Jump to content

CPU 100% usage unless Task Manager opened


Recommended Posts

I can hear the fan in my laptop running most of the time, it stops once I open Task Manager. When I first open task manager I see 100% usage and a few seconds later it drops. I have a decent laptop with 16GB of RAM and Core i7 8th gen, this happens even if I only have a browser open. I read that most likely it is a Bitcoin miner or something of that nature, I would really appreciate some help getting rid of it since Malware seems to not able to detect it.

 

Thanks!

Link to post
Share on other sites
  • Root Admin

Hello @tacologist

 

Please run the following steps and post back the logs as an attachment when ready.
Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
If you still have trouble downloading the software please click on Reveal Hidden Contents below for examples of how to allow the download.

 

Spoiler
 
 
 
 

 

Spoiler

 

When downloading with some browsers you may see a different style of screens that may block FRST from downloading. The program is safe and used hundreds of times a week by many users.

Example of Microsoft Edge blocking the download

image.png

image.png

image.png

 

 



STEP 01

  • If you already have Malwarebytes installed then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
  • If you don't have Malwarebytes installed yet please download it from here and install it.
  • Once installed then open Malwarebytes and select Scan and let it run.
  • Once the scan is completed make sure you have it quarantine any detections it finds.
  • If no detections were found click on the Save results drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
  • If there were detections then once the quarantine has completed click on the View report button, Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
  • If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
  • If Malwarebytes won't run then please skip to the next step and let me know in your next reply that the scanner would not run.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

  • Double-click to run the program
  • Accept the End User License Agreement.
  • Wait until the database is updated.
  • Click Scan Now.
  • When finished, if items are found please click Quarantine.
  • Your PC should reboot now if any items were found.
  • After reboot, a log file will be opened. Attach or Copy its content into your next reply.

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens, click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here each time
  • Please attach the Additions.txt log to your reply as well.
  • On your next reply, you should be attaching frst.txt and additions.txt to your post, every time.

 

Thanks

Link to post
Share on other sites
  • Root Admin

Please uninstall the following program. It was installed into a %temp% folder, which no program should be installed into a temporary folder.

cpuz150

Then restart the computer

Please do the following.

  • Open Malwarebytes and click the cross-hair just above the word Scanner
  • Then near the bottom click the Advanced scanners link
  • Then under Custom Scan click on the Configure Scan button
  • Enable scan for rootkits
  • Place a check mark on you C:\ volume hard drive and click the Scan button

This scan will take a long while to run but once completed please go to Reports and export the log to text or clipboard and post back the results.

Thank you

 

Link to post
Share on other sites
  • Root Admin

The log looks good, thanks.

Please run the following. Exit out of Malwarebytes while you run the scan

 

Let me have you run a different scanner to double-check. I don't expect it to find anything, but no harm in checking.

I would suggest a free scan with the ESET Online Scanner

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

  • It will start a download of "esetonlinescanner.exe"
  • Save the file to your system, such as the Downloads folder, or else to the Desktop.
  • Go to the saved file, and double click it to get it started. 
  • When presented with the initial ESET options, click on "Computer Scan".
  • Next, when prompted by Windows, allow it to start by clicking Yes 
  • When prompted for scan type, Click on Full scan 
  • Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on Start scan button.
  • Have patience.  The entire process may take an hour or more. There is an initial update download.
  • There is a progress window display.
  • You should ignore all prompts to get the ESET antivirus software program.   ( e.g.  their standard program).   You do not need to buy or get or install anything else.
  • When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
  • Click The blue “Save scan log” to save the log.
  • If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at bottom).
  • Press Continue when all done.  You should click to off the offer for “periodic scanning”.

 

 

Link to post
Share on other sites
  • Root Admin

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.
NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real time antivirus or security software before running this script. Once completed make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

The following directories are emptied:

  • Windows Temp
  • Users Temp folders
  • Edge, IE, FF, Chrome and Opera caches, HTML5 storages, Cookies and History
  • Recently opened files cache
  • Flash Player cache
  • Java cache
  • Steam HTML cache
  • Explorer thumbnail and icon cache
  • BITS transfer queue (qmgr*.dat files)
  • Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

Link to post
Share on other sites
  • Root Admin

The logs do not show any type of infection. What you appear to be experiencing is normal if the percentage quickly drops down.

