Hack Forums
CPU is high untill i open taskmanager... - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: CPU is high untill i open taskmanager... (/showthread.php?tid=5742099)

Pages: Pages 1 2

CPU is high untill i open taskmanager... - IS-14 - Oct 24, 2017

My cpu is so high and when i open taskmanager it goes back down quickly to like 2,3%...

RE: CPU is high untill i open taskmanager... - GGWP1337 - Oct 24, 2017

What are you doing when this issue occur?

RE: CPU is high untill i open taskmanager... - Smileツ - Oct 24, 2017

Silent miner probably , check your processes from cmd.

RE: CPU is high untill i open taskmanager... - IS-14 - Oct 24, 2017

(Oct 24, 2017 05:43 AM)○dåFu™ Wrote:  Silent miner probably , check your processes from cmd.

Microsoft Windows [Version 10.0.15063]
© 2017 Microsoft Corporation. All rights reserved.

C:\Users\tsach>tasklist

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
System Idle Process              0 Services                   0          8 K
System                           4 Services                   0     23,112 K
smss.exe                       424 Services                   0      1,008 K
csrss.exe                      620 Services                   0      4,376 K
wininit.exe                    720 Services                   0      5,212 K
csrss.exe                      736 Console                    1      4,696 K
winlogon.exe                   824 Console                    1     17,696 K
services.exe                   944 Services                   0      8,360 K
lsass.exe                      952 Services                   0     45,616 K
fontdrvhost.exe                372 Console                    1     11,988 K
fontdrvhost.exe                400 Services                   0      6,600 K
svchost.exe                    740 Services                   0     10,316 K
svchost.exe                    928 Services                   0     45,552 K
svchost.exe                    904 Services                   0     23,908 K
svchost.exe                    612 Services                   0     12,676 K
dwm.exe                       1100 Console                    1     96,024 K
svchost.exe                   1184 Services                   0     13,088 K
svchost.exe                   1824 Services                   0     18,000 K
svchost.exe                   1880 Services                   0     16,824 K
svchost.exe                   2000 Services                   0     16,040 K
svchost.exe                   1952 Services                   0     28,048 K
svchost.exe                   2032 Services                   0     13,336 K
svchost.exe                   1756 Services                   0     15,596 K
NVDisplay.Container.exe       2092 Console                    1     58,664 K
svchost.exe                   2136 Services                   0     17,552 K
svchost.exe                   2168 Services                   0     26,972 K
svchost.exe                   2184 Services                   0     16,752 K
svchost.exe                   2192 Services                   0     16,544 K
svchost.exe                   2300 Services                   0     21,336 K
svchost.exe                   2340 Services                   0     18,364 K
svchost.exe                   2468 Services                   0     28,164 K
svchost.exe                   2548 Services                   0     33,756 K
svchost.exe                   2644 Services                   0     19,756 K
svchost.exe                   2652 Services                   0     14,160 K
svchost.exe                   2660 Services                   0     16,404 K
svchost.exe                   2736 Services                   0     20,516 K
spoolsv.exe                   2836 Services                   0     39,808 K
svchost.exe                   2920 Services                   0     11,224 K
svchost.exe                   2968 Services                   0      6,936 K
svchost.exe                   3040 Services                   0      9,976 K
svchost.exe                   2720 Services                   0     12,996 K
dasHost.exe                   3188 Services                   0      9,276 K
svchost.exe                   3464 Services                   0      6,388 K
svchost.exe                   3476 Services                   0      7,380 K
SecurityHealthService.exe     3492 Services                   0     10,356 K
chrome.exe                    2908 Console                    1    183,328 K
svchost.exe                   6104 Services                   0      6,840 K
chrome.exe                    2112 Console                    1     88,284 K
chrome.exe                     972 Console                    1     88,780 K
chrome.exe                   10380 Console                    1     42,104 K
LocationNotificationWindo     9892 Console                    1      7,296 K
cmd.exe                       5128 Console                    1      3,184 K
conhost.exe                  11600 Console                    1     17,320 K
tasklist.exe                  7984 Console                    1      7,788 K
WmiPrvSE.exe                  9084 Services                   0      8,636 K

C:\Users\tsach>

RE: CPU is high untill i open taskmanager... - IS-14 - Oct 24, 2017

Its 30% and when i open task manager it goes back down to like 3%

RE: CPU is high untill i open taskmanager... - 5chn4pp - Oct 24, 2017

Solution: keep your task manager running 24/7.

JK, do this scan:

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Right click to run as administrator. When the tool opens click Yes to disclaimer.

  • Press Scan button.

  • It will produce logs called FRST.txt and Addition.txt in the same directory the tool is run from.

  • Please copy and paste the logs back here.




RE: CPU is high untill i open taskmanager... - IS-14 - Oct 24, 2017

FRST https://mega.nz/#!zIdVnIrD!D7KFMIQ0aKvGw6v_6LwN_4M6NbKB9y3AoggBqBoWfW0
Addition https://mega.nz/#!uItyWDDR!j6zG0G1djecjPN4Jzsd37EIq8_-Q2uuKmQVx8EPiM2o
its a text doc , i couldnt upload the logs they were too long.

