CPU running at 100% with nothing open [Solved]

• Read my instructions thoroughly, carry out each step in the given order.
• Do not make any changes to your system, or run any tools other than those I provided. Do not delete, fix, uninstall, or install anything unless I tell you to.
• If you are unsure about anything or if you encounter any problems, please stop and inform me about it.
• Stick with me until I tell you that your computer is clean. Absence of symptoms does not mean that your computer is free of malware.
• Back up important files before we start.

[external image: goGMWSt.gif]Backdoor Warning
 
——————————
 
One or more of the identified malware is known to use a backdoor, that allows attackers to remotely control your computer, download/execute files and steal system, financial & personal information.
 
If your computer has been used for online banking, has credit card information or other sensitive data, using a non-compromised computer/device you should immediately change all account information (including those used for Email, eBay, Paypal, online forums, etc).
 
Banking and credit card institutions should be notified of the possible security breach. Please read the following article for more information: How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
 
Whilst the identified malware can be removed, there is no way to guarantee the trustworthiness of your computer unless you reformat your hard drive and reinstall your Operating System. This is due to the nature of the malware, which allows a remote attacker to make any kind of modification. Many experts in the security community believe that once compromised with this type of malware, the best course of action is to reformat/reinstall. Please read the following articles for more information.

• When should I re-format? How should I reinstall?
• Help: I Got Hacked. Now What Do I Do?
• Where to draw the line? When to recommend a format and reinstall?

You now have the choice between cleaning the malware present or reformatting your computer. Ultimately, the decision is yours, and what you're most comfortable with. Once you've read the articles linked above, let me know if you have any questions, and how you wish to proceed.

• Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the entire contents of the codebox below and paste into the Notepad document.
  

  start
  CreateRestorePoint:
  
  zip: System32\drivers\jyst.sys
  Folder: C:\Users\Pamela\AppData\Local\{66D93A45-7283-4904-8236-1C69A998DFAD}
  
  C:\Users\Pamela\AppData\Local\{66D93A45-7283-4904-8236-1C69A998DFAD}
  2009-12-02 21:19 - 2015-07-26 01:18 - 0000470 _____ () C:\Users\Pamela\AppData\Roaming\wklnhst.dat
  2011-12-11 17:10 - 2011-12-11 17:10 - 0001260 ___SH () C:\Users\Pamela\AppData\Local\5o42hc3l58u034
  2010-12-08 20:38 - 2010-12-08 20:38 - 0000000 _____ () C:\Users\Pamela\AppData\Local\Jgohanedev.bin
  2010-12-08 20:38 - 2010-12-08 20:38 - 0000120 _____ () C:\Users\Pamela\AppData\Local\Mbezivewavadej.dat
  2011-12-09 19:50 - 2011-12-09 19:50 - 0001252 ___SH () C:\Users\Pamela\AppData\Local\nlxrgy8n4nqv0odc4cjr8n562o1a
  2011-12-11 17:10 - 2011-12-11 17:10 - 0001260 ___SH () C:\ProgramData\5o42hc3l58u034
  2009-12-08 01:08 - 2009-12-08 01:08 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
  2011-12-09 19:50 - 2011-12-09 19:50 - 0001252 ___SH () C:\ProgramData\nlxrgy8n4nqv0odc4cjr8n562o1a
  
  FirewallRules: [{A3EB645D-CB37-440A-89F6-7F4BFDEDEDA1}] => (Allow) svchost.exe
  CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Pamela\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.7.796\_platform_specific\win_x86\widevinecdmadapter.dll => No File
  CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Pamela\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.7.771\_platform_specific\win_x86\widevinecdmadapter.dll => No File
  Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File
  BHO: No Name -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> No File
  CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
  HKU\S-1-5-21-1608746659-3683959345-3987556120-1001\…\MountPoints2: {07bea468-a41f-11df-9111-002511a28efb} - L:\WIN\setup.exe
  HKU\S-1-5-21-1608746659-3683959345-3987556120-1001\…\Winlogon: [Shell] explorer.exe, <==== ATTENTION
  
  CMD: ipconfig /flushdns
  EmptyTemp:
  end

• Click File, Save As and type fixlist.txt as the File Name.
• Important: The file must be saved in the same location as FRST64.exe.

• Double-Click FRST64.exe to run the programme.
• Click Fix.
• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.

• Please go to my channel
• Click Browse and locate the following file on your Desktop:
  • Upload.zip
• Click Submit Query.

• Fixlog.txt

Hi Marie and thank you so much for your help.  I read the articles and I think I should reformat and reinstall.  I have not done anything after reading the articles and I'm really not sure the steps to reformatting and reinstalling.
Thanks again

Pamela

Hello Pamela,
 
I have not heard back from you in 3 days.

• Do you still require help?


• If you require additional time to complete my instructions, please let me know.


• If after 48 hours you have not replied to this thread it will have to be closed.
  
  
 

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.