High CPU usage, 100% . . .

[NTxLS]

Greetings, from Texas,

 

Have been having an issue with HIGH CPU usage, using Process Explorer to ID what is doing this.  Started out with AVAST! latest version 2016.  Removed Avast! and things settled.  Few days later an issue with WinAntiRansom was showing HIGH CPU usage.  That was solved by the creater of that software.  NOW it is MBAM is the one at the top of the list, some times there are two (2) 'MBAM.exe' files running with different PID #s at present there are four (4) as I am running a scan with MBAM.  They vary from about 10-11% up to 33-35% CPU usage.

 

Without a scan running the two (2) vary around 35-39% - 40-49% with NO idle time.

 

In the last month have had a problem with "Windows PowerShell" not working did some work with "Geeks-to-Go" and cleared that issue.  The first paragraph has been bouncing around for the last two (2) weeks.  Not sure what this issue can be, have run several scans per day with MBAM, SuperAntiSPyware, Microsoft Security Essentials and Spybot Search&Destroy 2 all updated just prior to running any scan.  All have shown NOTHING found.

 

Any ideas?

[Firefox]

Greetings from Texas!

We would need more info on the system....

Please read the following and in your next reply ATTACH the 3 requested logs - Diagnostic Logs

(the three files should be CheckResults.txt, FRST.txt and Addition.txt)

Thank You,

Firefox

[NTxLS]

FireFox,

 

Have two (2) of the files you requested.  FRST.txt and Addition.txt do not know where to find nor what to run to get the CheckResults.txt.  Have done a search of my system to see if there may be such a file.  NOTHING found, if you may give me some clues as to what will create this file it will be done ASAP.  Have used FRST (Farbar Recovery Scan Tool) before and have a copy on my system.  The first two (2) above are attached.

 

PLUS have some new software on my system for additional protection and still learning how to use said program, "WinAntiRansom" that tends to over protect me until I learn how to set-it-up.

 

Greetings from Texas!

We would need more info on the system....

Please read the following and in your next reply ATTACH the 3 requested logs - Diagnostic Logs
(the three files should be CheckResults.txt, FRST.txt and Addition.txt)

Thank You,

Firefox

 

FRST.txt

Addition.txt

[Firefox]

Please create an mbam-check log:

• Download mbam-check.exe from here and save it to your desktop
• Double-click on mbam-check.exe to run it, it should then open a log file
• Please do not copy and paste the entire contents of the log into your next post, instead please attach the log CheckResults.txt file which should now be located on your desktop to your next post.
• Click on the More Reply Options button, then click on the Browse button to locate your log then click the Attach button to attach the log to your post

[NTxLS]

FireFox,

 

Thank you for these instructions as I have never run any thing other than MBAM.  That flle is attached, those two (2) previous files would not attach using the "More Reply Options" had to move on to the Basic.CheckResults.txt

[NTxLS]

FireFox,

 

Since you had me run for those reports my CPU usage has dropped to about 50 - 60 percent with 35 - 45 percent Idle time.  It did not happen all at once has been gradually lowering.  Just last week it was running 85% - 97% Idle time.  Even when there was not any scan being done there was very little usage of the processor.  Over the week-end is when it started changing to NO idle time.  Do not remember how far back it goes, but; has been from one program to another over the last several weeks.  Just week-end before last it was Avast! Antivirus 2016 was the top user.  So I said 'Good-Bye' to Avast! then it went to MBAM two (2) copies of "mbam.exe" running under two (2) different PID numbers.  Without a scan running.

 

I was getting a little concerned as to what was happening . .

 

[NTxLS]

FireFox,

 

Just doing a little research using one of my NEW Protective softwares and discovered some Registry entries that are a long line of scrambled characters, digits, and ASCII characters.  Also some of the entries in my NEW software do NOT appear in RegEdit even when using Admin access.

 

The entries are under "HKEY_CURRENT_USER\Software\2f3e6df6f5" - "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\2f3e6df6f5" - "HKEY_USERS\S-1-5-21-4267585356-2186095281-715594798-1000\Software\2f3e6df6f5" - "HKEY_USERS\S-1-5-21-4267585356-2186095281-715594798-1003\Software\2f3e6df6f5" cannot find any connection with any of my installed software.

