Ekrn.exe using 50% CPU

Hi, did you pay for it?

--
¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

yes

I have 2 GB
ekrn.exe takes up 36 MB but 50% of my dual core.

and if you disable it, what is your CPU at?

--
¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

I can't disable it, I have access denied even though I am an administrator
my total CPU usage is at 54%
so if I remove the 50% from ekrn.exe, that leaves me with 4%

I can't disable it...

LOL!!!

The protective antivirus that traps you!!!! No!!! I'm your antivirus, not some other one!!! Mwahahahaha!!!

¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

Wouldn't I need to test a complete uninstallation + reinstallation?

nan

Attention !!! : this tool may be mistakenly detected as a virus
Attention !!! : this tool is powerful, strictly follow the instructions below

all "non-vital Windows" processes will be stopped, save your work.

Disable all your protections if possible, antivirus, sandbox, firewalls, etc....

download and save Pre_Scan on your desktop:

https://forums-fec.be/gen-hackman/Pre_Scan.exe

if the link does not work:

http://general-changelog-team.fr/fr/downloads/viewdownload/41-outils-de-gen-hackman/52-pre-scan
http://www.archive-host.com

Warning: There will be a desktop blackout during the scan --> do not panic.

once downloaded, run it, let it scan until "Pre_scan_date_and_time.txt" appears on the desktop.

If the tool is restarted multiple times, it will offer you a menu and since no option is requested, launch the "Kill" option

if the tool is blocked by the infection, use this version with the .pif extension:

https://forums-fec.be/gen-hackman/Pre_Scan.pif

if the tool detects a proxy and you haven't installed one, click on "remove proxy"

There may be a multitude of black windows flashing, let it work

Post Pre_Scan_date_and_time.txt that will appear on the desktop at the end of the scan

It is possible that the tool will restart your PC, let it do so

DO NOT POST IT ON THE FORUM!!! (it's too long)

Host the report on http://pjjoint.malekal.com then provide the link obtained in exchange on the forum where you are getting help

--
¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

It seems to be finished, the blue window has closed but there is no report on the desk.
ekrn.exe is now using only 0% of the CPU
Are you the one developing this tool?

actually, it was enough to restart the computer at the end of the analysis
here is the report:
https://pjjoint.malekal.com/files.php?id=20120922_x9x8m15g9e7

Are you the one developing this tool?

Yes, with quite a bit of help recently from Saachaa, the designer of Slowin Cleaner.

I'm studying your report.

¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

It seems that you did not disable the antivirus as requested.

--
¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

Do you want me to run the tool again?
But it seems that the problem is resolved.

yes, we haven't finished; just because you no longer see any issues, it doesn't mean you are completely safe. Thank you for finishing everything.

--
¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

Indeed, ekrn.exe is back in full swing
Thankfully, we trust you when using this software, as you can scan whatever you want, modify whatever you want ...
For example, my email address appears in the report ....
Here is the report:
https://pjjoint.malekal.com/files.php?id=20120923_m12q9j5g8v10
For example, my email address appears in the report ....

disable the antivirus, restart the tool, click on "Diag" and provide the link to the hosted report

and if I wanted to hack you, I wouldn't need these reports :)
but that's not my goal, I'm here to fight malware and not to be a part of it :)

¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

here is the second report
https://pjjoint.malekal.com/files.php?id=20120923_d10f15v8e14i10

Close all windows and applications during installation and scanning.

▶ Download here:

Malwarebytes

▶ Install it (make sure to select "French"; do not change the installation settings) and update it.

Restart Malwarebytes by strictly following these instructions:

! Disconnect and close all running applications!

▶ Launch Malwarebytes.

Perform a so-called "Complete" scan.

▶ Let the program work (and do nothing else with the PC during the scan).
▶ At the end, click on "Results."
▶ Ensure that all infected items are validated, then click on "Remove."

▶ Note: If you need to restart your PC to complete the cleaning, do it!

▶ Post the saved report after removing the infected items (in the "Report/Log" tab of Malwarebytes, the most recent one)

--
¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

Here is your report:
I think he found your scanning software as malware:

Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Database version: v2012.09.23.04

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Guillaume :: PC-DE-UTILISAT [administrator]

09/23/2012 07:21:13 PM
mbam-log-2012-09-23 (07-21-13).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File system | Heuristic/Extra | Heuristic/Shuriken | PUP | PUM
Scan options disabled: P2P
Item(s) scanned: 455949
Elapsed time: 1 hour(s), 43 minute(s), 32 second(s)

Memory processes detected: 0
(No malicious items detected)

Memory modules detected: 0
(No malicious items detected)

Registry key(s) detected: 0
(No malicious items detected)

Registry value(s) detected: 0
(No malicious items detected)

Registry data item(s) detected: 0
(No malicious items detected)

Folder(s) detected: 0
(No malicious items detected)

File(s) detected: 2
C:\Users\Guillaume\Desktop\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and successfully deleted.
C:\Users\Guillaume\Downloads\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and successfully deleted.

(end)