Random process using 30% of CPU

[Wano97]

I was wondering what this "Microsoft (32 bits)" process actually does? As far as I'm aware, I've never encountered this until recently. It runs when I start up my PC, and doesn't show up anymore after I close the process until next restart. It constantly uses 25-30% of my CPU until I close it.

 

[minibois]

I was wondering what this "Microsoft (32 bits)" process actually does? As far as I'm aware, I've never encountered this until recently. It runs when I start up my PC, and doesn't show up anymore after I close the process until next restart. It constantly uses 25-30% of my CPU until I close it.

 

 

I don't have that process, could it be a virus?

[Wano97]

I don't have that process, could it be a virus?

That's what I was wondering, but avast or malwarebytes didn't seem to find any.

[Jade]

1 - I don't have it, either.

2 - That's the icon a lot of encrypters use.

Probably a virus.

[Aytex]

i dont either virus confirmed

[Johannes_Lazor]

Probably a miner virus, Otherwise it would not be that heavy.

[itachipirate]

reinstall windows

You've been compromised. Or just use the Malwarebytes rootkit scanner

[yuh25]

That looks like the default VB6 icon. Try right clicking it and go "open file location" to find out what it is and remove it if you have no idea

[minibois]

That's what I was wondering, but avast or malwarebytes didn't seem to find any.

With "I've never encountered this until recently." do you mean that you saw it today first or since this week or so?

[Wano97]

reinstall windows

You've been compromised. Or just use the Malwarebytes rootkit scanner

 

 

Probably a miner virus, Otherwise it would not be that heavy.

 

 

i dont either virus confirmed

 

 

1 - I don't have it, either.

2 - That's the icon a lot of encrypters use.

Probably a virus.

Looking through my startup processes:

 

Checking where it's located:

Isn't it possible to delete this?

 

@Minibois Like 1-2 weeks ago

 

Edit: Malwarebytes seems to find those files once again, but with different paths.

 

[cragger89]

Lol, downloading dodgy software?

 

TBH, Windows 8.1 is so quick to install now that I would just do a format/install of the OS.

[JefferyD90]

looks like it's time for a clean install of Windows

[Wano97]

Lol, downloading dodgy software?

 

TBH, Windows 8.1 is so quick to install now that I would just do a format/install of the OS.

 

I don't download dodgy software but I've recently accepted some random file from a guy on skype, that might be it.

looks like it's time for a clean install of Windows

Looks like it... I just did one 3-4 weeks ago though

[Casperian]

Out of pure curiosity, what is in the cdkeys.txt file? (if it's what I think it is, whoever made this isn't the best)

Do you recognise anything in the file?

[matjojo]

what they said, a clean install really does not take much time anymore, so do it! especcially seeing it taking a lot of boot time!

[matjojo]

I don't download dodgy software but I've recently accepted some random file from a guy on skype, that might be it.

 

 

that is it totally:P

[Wano97]

Out of pure curiosity, what is in the cdkeys.txt file? (if it's what I think it is, whoever made this isn't the best)

Do you recognise anything in the file?

It shows random games and software, so yes:

Need for Speed Carbon :

Need For Speed Hot Pursuit 2 :

Need for Speed Most Wanted :

Need for Speed ProStreet :

Need For Speed Underground :

Need for Speed Underground 2 :

Medieval II Total War : 

Adobe Goolive : 

Nero 7 : Splinter Cell Pandora Tomorrow : 

Splinter Cell Chaos Theory : 

Call of Duty : 

Call of Duty United Offensive : 

Call of Duty 2 : 

Call of Duty 4 : 

Call of Duty WAW : 

Dawn of War : 

Dawn of War - Dark Crusade : 

Dawn of War - Dark Crusade : 

Dawn of War - Dark Crusade : 

ACDSystems PicAView : 

Act of War : 

Adobe Photoshop 7 :

Advanced PDF Password Recovery :

Advanced PDF Password Recovery Pro :

Advanced ZIP Password Recovery :

Battlefield Vietnam

Black and White

Black and White 2 :

Boulder Dash Rocks :

Burnout Paradise :