RE: CPU is high untill i open taskmanager... - Zar66661 - Oct 24, 2017

You got a heavy load of the svchost services running, and it sounds like a silent miner. Best to check msconfig startup/services to see if "svchost.exe" is ticked to start on those tabs.

RE: CPU is high untill i open taskmanager... - Zar66661 - Oct 24, 2017

Also pastebin is more hacx friendly my man.

RE: CPU is high untill i open taskmanager... - Sparkfear - Oct 24, 2017

Seems sketchy.

Code
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

Code
Imminent Monitor (HKLM-x32\...\Imminent Monitor) (Version: 5.0 - Imminent Methods)
CustomCLSID: HKU\S-1-5-21-1947286723-1358728306-555116126-1001_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InprocServer32 -> C:\Users\tsach\AppData\Local\Microsoft\OneDrive\17.3.7073.1013\amd64\FileCoAuthLib64.dll (Microsoft Corporation)

Code
2017-10-23 01:22 - 2017-02-19 03:12 - 001240576 _____ () C:\Users\tsach\Desktop\PC\Imminent Methods\Imminent Monitor\bin\cef\CefSharp.Core.dll
2017-10-23 01:22 - 2017-02-19 03:12 - 066165760 _____ () C:\Users\tsach\Desktop\PC\Imminent Methods\Imminent Monitor\bin\cef\libcef.dll
2017-10-23 01:22 - 2017-02-19 03:12 - 000822784 _____ () C:\Users\tsach\Desktop\PC\Imminent Methods\Imminent Monitor\bin\cef\CefSharp.BrowserSubprocess.Core.dll
2017-10-23 01:22 - 2017-02-19 03:12 - 001886208 _____ () C:\Users\tsach\Desktop\PC\Imminent Methods\Imminent Monitor\bin\cef\libglesv2.dll
2017-10-23 01:22 - 2017-02-19 03:12 - 000078848 _____ () C:\Users\tsach\Desktop\PC\Imminent Methods\Imminent Monitor\bin\cef\libegl.dll
Meanwhile in your host
Code
127.0.0.1 jotti.org
127.0.0.1 viruschef.com
127.0.0.1 donotdistribute.com
127.0.0.1 www.jotti.org
127.0.0.1 www.viruschef.com
127.0.0.1 www.donotdistribute.com
127.0.0.1 www.metadefender.com
127.0.0.1 metadefender.com

Code
FirewallRules: [TCP Query User{2558B8E6-BC02-446D-A61B-D8A7F8C3B142}C:\users\tsach\desktop\dcrat\darkcomet.exe] => (Allow) C:\users\tsach\desktop\dcrat\darkcomet.exe
FirewallRules: [UDP Query User{37AFCCCD-5402-4323-95BA-B34D5DCA0DF2}C:\users\tsach\desktop\dcrat\darkcomet.exe] => (Allow) C:\users\tsach\desktop\dcrat\darkcomet.exe
FirewallRules: [TCP Query User{23378187-FFE1-421D-8E4B-52260A39B95A}C:\users\tsach\desktop\pc\hacking & rats\dcrat\darkcomet.exe] => (Allow) C:\users\tsach\desktop\pc\hacking & rats\dcrat\darkcomet.exe
FirewallRules: [UDP Query User{9F146AB6-BF86-49CA-ACA1-ED1A50D5A891}C:\users\tsach\desktop\pc\hacking & rats\dcrat\darkcomet.exe] => (Allow) C:\users\tsach\desktop\pc\hacking & rats\dcrat\darkcomet.exe

Reason enough to believe you're infected..

RE: CPU is high untill i open taskmanager... - IS-14 - Oct 24, 2017

reason enough not to, imminent monitor is my rat and the host is blocked by the coder of the crypter i use...

RE: CPU is high untill i open taskmanager... - GruntStyl - Oct 24, 2017

I know a lot of Miners will do such activity. I'm sure a lot of Spyware is starting to use the technique now though as well.

RE: CPU is high untill i open taskmanager... - IS-14 - Oct 24, 2017

guess no one here is smart enough to deal with this type of malware.

https://imgur.com/a/JufCX is svchost a virus? i have 5000 of those.

RE: CPU is high untill i open taskmanager... - Linxy - Oct 24, 2017

https://en.wikipedia.org/wiki/Svchost.exe

It's built into Windows, but miners will name their applications "svchost.exe" to trick users into thinking it is essential. It is normal for there to be more than one svchost.exe running on a windows machine. Try a system recovery to a time that you did not see this happening, back track to any applications you have ran that may have been questionable.

RE: CPU is high untill i open taskmanager... - IS-14 - Oct 24, 2017

(Oct 24, 2017 04:02 PM)Linxy Wrote:  https://en.wikipedia.org/wiki/Svchost.exe

It's built into Windows, but miners will name their applications "svchost.exe" to trick users into thinking it is essential. It is normal for there to be more than one svchost.exe running on a windows machine. Try a system recovery to a time that you did not see this happening, back track to any applications you have ran that may have been questionable.

why would any silent miner want only 30% of my cpu and not 90 ,100...