Powershell.exe using CPU

[Lucas33333]

Hello i have an issue with Powershell.exe ruinning on my computer its a brand new system it uses up tp 35% cpu and it appears and dissapers every 3 minutes , i dont know if its an infection or whatever that is but i can tell it reduces perfomance of my laptop in cpu intensive tasks. Looking for some help. I will include Farbar report 

Addition.txt

FRST.txt

[AdvancedSetup]

Hello @Lucas33333 and

Let me have you run the following. Reboot after step 2 then run a new scan with FRST and post back those new logs.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[Lucas33333]

None of my antivirus programs detected nothing Malwarebytes neither, I will run adw cleaner tomorrow and post log here. Do you think it’s some kind of infection or virus or what exactly that could be ?

Edited September 14, 2017 by AdvancedSetup
removed quote

[AdvancedSetup]

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

 

fixlist.txt

 

Thank you

Ron

 

Edited September 14, 2017 by AdvancedSetup

[Lucas33333]

Can i damage my computer if I choose fix option on farbar though ?

[AdvancedSetup]

We're not really removing much here. Gathering some information on a file set to run as a scheduled task that may not be valid. Then we're also cleaning out temporary file locations where some malware hides.

The fix also creates a backup before it proceeds, so in theory if something did go wrong, we could undo it.

Ron

 

[Lucas33333]

Ok, as soon as I get home from work I will use farbar fix option and send you file here 

[Lucas33333]

When I choose fix option it says fix.txt not found cannot fix error 

[AdvancedSetup]

You need to download the fixlist.txt file from my post above and place it in the same folder as the FRST64.EXE program.

 

[Lucas33333]

this is what i have gotten, also i checked task manager and powershell was running still

Fixlog.txt

[Lucas33333]

Also in task manager and procep64 it shows powershell.exe 7943 or different numbers, and in task manager is says Power shell 32 bit, it comes and goes every couple seconds causing spikes in cpu usage up to 35% 

[AdvancedSetup]

I'm wondering if it is due to Windows Updates going on.

That file I wanted to check is a valid Windows program, but not finding much useful information as to what it's used for. Possibly Windows Defender

Please run FRST again and make sure you place a checkmark on the Additions.txt check box and post back both new logs please.

 

[Lucas33333]

Addition2.txt

FRST2.txt

[Lucas33333]

Also what i noticed , im not sure its important but once powershell runs on task manager % usage of WMI hosts increases from1.5% to 5-6%

[AdvancedSetup]

Please start an elevated Admin level Command Prompt and type the following exactly and press the Enter key after each line.

SCHTASKS /Query /FO LIST /V >"%USERPROFILE%\Desktop\MyScheduledTasks.txt"

reg export "HKEY_CURRENT_USER\Console" "%USERPROFILE%\Desktop\MyConsoleSettings.txt" /y

Then locate on your desktop the file MyScheduledTasks.txt and MyConsoleSettings.txt  then attach them back on your next reply and I'll take a look and see what's going on.

Thank you

Ron

 

[Lucas33333]

You mean type SCHTASKS /Query /FO LIST /V and press enter right ? After each sentence ?

[AdvancedSetup]

Copy / Paste is the easiest thing if you can do that

 

[Lucas33333]

there you go

MyConsoleSettings.txt

MyScheduledTasks.txt

[AdvancedSetup]

Okay, at this point nothing is directly loading PowerShell that I can see in the logs or Scheduled Tasks. My guess is that one of your other programs are calling it to run some task for them. Some games use PowerShell to run things but it's called from their executable so it's not listed in logs like this.

You can try doing a clean boot up with MSCONFIG and no apps set to run and see if it stops that way.

You can use Process Monitor or Process Explorer and watch and see what application is kicking it off.

It is a legitimate program and is useful if used for good purposes, but in some cases malware has started to use it too. But we're not detecting any malware at this time either which makes me think one of your other legit programs is probably calling it.

 

[Lucas33333]

In process explorer it once powershells runs conhost.exe and svhost.exe appears on red line and dissapers once powershell does as well, even though i have svhost and conhost.exe running already all the time

[Lucas33333]

I just checked again and it says error opening path under powershell under conhost.exe and svhost.exe in procep

Edited September 20, 2017 by Lucas33333

[AdvancedSetup]

No, you need to catch it when it's not running, then see which program launched it. That, or as said make a clean boot so that nothing is running on startup.

Then see if PowerShell still launches or not. If not, the slowly one by one start putting back the programs and testing until PowerShell once again starts launching.

 

[Lucas33333]

I found what’s launching powershell and hosts.exe it was my driver support app that came with my laptop pre installed I closed and disabled it and now my cpu usage doesn’t go above 6% at idle. Such a relief no more fps drops and higher cpu temp. Thanks for your help !

[AdvancedSetup]

Great, glad you were able to find it. I'm sure that is a relief

I'll go ahead and close your topic soon then. Take care and stay safe out there.

Ron

 

[AdvancedSetup]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!