Cpu seems to be overloading

Viruses and worms
1

Hello, my laptop has begun to do funny things like the keys on the keyboard changing randomly and serious cpu and memory lag. Is this a virus?

2

Attach the requested log files to your next post if you want help.

3

sorry, which log files refer you too?

4

Here are the instructions: https://forum.avast.com/index.php?topic=53253.0

5

okay cool here are the logs ;D ;D

6

Await my reply whilst I analyze your logs.

7
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
Enable only one as multiple programs takes a lot of resources.

Hack/Pirate tool: C:\WINDOWS\AutoKMS\AutoKMS.exe has been detected. We do not condone piracy and further help will be declined should you choose to use them.

[*]Step #1 Fix with FRST
Make sure that you still have FRST.exe on your Desktop. If you do not have it, download the suitable version from here to your Desktop.
[*]Open Notepad.exe. Do not use any other text editor software;
[*]Copy and Paste the contents inside the code-box to your Notepad –

Start
CreateRestorePoint:
CloseProcesses:
EmptyTemp:
Task: {1E28A318-7E11-4191-AE65-15028A34C9AF} - System32\Tasks\{DFCC743C-D7FC-4C3D-B7DB-5C43B0E3E8CE} => pcalua.exe -a F:\setup.exe -d F:\
Task: {22A0CD80-CE78-4300-8B9C-66746725DD7A} - System32\Tasks\{200D20A9-4828-401E-8D9F-FF4F91339C3A} => pcalua.exe -a C:\PROGRA~2\PACIFI~1\SETUPR~1.EXE -d C:\Users\jigalowjugs\Downloads -c ENV.REPORT_ADRESS SETUP_START 31a2b880-13c2-4c13-9994-29aa45e53517
Task: {5B4F1A68-EEAE-474E-9440-0335DA253567} - System32\Tasks\AutoKMS => C:\WINDOWS\AutoKMS\AutoKMS.exe
Task: {6876BAD2-29EE-4149-8B2C-3D46B39383E5} - System32\Tasks\MdmUpdateTaskMachineCore => C:\Users\jigalowjugs\AppData\Roaming\uTorrent\Caches\mdm [2015-07-05] () <==== ATTENTION
C:\WINDOWS\AutoKMS\
AlternateDataStreams: C:\ProgramData:gs5sys
AlternateDataStreams: C:\Users\All Users:gs5sys
AlternateDataStreams: C:\Users\jigalowjugs:gs5sys
AlternateDataStreams: C:\ProgramData\Application Data:gs5sys
AlternateDataStreams: C:\ProgramData\Templates:gs5sys
AlternateDataStreams: C:\Users\jigalowjugs\Application Data:gs5sys
AlternateDataStreams: C:\Users\jigalowjugs\Cookies:gs5sys
AlternateDataStreams: C:\Users\jigalowjugs\Local Settings:gs5sys
AlternateDataStreams: C:\Users\jigalowjugs\Templates:gs5sys
AlternateDataStreams: C:\Users\jigalowjugs\AppData\Local:gs5sys
AlternateDataStreams: C:\Users\jigalowjugs\AppData\Roaming:gs5sys
AlternateDataStreams: C:\Users\jigalowjugs\AppData\Local\Application Data:gs5sys
AlternateDataStreams: C:\Users\jigalowjugs\AppData\Local\History:gs5sys
AlternateDataStreams: C:\Users\jigalowjugs\Documents\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\Public\Documents\desktop.ini:gs5sys
() C:\Users\jigalowjugs\AppData\Roaming\uTorrent\Caches\mdm
C:\Users\jigalowjugs\AppData\Roaming\uTorrent\Caches\mdm
HKU\S-1-5-21-1765391690-3716712665-1934986230-1000\...\MountPoints2: {4675f919-8b8e-11e3-b8e7-dca971682422} - F:\SETUP.EXE
HKU\S-1-5-21-1765391690-3716712665-1934986230-1000\...\MountPoints2: {4675f91a-8b8e-11e3-b8e7-dca971682422} - G:\Setup.exe
HKU\S-1-5-21-1765391690-3716712665-1934986230-1000\...\MountPoints2: {89c16dc7-8b70-11e3-bc9d-806e6f6e6963} - D:\install.exe
HKU\S-1-5-21-1765391690-3716712665-1934986230-1000\...\MountPoints2: {ed3cf5cd-f3d1-11e3-8230-e8039a16b1b7} - H:\setup.exe
HKU\S-1-5-21-1765391690-3716712665-1934986230-1000\...\MountPoints2: {ed3cf5ce-f3d1-11e3-8230-e8039a16b1b7} - I:\SETUP.EXE
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled
ProxyServer: [.DEFAULT] => http=127.0.0.1:65147;https=127.0.0.1:65147
RemoveProxy:
SearchScopes: HKLM-x32 -> DefaultScope value is missing
BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} ->  No File
U3 az87ba7j; C:\Windows\System32\Drivers\az87ba7j.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder)
CMD: bitsadmin /reset /allusers
End

[*]Click on File > Save as…
[list][*]Inside the File Name box type fixlist.txt
[*]From the Save as type drop down list, choose All Files
[*]Save the file to your Desktop;
[*]Re-run FRST.exe and click Fix;
[*]Note: If FRST advises there is a new updated version to be downloaded, do so/allow this.[]After the completion, a log will be produced;
[]Attach the log in your next reply.[/list]

[*]Step #2 Fix with AdwCleaner
[*]Download AdwCleaner by Xplode to your Desktop from the following link.
[list][]Download Link #1
[]Download Link #2
[*]Right-click on AdwCleaner.exe and choose Run as administrator;
[*]Click on Scan and let the program run unhindered;
[*]When done, click on Clean and allow the system to reboot after it is done;
[]A log will be opened automatically after the restart;
[]Attach the log in your reply.[/list]

[*]Required Log(s):
[]FRST Fix Log
[]AdwCleaner Log

Regards,
Valinorum

8

Hello, thank you for your assistance, this laptop has been a communal laptop and used by many people as such its been hard to monitor what its been used for and this is the possible reason for the hack/ pirate tool. I assure you that no such thing will be done again. Here are the logs created.
Regards jeff

9

How is your PC?

10

yea seems better, thanks

11

Although when i use the mouse button it still seems to double click for no reason or highlight random things i didnt press. this is different than before.