[NTxLS]

FireFox,

 

UpDATE of my system, those RegKeys listed in my previous message are GONE, they evidently had NO use as far as my software is concerned.  Also removed MBAM, Avast! (latest version) and deleted those RegKeys then my Process Explorer shows CPU usage is now down to less than 10% with 85% Idle Time.  OH! also have reinstalled Avast! 2016 AND MBAM v2.2.1024.  All seems to be back to normal, for now.  Expect this to change in the next few days, looks to me to be some sort of slow moving malware, virus type software.  Have set some things to monitor what is going on, maybe will get LUCKY and learn more.  Interested?

[NTxLS]

Evidently this topic can be closed as there has NOT been any assistance since Firefox requested those three (3) files which were provided ASAP!  Added some info to maybe give a little HELP to the evaluation, that is when NOTHING else has been posted except my informational messages which have been ignored.

 

Thank you for this NO HELP!

[Firefox]

Thanks for the updates...

Just so you know, the logs are not always necessarily for the person that requested them (in this case me). They are required so I or someone form staff can review them, and then they respond.

I requested them, as this is normal so they can be reviewed.

Currently I am at a conference from Dec 3 - 8, with limited computer access, hence why I have not replied.

I am glad to hear your computer is running better, should the problem come back I think it would be best to have one of the experts take a deeper look. This would require running tools that are not permitted to run in this section of the forum. I say this because you have some services failing, and even explorer.exe... To do that just follow the instructions below...

To get someone to take a deeper look, feel free to follow the instructions below to receive free, one-on-one expert assistance in checking your system and clearing out any infections and correcting any damage done by the malware.

Please see the following pinned topic which has information on how to get help with this: Available Assistance for Possibly Infected Computers

Thank you

[NTxLS]

FireFox,

 

Do not missunderstand me with that post as I was not aware you were not at the "SHOP" and had read elsewhere that, 'if you post updates the others will think you are having help and ill ignore.'  Was hoping someone else, if not too busy, could step in and let me know something.  You have MY permission to attend that Conference uninterrupted.  Thank you, though, for this update and suggestion.

 

Am running some testing at this time, on my own, plus saving some data that has been removed just in case it could be improtant.

[daledoc1]

Hi, @NTxLS:

 

I know that it can be frustrating, waiting for computer help.

Please be aware that most of us here (including @Firefox and myself) are just volunteers -- we help when and how we can.

 

Also, this is the MBAM Help section for help installing and running Malwarebytes Anti-Malware (MBAM).

It's not entirely clear from your posts or logs that your problems relate directly to MBAM, rather than to another, more general computer issue (or perhaps even malware damage).

>>This is especially so since your CheckResults.txt log is extremely truncated/incomplete -- it does not provide the full amount of information about your MBAM installation.

>>You also mention in your posts that you are doing your own diagnostics, running powerful anti-malware BETA tools (here) and perhaps making other interventions -- that can make it hard for us to know what is or is not going on with the system.

 

The bottom line:

Work on these latter sorts of issues (general computer problems & malware removal/repair) is conducted in different sub-forums, reserved for that type of investigation and repair.  The tools needed cannot be used here in this particular section of the forum.

 

The assistance in the malware removal area is provided free of charge, one-on-one, by trained experts.

The other alternative for deeper, free help is via the help desk, by email.

So, we respectfully suggest that you might want to please start with this pinned topic which explains how to get help: Available Assistance for Possibly Infected Computers

Then, if you wish, we suggest that you please EITHER start a new, separate post in the malware removal forum, OR that you please log a ticket at the help desk.

That's the most efficient way to get help for your issues.

 

Thanks for your patience and understanding,

[NTxLS]

FireFox,

 

Just to let you know there is a more detailed report posted as you suggested wih two (2) of the "FRST64.exe" reports as required.

[NTxLS]

"daledoc1,"

I fully understand and have posted in that Topic area as you have suggested, also by Firefox, with a more full explanation and the two (2) files attached.  This testing I refer to was done yesterday and so far Process Explorer is showing 81.0 - 92.4% "System Idle Process" at this point in time.

[AdvancedSetup]

As user is being assisted in HJT forum I will go ahead and close this topic now.

 

Thank you