since you seem to have Windows 10, I recommend a Windows Defender Offline scan. But without proper knowledge of how malware works, it is not guaranteed to work 100% of the times.

  • Education! Education! Education! Malware are very ineffective threats today. Those who get infected by them suffer from critical lack of education about computers, security and malware. So, grab a good book and start learning about them.

1
  • 3
    Thanks, it turned out to be a coin miner (virustotal.com/#/file/…) in %appdata%\Microsoft\SoundMixer\SoundMixer.exe. Was clever enough to stop the activity even when a 3rd party process viewer was launched. Also I had to fix few registry entries, but now I got my cmd back.
    – Luke
    Commented May 31, 2018 at 6:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .