ekrn.exe using 50% CPU

Question

Hello,

I have a big problem, ekrn is using 50% of my CPU but I don't know how to disable it or reduce this load.
I know it's an ESET process but even when I disable the protection, it remains at 50%

<config>Windows 7

g3n-h@ckm@n · Answer

Hi, did you pay for it?  -- ¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

truc34 · Answer

yes

g3n-h@ckm@n · Answer

Well... how much RAM do you have?  -- ¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

truc34 · Answer

I have 2 GB ekrn.exe takes up 36 MB but 50% of my dual core.

g3n-h@ckm@n · Answer

and if you disable it, what is your CPU at?  -- ¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

truc34 · Answer

I can't disable it, I have access denied even though I am an administrator  my total CPU usage is at 54%  so if I remove the 50% from ekrn.exe, that leaves me with 4%

g3n-h@ckm@n · Answer

I can't disable it...  LOL!!!  The protective antivirus that traps you!!!! No!!! I'm your antivirus, not some other one!!! Mwahahahaha!!!  ¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

truc34 · Answer

Wouldn't I need to test a complete uninstallation + reinstallation?

g3n-h@ckm@n · Answer

nan

Attention !!! : this tool may be mistakenly detected as a virus
Attention !!! : this tool is powerful, strictly follow the instructions below

all "non-vital Windows" processes will be stopped, save your work.

Disable all your protections if possible, antivirus, sandbox, firewalls, etc....

download and save Pre_Scan on your desktop:

https://forums-fec.be/gen-hackman/Pre_Scan.exe

if the link does not work:

http://general-changelog-team.fr/fr/downloads/viewdownload/41-outils-de-gen-hackman/52-pre-scan
http://www.archive-host.com

Warning: There will be a desktop blackout during the scan --> do not panic.

once downloaded, run it, let it scan until "Pre_scan_date_and_time.txt" appears on the desktop.

If the tool is restarted multiple times, it will offer you a menu and since no option is requested, launch the "Kill" option

if the tool is blocked by the infection, use this version with the .pif extension:

https://forums-fec.be/gen-hackman/Pre_Scan.pif

if the tool detects a proxy and you haven't installed one, click on "remove proxy"

There may be a multitude of black windows flashing, let it work

Post Pre_Scan_date_and_time.txt that will appear on the desktop at the end of the scan

It is possible that the tool will restart your PC, let it do so

DO NOT POST IT ON THE FORUM!!! (it's too long)

Host the report on http://pjjoint.malekal.com then provide the link obtained in exchange on the forum where you are getting help

--
¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

truc34 · Answer

It seems to be finished, the blue window has closed but there is no report on the desk. ekrn.exe is now using only 0% of the CPU Are you the one developing this tool?

truc34 · Answer

actually, it was enough to restart the computer at the end of the analysis here is the report: https://pjjoint.malekal.com/files.php?id=20120922_x9x8m15g9e7

g3n-h@ckm@n · Answer

Are you the one developing this tool?  Yes, with quite a bit of help recently from Saachaa, the designer of Slowin Cleaner.  I'm studying your report.  ¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

g3n-h@ckm@n · Answer

It seems that you did not disable the antivirus as requested.  -- ¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

truc34 · Answer

Do you want me to run the tool again? But it seems that the problem is resolved.

g3n-h@ckm@n · Answer

yes, we haven't finished; just because you no longer see any issues, it doesn't mean you are completely safe. Thank you for finishing everything.

--
¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

truc34 · Answer

Indeed, ekrn.exe is back in full swing
Thankfully, we trust you when using this software, as you can scan whatever you want, modify whatever you want ...
For example, my email address appears in the report ....
Here is the report:
https://pjjoint.malekal.com/files.php?id=20120923_m12q9j5g8v10
For example, my email address appears in the report ....

g3n-h@ckm@n · Answer

disable the antivirus, restart the tool, click on "Diag" and provide the link to the hosted report

and if I wanted to hack you, I wouldn't need these reports :)
but that's not my goal, I'm here to fight malware and not to be a part of it :)

¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

truc34 · Answer

here is the second report https://pjjoint.malekal.com/files.php?id=20120923_d10f15v8e14i10

g3n-h@ckm@n · Answer

Close all windows and applications during installation and scanning.   &#9654 Download here:  Malwarebytes  &#9654 Install it (make sure to select "French"; do not change the installation settings) and update it.  Restart Malwarebytes by strictly following these instructions:  ! Disconnect and close all running applications!  &#9654 Launch Malwarebytes.  Perform a so-called "Complete" scan.  &#9654 Let the program work (and do nothing else with the PC during the scan). &#9654 At the end, click on "Results." &#9654 Ensure that all infected items are validated, then click on "Remove."  &#9654 Note: If you need to restart your PC to complete the cleaning, do it!   &#9654 Post the saved report after removing the infected items (in the "Report/Log" tab of Malwarebytes, the most recent one)   -- ¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

truc34 · Answer

Here is your report:
I think he found your scanning software as malware:

Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Database version: v2012.09.23.04