Anno 1701 :

Ashamopp WinOptimizer Platinum :

AV Voice Changer :

Battlefield(1942) :

Battlefield 1942 Secret Weapons of WWII :

Battlefield 1942 The Road to Rome :

Battlefield 2 :

Battlefield(2142) :

Camtasia Studio 6(Name) :

Camtasia Studio 6(Key) :

Chrome :

Codec Tweak Tool :

Command and Conquer Generals :

Command and Conquer Generals Zero Hour :

Red Alert 2 :

Red Alert :

Command and Conquer Tiberian Sun :

Command and Conquer 3 :

Command and Conquer 3 :

Company of Heroes :

Company of Heroes :

Counter-Strike :

Crysis :

PowerDVD :

PowerBar :

CyberLink PowerProducer :

Day of Defeat :

The Battle for Middle-earth II :

The Sims 2 :

The Sims 2 University :

The Sims 2 Nightlife :

The Sims 2 Open For Business :

The Sims 2 Pets :

The Sims 2 Seasons :

The Sims 2 Glamour Life Stuff :

The Sims 2 Celebration Stuff :

The Sims 2 H M Fashion Stuff :

The Sims 2 Family Fun Stuff :

DVD Audio Extractor (Name) :

DVD Audio Extractor (Serial) :

Empire Earth II :

F.E.A.R :

F-Secure :

FARCRY :

FARCRY 2 : 

FIFA 2002 :

FIFA 2003 :

FIFA 2004 :

FIFA 2005 :

FIFA 07 :

FIFA 08 :

Freedom Force :

Frontlines: Fuel of War Beta :

Frontlines: Fuel of War :

GetRight :

Global Operations :

Gunman :

Half-Life :

Hellgate: London :

Hidden & Dangerous 2 :

IGI 2 Retail :

InCD Serial :

InCD Username :

IG2 :

iPod Converter (Registration Code) :

iPod Converter (User Name) :

James Bond 007 Nightfire :

Status Legends of Might and Magic :

Macromedia Flash 7 :

Macromedia Fireworks 7 :

Macromedia Dreamweaver 7 :

Madden NFL 07 :

Matrix Screensave :

Medal of Honor Airborne :

Medal of Honor: Airborne :

Medal of Honor: Allied Assault :

Medal of Honor: Allied Assault: Breakthrough :

Medal of Honor: Allied Assault: Spearhead :

Medal of Honor: Heroes 2 :

mIRC :

Nascar Racing 2002 :

Nascar Racing 2003 :

NHL 2002 :

NBA LIVE 2003 :

NBA LIVE 2004 :

NBA LIVE 07 :

NBA Live 08 :

Nero - Burning Rom :

Nero 7 :

Nero 8 :

NHL 2002 :

NHL 2003 :

NHL 2004 :

NHL 2005 :

NOX :

Numega SmartCheck :

OnlineTVPlayer (Name) :

OnlineTVPlayer (Serial) :

O&O Defrag 8.0 (Username) :

O&O Defrag 8.0 (Company) :

O&O Defrag 8.0 (Serial) :

Partition Magic 8.0 :

Passware Encryption Analyzer (Name) :

Passware Encryption Analyzer (License) :

Passware Encryption Analyzer (Serial) :

Passware Windows Key (License) :

Passware Windows Key (Name) :

Passware Windows Key (Serial) :

PowerDvD :

PowerStrip :

Pro Evolution Soccer 2008 :

Rainbow Six III RavenShield :

Shogun Total War Warlord Edition :

Sid(Meier) 's Pirates! :

Sid(Meier) 's Pirates! :

Sim City 4 Deluxe :

Sim City 4 :

Sniffer Pro 4.5 :

Soldiers Of Anarchy :

Soldiers Of Anarchy :

Stalker - Shadow of Chernobyl :

Star Wars Battlefront II (v1.0) :

Star Wars Battlefront II (v1.1) :

Steganos Internet Anonym VPN :

Splinter Cell Pandora Tomorrow :

Surpreme Commander :

S.W.A.T 2 :

S.W.A.T 3 :

S.W.A.T 4 :

