Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: Hale.exe and cmd using a lot of CPU  (Read 9027 times)

0 Members and 1 Guest are viewing this topic.

Centurion

    Topic Starter


    Beginner

  • Wicked!
    Hale.exe and cmd using a lot of CPU
    « on: July 07, 2018, 12:18:45 PM »
    I noticed after restarting my pc that there was this process called hale.exe and cmd.exe using a lot of CPU. Upon killing cmd.exe the hale virus goes away and my computer returns to idle state but every time I restart it comes back. How do I get rid of it? Malwarebytes doesn't seem to pick it up.


    SuperDave

    • Malware Removal Specialist
    • Moderator


    • