running CMD.exe process in background causing CPU high temp and high RAM usage (30%)

Question

running CMD.exe process in background causing CPU high temp and high RAM usage (30%)

Zen 20

Hi everyone!

as the title suggests, i'm having a problem with the cmd running high in the background every time I boot up, this time with my PC. I've found some posts on reddit about a crypto miner file hiding in the program data but to no avail, I seem can't find the culprit. Then I came across a post in using FRST software hence I used the program and linked below my logs. As you can tell, I would like to ask someone's help in creating a fixlist as I am not an expert in reading this kind of logs.

Hoping someone could reach this post, Thank you so much.

https://drive.google.com/file/d/1vkbAY8WH5wyCXoGSlhfkJEjsQvCDITHR/view?usp=drive_link

2 answers

Your answer

Answer 1

DaveM121 811.7K Independent Advisor

1

Open Task Manager, and select the Processes tab.

Right click the CPU column header and enable the Command Line column.

Please provide a screenshot of that window showing the Cmd.exe process and the associated text in the Command Line column.

2

Click the link below to download a small free utility that does not require installation.

https://download.sysinternals.com/files/Autoruns.zip

When the file downloads, unzip it.

Run Autoruns64 as Administrator

A

Select the 'Logon' tab at the top of Autoruns.

Please provide a screenshot of all entries on that tab.

B

Select the 'Scheduled Tasks' tab at the top of Autoruns.

Please provide a screenshot of all entries on that tab.

Zen 20 Reputation points

2025-10-28T13:24:49.4133333+00:00

Hi Dave,

Thank you for your response, I will take note of this other solution you've provided. I've tried a different solution for now, If ever the problem persists, I'll take this method into consideration. I really appreciate the effort of putting in your response.

Thank you.
DaveM121 811.7K Reputation points Independent Advisor

2025-10-28T13:26:57.6133333+00:00

Glad to help!
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
DaveM121 811.7K Reputation points Independent Advisor

2025-10-29T10:13:59.6366667+00:00

Reply to other user.

Answer 2

_AW_ 64,136 Volunteer Moderator

This should sort things for you.

Download Fixlist.txt and save it in the folder where FRST64.exe is located.
Close any apps with unsaved work.
Run FRST64.exe and click "Fix".
The computer will reboot to complete the process.

Please upload Fixlog.txt so I can check if any further action is needed.

Zen 20 Reputation points

2025-10-28T13:22:06.77+00:00

Hi AW,

First of all, thank you so much for your response, I appreciate it.

I've done the following steps provided and my PC is fine now, its idling on its normal temps without opening task manager like last time but during reboot I encoutered a boot failure 2 times then suddenly the system proceeds to boot like normal, gave me a heart attack for a bit, hopefully won't run into such problems soon.

anyways, I've attached the fixlog below, please tell me if there is any steps I should take after this.

thank you so much.

Fixlog.txt
Zen 20 Reputation points

2025-10-28T13:27:21.7833333+00:00

my CPU for now is idling at 50+ degrees Celsius but if I open my task manager it suddenly drops to 38ish degrees C. does the miner still exist somehow?
_AW_ 64,136 Reputation points Volunteer Moderator

2025-10-28T13:58:32.5766667+00:00

Run a scan with Malwarebytes https://www.malwarebytes.com/

Post a screenshot of the result.
Zen 20 Reputation points

2025-10-28T15:34:42.22+00:00

Hi AW,

these were the results of the scan.
_AW_ 64,136 Reputation points Volunteer Moderator

2025-10-28T21:58:57.78+00:00

Just PUPs. They're all OK as you would have knowingly downloaded them.
_AW_ 64,136 Reputation points Volunteer Moderator

2025-10-28T22:08:30.08+00:00

I realized that a lot of the Fixlog is missing so potentially malware may not have been completely removed. Could you rerun the Fixlist and provide the new fixlog?

Also run a new scan with Windows Defender.
_AW_ 64,136 Reputation points Volunteer Moderator

2025-10-28T22:12:21.74+00:00

Could you also reply to me in your other thread as the miner was not removed.
Zen 20 Reputation points

2025-10-28T23:46:46.8933333+00:00

Hi AW,

Thank you for responding for both threads.

I will make a second run for the fixlist you gave me later when I get home from work and do a scan with defender. I'm just hesitant to do it as a boot failure might occur again, can you explain perhaps what is the cause of the boot failure?

*re: Could you also reply to me in your other thread as the miner was not removed.
*
also, I replied to you in my other thread which involves my laptop.

Thank you very much.
_AW_ 64,136 Reputation points Volunteer Moderator

2025-10-28T23:55:00.75+00:00

I've no idea what would have caused the boot failure, though I'm certain it's nothing to do with Farbar/FRST.

Share via

running CMD.exe process in background causing CPU high temp and high RAM usage (30%)

2 answers

Your answer