powershell high ram usage

Question

Hello, a couple of days ago i've noticed that my laptop suddenly ran slower than usual, working and on games. This prompted me to examine the cause of this, which is when I noticed that there are multiple powershell.exe running and using super high ram and CPU usage. In another thread similar to this issue, someone helped them and used Farbar to remove it. But I don't understand how to do the same.

Below is the link for the Farbar txt files. https://drive.google.com/drive/folders/1ivVJyWFoYIdFE7AA4NbYl-rbGmVtL5D4?usp=drive_link

Any assistance regarding this issue would be greatly appreciated :). Thanks in advance

Answer 1

Thanks, I got the link working. The log shows that the malware has successfully been removed. The Powershell stuff was all miner related thus the high CPU and RAM usage.

You also had a Remote Administration Tool, Quasar RAT, which is an open source RAT often used by malware actors to steal passwords and information they may find useful and many other uses.

Your entire 'C' drive had also been excluded from Defender's detections hence nothing was being detected and removed.

More info on its capabilities at https://github.com/quasar/Quasar#features 

I suggest you change any important passwords and setup MFA where possible.

If there's nothing further, clean up by deleting Farbar and the C:\FRST folder.

Also, it would be very much appreciated if you would mark the thread as answered, by pressing 'Yes' below the post(s) that provided the solution.

Good luck! :)

Answer 2

• Download Fixlist.txt and save to the folder FRST64.exe is in
• Run FRST64 and click "Fix" - the PC will reboot to complete the procedure

Please upload Fixlog.txt

Answer 3

thank you very much! Just an additional question, did the log tell anything about the source of the malware? as in where I got it from?

But other than that thank you so much for your help :)

Answer 4

Thank you very much for the quick reply! I have uploaded the fixlog.txt in the same drive! Are there any additional things that I have to do after this? If so, what are the cause of the high powershell usage and its purpose?

Thank you in advance again!

https://drive.google.com/drive/u/2/folders/1ivVJyWFoYIdFE7AA4NbYl-rbGmVtL5D4