mining virus hiding in system.exe?

[brigas]

When i leave my laptop alone I have noticed that the fans start blowing up, but the moment i come back they calm down. I open my fan software and it shows that there is overheat due to high cpu activity and I open the task manager and see that just the moment before i opened it the cpu activity was high.

 

Recently I have been leaving the task manager open when i left the pc with screen always on and now I discovered that the culprit is system.exe that goes to 18% cpu activity until i move the mouse then it instantly goes to 0.5%, its not fake activity either since it overheats and causes the fans to blow up.

 

I've ran multiple malware and antivirus scans and no luck, how can I track the problem down? Is this a known issue? Thanks in advance.

[brigas]

as an addition when i open file location it sends me to the system32 folder to the file ntoskrnl.exe and it doesnt seem to be a duplicate process disguised as the system.exe, it seems to have infiltrated the actual system.exe process

[MKDB]

Hello @brigas  and 

 

My name is MKDB and I will assist you.

 

 

Some ground rules:

• Please follow the steps in the given order and post back the log files.
• Please attach all log files into your post.
• Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
• Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
• Searching, detecting and removing malware isn't instantaneous and there is no guarantee to repair every system. Before we start, please make sure that you have an external backup, not connected to this system, of all private data.
• Please be patient and stick with me until I give you the "all clear".
• Only run the tools I guide you to. Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Cracked or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• As English is not my native language, please do not use slang or idoms. It may be hard for me to understand.
• If you do not respond within 4 days, your topic will be closed.

 

 

Can you tell me which antimalware tools you have already used so far?

 

 

Step 1

Please download the suitable version of Farbar Recovery Scan Tool (FRST) and save it to your desktop: 32bit | 64bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Check the box in front of Shortcut.txt.
• Press the Scan button.
• FRST will create three logs (FRST.txt + Addition.txt + Shortcut.txt) in the same directory the tool is run.
• Please attach these logfiles to your next reply.

 

 

 

[MKDB]

Due to the lack of feedback, I do not follow this topic any longer.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection.

Thank you.