Question CPU Fan/ Hidden Malware?

[Pez]

Hi all.

Something similar happened to me many years ago, perhaps a decade.

My computer would be idle, nothing major going on, no programs that I'd executed running, just standard background programs running.

But I'd hear my CPU fan speeding up, as if there was a program running that was demanding a lot from the CPU. But as soon as I'd launch Task Manager, the CPU fan would slow back down to "normal", and nothing in the Task Manager Apps or Background Processes would jump out at me as "suspicious".

If my memory serves me, I believe it turned out to be some kind of bit coin miner......but for the life of me, since it was so long ago, I can't remember what I used to detect & find it. Anyway....

The same thing is happening again now.

I have Windows 10, 64-bit, Version 1909, OS Build 18363.535

I use the built-in Windows 10 Windows Security.

Now: When I say my CPU fan is speeding up, I don't mean in a ridiculous manner, not like the CPU is spiking out at 90 or 100%. I just have sensitive hearing and can pick up on the slightest differences

Well, whatever this is that's causing the slight spike in CPU usage, plus, the speeding up of the CPU fan, is "hiding" when I launch Task Manager. From some searching I did on the 'Net, others have experienced things similar to mine. One of the possible solutions I came across is to get a program called "Bill2's Process Manager". I downloaded & installed it, but, none of the processes jumped out as being suspicious; I even arranged the processes by CPU usage to see what was taking up the most %.

I downloaded the free copy of Malewarebytes and ran it. It did find two bit coin entries in the Registry, so I had the program quarantine it.

Any of you know a good online anti-virus scanner? How about any of these at this link:
https://www.ecloudbuzz.com/best-free-online-virus-scanners/

Thanks for any help & suggestions;
Pez

 

[Ralston18]

Take another look at what all may be running on your computer.

Task Manager is a start.

However Resource Manager can be very helpful via the graphs and you can focus on the CPU(s).

Another tool is Windows Process Explorer (free). Microsoft product and downloadable via Microsoft's website.

https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

Very likely that you will find some rogue process that can be safely terminated or otherwise dealt with - i.e., reinstall/reconfigure perhaps.

Delve deeper and then, failing any results, try another AV.

 

[Pez]

Ralston18!!

Yes, that did it!!!

You put Resource "Manager", but I believe you meant "Monitor", correct?

When Task Manager is launched, if you go to the Performance tab, you can launch Resource Monitor right at the bottom of the interface.

Well, it was a combination of Resource Monitor, and, I downloaded & installed that Process Explorer.

I mentioned in my original post about when launching Task Manager how the "sound" of the fans would go back down to "normal", as if the program causing the CPU increase was hiding.

Well, I launched that Process Explorer (and I saw it in regular Task Manager & Resource Monitor), and I notice some app called "SoundMixer". I thought nothing of it at first, but then I was like, Hmmmmm.....wait a minute.

My Aorus Gaming 8 motherboard has an integrated sound card; perhaps you've heard of Creative/ SoundBlaster? But this SoundMixer didn't sound familiar.....

I look up its location: C:\Users\[username]\AppData\Roaming\Microsoft\SoundMixer

I see that it's in a Microsoft folder, so at first I'm thinking it's legit.

Well, you know how when you right-click on a file then left-click/ choose Properties? On the Details tab you'll find info about the file.

Welllllll....on the Details tab for SoundMixer? Next to "Product Name", there's nothing there about "Microsoft", just the word "SoundMixer" again. And next to "Copyright"? Nothing about Microsoft there, either; it just has "Copyright (C) 2017".

I looked it up, and yes, it is malware. I have no idea how it slipped into my system; maybe a hacked web site.

So, I End Process in Task Manager, then go to that location of C:\Users\[username]\AppData\Roaming\Microsoft\SoundMixer, and Delete the SoundMixer folder & file/ program.

And now my CPU fan does not speed up

Thanks for your suggestions!!
Pez

 

[Ralston18]

Yes. I meant Resource Monitor - apologies.

Key is that you figured it all out.

You are welcome.

 

[mdd1963]

Many crypto currency mining pieces of malware will indeed 'hide' themselves/suspend themselves when/if task manager is started, making detection more difficult by the casual user...

Glad you found it!