Powershell hogging ram/cpu (crypto malware)

Question

Since i've got that issue and got it fixed with a good person named _AW_ in this community. i got it again and noticed a lot of people are having same issue. he told me in this thread to make a thread so he reply me.

https://answers.microsoft.com/en-us/windows/forum/all/powershell-sudden-high-ram-usage/daa6eb1d-0757-474e-b835-0832a2ae1599

i hope he finds a way that everyone can solve their problem with.

note: i use my pc normally and i suddenly get a pop up powershell for 1sec and disappears with a 3gb ram usage and 30% cpu usage.

my system with i3 2350M/4gb ram ddr3.

Answer 1

So is the problem resolved? If not, post fresh FRST logs.

Answer 2

sorry for late reply.

after i checked task scheduler i noticed there 2 files are hogging powershell on my pc. i deleted them but they still work. i got back up of them on telegram. here pictures of the files that says powershell:

https://ibb.co/Y7SFjYS

https://ibb.co/p2wvQRt

Answer 3

Hi Ali_FloppaFan, please scan with Farbar Recovery Scan Tool (FRST), and I'll help you resolve the issue.

https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

Run FRST as administrator, use default settings and press Scan. Two logs are created in the folder that FRST is run from, FRST.txt and Addition.txt. Zip the logs and share on OneDrive, Google Drive or any file sharing service, then post the share link.

* Note:If you are downloading FRST with Edge, smartscreen will initially block it.

Click on the 3 dots next to the warning and select Keep -> Show more -> Keep anyway.

Answer 4

Hi Ali. I'm Greg, here to help you with this.

What makes you think you have Crypto Malware? Please explain.

1. Do this most thorough disinfection procedure using the industry's leading free scanners to find and root out infection wherever it hides, then repair any system files that were corrupted:

https://answers.microsoft.com/en-us/windows/for...

2. If after that you still get the Powershell popup there are fixes for that here:

https://www.minitool.com/backup-tips/windows-po...

3. If it persists with high RAM and CPU usage by Powershell, there are fixes for that here:

https://thegeekpage.com/high-cpu-usage-by-windo...

https://www.reddit.com/r/techsupport/comments/z...

https://www.youtube.com/watch?v=HSnT6_WK1zg

Feel free to ask back any questions. Based on the results you post back, I will have other suggestions if necessary.

____________________________________________

Standard Disclaimer: There are links to non-Microsoft websites. The pages appear to be providing accurate, safe information. Watch out for ads on the sites that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the sites before you decide to download and install it.