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Guillaume :: PC-DE-UTILISAT [administrator]

09/23/2012 07:21:13 PM
mbam-log-2012-09-23 (07-21-13).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File system | Heuristic/Extra | Heuristic/Shuriken | PUP | PUM
Scan options disabled: P2P
Item(s) scanned: 455949
Elapsed time: 1 hour(s), 43 minute(s), 32 second(s)

Memory processes detected: 0
(No malicious items detected)

Memory modules detected: 0
(No malicious items detected)

Registry key(s) detected: 0
(No malicious items detected)

Registry value(s) detected: 0
(No malicious items detected)

Registry data item(s) detected: 0
(No malicious items detected)

Folder(s) detected: 0
(No malicious items detected)

File(s) detected: 2
C:\Users\Guillaume\Desktop\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and successfully deleted.
C:\Users\Guillaume\Downloads\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and successfully deleted.

(end)

g3n-h@ckm@n · Answer

exactly it's normal  are there still issues?  -- ¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

truc34 · Answer

No, I think it's over. Did the reports learn something? Thank you very much for helping me.

g3n-h@ckm@n · Answer

Well, there's still the cleaning up to do ^^    https://gen-hackman.kanak.fr/#1037 -- ¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

truc34 · Answer

# DelFix v9.0 - Report created on 09/24/2012 at 07:27:40 # Updated on 09/23/12 by Xplode # Operating System: Windows 7 Home Premium Service Pack 1 (32-bit) # Username: Guillaume - PC-DE-UTILISAT (Administrator) # Executed from: C:\Users\Guillaume\Downloads\delfix.exe # Option [Removal]   ~~~~~~ Folders ~~~~~~  Deleted: C:\Qoobox Deleted: C:\pre_scan Deleted: C:\32788R22FWJFW  ~~~~~~ Files ~~~~~~  Not Deleted: C:\Users\Guillaume\Desktop\Defogger.exe Deleted: C:\Users\Guillaume\Downloads\adwcleaner (1).exe Deleted: C:\Users\Guillaume\Downloads\defogger_disable.log Deleted: C:\Users\Guillaume\Downloads\hijackthis.log Deleted: C:\Users\Guillaume\Downloads\JavaRa.zip  ~~~~~~ Registry ~~~~~~  Key Deleted: HKCU\console_combofixbackup Key Deleted: HKCU\Software\g3n-h@ckm@n Key Deleted: HKLM\SOFTWARE\AdwCleaner Key Deleted: HKLM\SOFTWARE\Swearware Key Deleted: HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart Key Deleted: HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys Key Deleted: HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart Key Deleted: HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys  ~~~~~~ Other ~~~~~~  -> Prefetch Video  *************************  DelFix[S1].txt - [1363 bytes] - [09/24/2012 07:27:40]  ########## EOF - C:\DelFix[S1].txt - [1487 bytes] ##########     for purera: Total space cleaned: 282.23 MB  and thank you again

g3n-h@ckm@n · Answer

ok good road :)  -- ¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

truc34 · Answer

he has returned

g3n-h@ckm@n · Answer

who ?  -- ¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

truc34 · Answer

ekrn.exe is still at 49%.

g3n-h@ckm@n · Answer

give it a try and use ccleaner to clean the registry several times before reinstalling it  -- ¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

truc34 · Answer

It seems to have solved the problem thank you

truc34 · Answer

in fact, it's random, it's roughly 1 time out of 2 but I think there are no solutions.

truc34 · Answer

It's when he's updating that he uses 50%, but sometimes he gets stuck on an update because he can't find an internet connection (I'm using FreeWifi). I need to authenticate on FreeWifi, cancel the update search, and restart it. After that, it's fine.

g3n-h@ckm@n · Answer

hospital ?  -- ¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

truc34 · Answer

yes

g3n-h@ckm@n · Answer

oh well, if your connection is lousy, it's normal that he's struggling  -- ¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

See u in a big bullshit · Answer

Good evening, hello, anyway hi, I have read this entire post here and I'm a bit disoriented...  Yesterday, I noticed that my CPU was around 60% right from startup, I tried several things, I ran an ESET NOD32 antivirus scan then I was advised to buy Malwarebytes to see if there was any rootkit the scans resulted in the removal of a few "potentially dangerous" applications  I then rebooted and as nothing had changed and I was still around 60% CPU with no applications open except my ESET NOD32, I let it run until today  And it was today that I took note of this ekrn.exe which is consuming about 50% of resources. I also bought the ESET version. Even though I downloaded the antivirus software before entering my key to activate it (I was already a user on another PC and I had protected it very well with this software for 5 years... before giving it to a friend)  In your opinion, what should I do??

g3n-h@ckm@n · Answer

Hello, open a new topic  -- ¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

Ekrn.exe using 50% CPU

37 réponses

Texture issues in enshrouded

Driver his

Peritel to hdmi conversion

How to access the bios on a compaq notebook

Dsi won't turn on anymore

Search for a song with the lyrics

Left mouse click, touchpad click inactive

Codes stronghold crusader

Stuck computer system repair

Disable write protection mp3 player