Jump to content
Lucas33333

Powershell.exe using CPU

Recommended Posts

Hello i have an issue with Powershell.exe ruinning on my computer its a brand new system it uses up tp 35% cpu and it appears and dissapers every 3 minutes , i dont know if its an infection or whatever that is but i can tell it reduces perfomance of my laptop in cpu intensive tasks. Looking for some help. I will include Farbar report 

Addition.txt

FRST.txt

Share this post


Link to post
Share on other sites

Hello @Lucas33333 and :welcome:

Let me have you run the following. Reboot after step 2 then run a new scan with FRST and post back those new logs.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

  • If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
  • If you don't have Malwarebytes 3 installed yet please download it from here and install it.
  • Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
  • Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
  • If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

  • Right-click on the program and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Accept the Terms of use.
  • Wait until the database is updated.
  • Click Scan.
  • When finished, please click Clean.
  • Your PC should reboot now if any items were found.
  • After reboot, a log file will be opened. Copy its content into your next reply.

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens, click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
  • Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

Share this post


Link to post
Share on other sites

None of my antivirus programs detected nothing Malwarebytes neither, I will run adw cleaner tomorrow and post log here. Do you think it’s some kind of infection or virus or what exactly that could be ?

Edited by AdvancedSetup
removed quote

Share this post


Link to post
Share on other sites

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

 

fixlist.txt

 

Thank you

Ron

 

Edited by AdvancedSetup

Share this post


Link to post
Share on other sites

We're not really removing much here. Gathering some information on a file set to run as a scheduled task that may not be valid. Then we're also cleaning out temporary file locations where some malware hides.

The fix also creates a backup before it proceeds, so in theory if something did go wrong, we could undo it.

Ron

 

Share this post


Link to post
Share on other sites

Also in task manager and procep64 it shows powershell.exe 7943 or different numbers, and in task manager is says Power shell 32 bit, it comes and goes every couple seconds causing spikes in cpu usage up to 35% 

Share this post


Link to post
Share on other sites

I'm wondering if it is due to Windows Updates going on.

That file I wanted to check is a valid Windows program, but not finding much useful information as to what it's used for. Possibly Windows Defender

Please run FRST again and make sure you place a checkmark on the Additions.txt check box and post back both new logs please.

 

Share this post


Link to post
Share on other sites

Also what i noticed , im not sure its important but once powershell runs on task manager % usage of WMI hosts increases from1.5% to 5-6%

Share this post


Link to post
Share on other sites

Please start an elevated Admin level Command Prompt and type the following exactly and press the Enter key after each line.

SCHTASKS /Query /FO LIST /V >"%USERPROFILE%\Desktop\MyScheduledTasks.txt"

reg export "HKEY_CURRENT_USER\Console" "%USERPROFILE%\Desktop\MyConsoleSettings.txt" /y

Then locate on your desktop the file MyScheduledTasks.txt and MyConsoleSettings.txt  then attach them back on your next reply and I'll take a look and see what's going on.

Thank you

Ron

 

Share this post


Link to post
Share on other sites

Okay, at this point nothing is directly loading PowerShell that I can see in the logs or Scheduled Tasks. My guess is that one of your other programs are calling it to run some task for them. Some games use PowerShell to run things but it's called from their executable so it's not listed in logs like this.

You can try doing a clean boot up with MSCONFIG and no apps set to run and see if it stops that way.

You can use Process Monitor or Process Explorer and watch and see what application is kicking it off.

It is a legitimate program and is useful if used for good purposes, but in some cases malware has started to use it too. But we're not detecting any malware at this time either which makes me think one of your other legit programs is probably calling it.

 

Share this post


Link to post
Share on other sites

In process explorer it once powershells runs conhost.exe and svhost.exe appears on red line and dissapers once powershell does as well, even though i have svhost and conhost.exe running already all the time

Share this post


Link to post
Share on other sites

I just checked again and it says error opening path under powershell under conhost.exe and svhost.exe in procep

Edited by Lucas33333

Share this post


Link to post
Share on other sites

No, you need to catch it when it's not running, then see which program launched it. That, or as said make a clean boot so that nothing is running on startup.

Then see if PowerShell still launches or not. If not, the slowly one by one start putting back the programs and testing until PowerShell once again starts launching.

 

Share this post


Link to post
Share on other sites

I found what’s launching powershell and hosts.exe it was my driver support app that came with my laptop pre installed I closed and disabled it and now my cpu usage doesn’t go above 6% at idle. Such a relief no more fps drops and higher cpu temp. Thanks for your help !

Share this post


Link to post
Share on other sites

Great, glad you were able to find it. I'm sure that is a relief :D

I'll go ahead and close your topic soon then. Take care and stay safe out there.

Ron

 

Share this post


Link to post
Share on other sites

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.