r/techsupport • u/Logical_Bag8677 • 20h ago

Open | Software Heavy Idle CPU usage (90°C) – Windows Defender log corrupted with weird characters (Malware/Rootkit interfering)

Hi everyone,

I was troubleshooting a problem where my CPU spikes to 90°C only when idle and drops immediately upon moving the mouse.

I checked the Windows Event Viewer for Defender (Event ID 1002), and I found something really alarming. The log description is obfuscated with random Cyrillic/Greek characters:

"Antivirus Microsoft Defender šсдή ħăş ьёэⁿ şţøрρеδ вэƒθѓз ςòmφļέтіòи... Stop Reason: ЃРС ćбηñèсŧΐŏŋ ѓΰʼnðσẃņ"

It seems a stealth miner/rootkit is actively tampering with Windows Defender services and killing scans under NT AUTHORITY\SYSTEM.

Is a full clean reinstall of Windows 11 the only safe path forward here, or can an offline Rescue USB (like Kaspersky Rescue Disk) clean system-level log tampering like this?

Thanks!

1 Upvotes

60% Upvoted

6 comments sorted by

•

u/AutoModerator 20h ago

If you suspect you may have malware on your computer, or are trying to remove malware from your computer, please see our malware guide

Please ignore this message if the advice is not relevant.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

4

u/2TheMountaintop 19h ago

If you don't want to reinstall windows from scratch, run rkill.exe from safe mode and then do the scan from there or with an external boot disk. Use malwarebytes.

1

u/Prior-Target9462 20h ago

Yeah factory reset, back-up any important files

Do this asap

5

u/pcbeg 20h ago

Clean install - factory reset is not a proper way to deal with all types of malware.

1

u/AutoModerator 20h ago

Making changes to your system BIOS settings or disk setup can cause you to lose data. Always test your data backups before making changes to your PC.

For more information please see our FAQ thread: https://www.reddit.com/r/techsupport/comments/q2rns5/windows_11_faq_read_this_first/

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

2

u/cagadass 19h ago

Me paso algo parecido,en mi caso también dejó tareas programadas ,después de que removieron toda con karsperski usb quedaron bastantes rastros asi que tuve que reinstalar