High CPU unless Task manager is open (Windows 11, Nitro an517, Eset S.S.P )

[marshmalloow 0]

Sometimes, when I am using my Laptop, the CPU is suddenly very high, making the ventilation go fast, then I open Task Manager and the CPU drops down to normal, and the ventilation returns to normal.

Yet this is more common when I leave the laptop alone, no application open, just the laptop, CPU & ventilator go high, and don't stop unless I open TM, then it drops to normal.

It is quite a headache, as I have ran dozen of Eset S.S.P smart and also 100% scans, all the times no viruses are found.

In the past my got infected, yet Eset found these viruses and eliminated them, now there is no viruses to be found anymore.

My laptop is quite new, and I make sure I don't install insecure software, also I manually disable all the background services, and scheduled tasks that are not from Windows or imperative to run the OS.

I also keep all my drivers up to date, and put special attention on keeping the ventilation of the laptop clean and functional.

I wonder what can be done, how to "fix" this ghostly problem, as Eset S.S.P is unable to find the root cause of it.

[itman 1,538]

15 hours ago, marshmalloow said:

Sometimes, when I am using my Laptop, the CPU is suddenly very high, making the ventilation go fast, then I open Task Manager and the CPU drops down to normal, and the ventilation returns to normal.

Yet this is more common when I leave the laptop alone, no application open, just the laptop, CPU & ventilator go high, and don't stop unless I open TM, then it drops to normal.

It sounds like a coin miner running that Eset is not detecting.

You will need to create a Process Monitor log for @Marcos to review and detect what process is generating the high CPU usage. Start Process Monitor with logging enabled when you you hear the laptop fan noise increase and terminate Process Monitor after 20 secs. or so. Attach created zipped Process Monitor log file to your next forum reply.

Instructions on how to download and use Process Monitor are here: https://support.eset.com/en/kb6308-using-process-monitor-to-create-log-files

[itman 1,538]

I guess I should add that some coin miners can detect security tools that can be used to monitor their activities and shut themself down:

Quote

While running, the miner will constantly poll the list of running of processes. If it detects processes running for Process Explorer, Task Manager, Process Monitor, Process Hacker, AnVir Task Manager, PlayerUnknown's Battlegrounds (PUBG), Counterstrike: Global Offensive, Rainbox Six, or Dota 2, it will terminate the attrib.exe and Iostream.exe processes.

https://www.bleepingcomputer.com/news/security/cryptocurrency-miner-plays-hide-and-seek-with-popular-games-and-tools/

Might be best to rename the Process Monitor executable, procmon.exe, to taskmonitor.exe or the like prior to executing it.

Edited December 15, 2022 by itman