Windows Command processor using really high memory

Question

it starts everytime i boot, when i end task from task manager it closed and doesnt seems to effect anything. i think its a malware or something, how can i remove it?

---

Moved from: Sysinternals

Answer 1

You have a miner infection.

• Download Fixlist.txt and save it in the folder where FRST64.exe is located.
• Close any apps with unsaved work.
• Run FRST64.exe and click "Fix".
• The computer will reboot to complete the process.

Please upload Fixlog.txt so I can check if any further action is needed.

Answer 2

Since you are already looking at task manager, switch to the Details tab. Right click on the column headers and add the Command Line column. Resize the columns so that you can see the entire command line.

What is it running? Do you recognize the .bat file or folder names?

You can then use Autoruns to look for an entry that contains that command line. Uncheck it to prevent it from running.

https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns

Answer 3

Please provide Farbar Recovery Scan Tool (FRST) logs for analysis.

https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

Note: If you are using Edge or Chrome, SmartScreen may initially block the download. Click on the three dots next to the warning and select Keep => Click the Delete drop arrow => Keep anyway.

• If your computer's language is not English, rename FRST64.exe to FRST64English.exe
• Run the tool, leave the default settings, and press Scan.
• Zip the logs, FRST.txt and Addition.txt, then upload to a cloud storage service like OneDrive, Google Drive or gofile.io
• Post the share link.

Share OneDrive files and folders - Microsoft Support