TechSmith SnagIt (Name) :

TechSmith SnagIt (Name) :

TechSmith SnagIt (Serial) :

Texas Calculatem 4 (Owner) :

Texas Calculatem 4 (Owner) :

The Battle for Middle-earth :

The Orange Box :

The Orange Box :

TMPGEnc DVD Author :

TuneUp 2007 (Name) :

TuneUp 2007 (Key) :

TuneUp 2007 (Company) :

TuneUp 2008 (Name) :

TuneUp 2008 (Key) :

TuneUp 2008 (Company) :

TuneUp 2009 (Name) :

TuneUp 2009 (Key) :

TuneUp 2009 (Company) :

Winamp (Username) :

Winamp (Serial) :Orange Box :

Pes 2008 :

Mirc Username :Mirc Serial :

Fifa 2002 :

Fifa 2003 :

Fifa 2004 :

Fifa 2005 :

Fifa 2007 :

Fifa 2008 :

Far Cry :

Far Cry 2 :

F.E.A.R :

Cyberlink PowerBAR :

Cyberlink PowerDVD :

Camtasia Username :Password :

The Sims 3 :

The Sims 2 :

The Sims Fun Family Stuff :

Battlefield 2 - Special Forces :

The Sims Glamour Life Stuff :

The Sims NightLife :

Nero 5 & 6 :

Nero 7 :

Nero 8 :

Nero 9 :

The Sims 2 Open For Bussines :

Bully Scholarship Edition Bully Scholarship Edition :

Transformers 2 - Revenge of the Fallen :

The Sims 2 Univeristy :

MirrorsEdge™ :

DeadSpace :

Spore :

FIFA 09 :

PES 2009 :

Call of Duty :

Call of Duty 2 :

Call of Duty 4 :

Call of Duty 5 :

Half Life 1 :

Halo :

Counter Strike 1.6 :

Serial Key of Microsoft Windows 8.1 :

GTA IV Serial Key :

CamTasia7 UserName :

CamTasia7 Serial:

FIFA10 :

TuneUp2010(UserName) :

TuneUp2010(Key) :

 

what they said, a clean install really does not take much time anymore, so do it! especcially seeing it taking a lot of boot time!

Yeah I might do that

[Casperian]

Snip

Yup, trying to get your CD keys from the registry. No idea why it is using 30% of the CPU.

 

TBH judging by the fact they called the file cdkeys (not even obvious) and they used a standard write (writing in binary would of made it non-human readable), I'm guessing this was some guys attempt at a virus. Also I hate explaining viruses but you can also catch SIGINT and do nothing which would mean you would be unable to close it.

[Wano97]

Yup, trying to get your CD keys from the registry. No idea why it is using 30% of the CPU.

 

TBH judging by the fact they called the file cdkeys (not even obvious) and they used a standard write (writing in binary would of made it non-human readable), I'm guessing this was some guys attempt at a virus. Also I hate explaining viruses but you can also catch SIGINT and do nothing which would mean you would be unable to close it.

Won't a simple malwarebytes rootscan etc be enough? Is a full reinstall of the OS necessary?

[Casperian]

Won't a simple malwarebytes rootscan etc be enough? Is a full reinstall of the OS necessary?

If you delete the files, do they come back?

If so, check %programdata% for anything unusual, I've seen quite a few virus try hide there.

[Wano97]

If you delete the files, do they come back?

If so, check %programdata% for anything unusual, I've seen quite a few virus try hide there.

I ran malwarebytes over it and the file is gone now from task manager and nothing odd seems to appear on startup.

[Stadiz]

This guy can help you more out.

http://linustechtips.com/main/topic/90213-malware-removal-guide/

[Wano97]

This guy can help you more out.

http://linustechtips.com/main/topic/90213-malware-removal-guide/

Thank, I'll also save it for future use.

[JefferyD90]

I don't download dodgy software but I've recently accepted some random file from a guy on skype, that might be it.

Looks like it... I just did one 3-4 weeks ago though

http://linustechtips.com/main/topic/324871-guide-how-to-install-windows-the-right-way/ follow this guide, it will help