Please see the following topic

 

CPU Usage always at 70%+ until task manager is open

 

 

 

Link to post
Share on other sites

Hello,

My concern started with the fan constantly running, but I guess, if task manager showing that it is running at 100% is normal for a few seconds, the fan issue is just a problem with the hardware in my laptop because CPU definitely drops significantly after a few seconds. I really appreciate your help, everything was super clear!

 

Thank you very much!

Link to post
Share on other sites

Hello @Porthos,

 

Thank you for your reply. I have updated Windows, the problem seems to still be the same and now I also see my CPU usage not drop as much after a few seconds. Microsoft Windows Search Filter Host and Microsoft Windows Search Protocol Host combined seem to be using around 30% of the CPU all the time, even when nothing else is running. Please let me know your thoughts.

 

Thank you!

Link to post
Share on other sites
On 1/13/2021 at 8:50 PM, tacologist said:

I can hear the fan in my laptop running most of the time

Many laptops have badly designed cooling. When is the last time you cleaned the fan out?

Link to post
Share on other sites

Like 3 weeks ago, I opened my laptop to install a second RAM. But I understand it could just be a hardware issue.

Is there anything you would recommend me to do with the Microsoft Windows Search Filter Host and Microsoft Windows Search Protocol Host to try and bring down the usage a little bit? Or is that just part of Windows and it is always like that?

 

Thanks!

Link to post
Share on other sites
40 minutes ago, tacologist said:

Is there anything you would recommend me to do with the Microsoft Windows Search Filter Host and Microsoft Windows Search Protocol Host

You could read thru this. Any changes you do are at your own risk.

https://theitbros.com/fix-microsoft-windows-81-and-10-search-protocol-and-indexer-high-cpu-load-problem/

 

Link to post
Share on other sites

If it's search indexing causing the high CPU usage, you could just let the system sit idle for a while to allow indexing to complete, that way it will have at least most of the files and locations it wants indexed indexed already which should reduce the frequency of it ramping up usage.

One other possible cause of CPU usage in the background is Windows Defender.  It kicks off scans in the background automatically and it is possible to stop it by disabling the scheduled task associated with it:

defender.thumb.png.bd7772464631c6a2a9fc5f294dddb437.png

If you do decide to disable it, I'd recommend performing at least a quick scan with Defender every once in a while, though really scans aren't often needed with Defender if you keep its real-time protection enabled since it is an on-access scanner, meaning any new/changed items get scanned automatically, as do any items that are accessed by other processes (meaning that when you scan with Malwarebytes, Defender is also technically scanning your system if its real-time protection is enabled and running).

Link to post
Share on other sites
  • Root Admin

No, I don't believe that to be the issue. That is an ongoing high CPU usage that does not go away.

The issue, unless I'm misunderstanding it, is that the user potentially has a power management issue where his fans are coming on and thus that prompted him to open Task Manager to start to see what was going on and noticed the high CPU usage, but then within seconds that drops way down.

So, maybe he has a heating issue or Power Management issue?

 

Link to post
Share on other sites

Yeah, could be.  My thinking was that if it's an idle task (like search indexing, which becomes active when the system is idle) or a scheduled background task like the Defender scans, that could be the cause.  The fact that launching Task Manager makes it stop makes me think it has got to be an idle task; something the system does when no active process is using the CPU.  Search Indexer is the most common one to show up with any great frequency, but there are others.  Windows 10 does a lot of stuff in the background for maintenance and telemetry, so narrowing it down can be tough, especially if it stops doing its thing whenever you try to analyze what it's doing (like using Task Manager or other tools to look at active processes), but maybe using something else like Process Explorer will expose the culprit, assuming it doesn't do the same thing and use too much CPU causing the idle task to stop itself.

Process Explorer can be downloaded from here if you want to give that a try.  Hopefully it won't interrupt whatever it is eating the CPU the way that Task Manager does so that we can actually catch it in the act.

Link to post
Share on other sites

Hello,

I followed the suggestion from @Porthos to update Windows and the suggestion from @exile360 to let the computer sit idle for a while and the issue seems to have improved significantly. I still see 100% when I open Task Manager but after a few seconds it drops significantly. Microsoft Windows Search Filter Host and Microsoft Windows Search Protocol Host are not there anymore and the fan seems to not be going too often like it used to.

 

Thank you very much @Porthos, @exile360 and @AdvancedSetup, I really appreciate the help!

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.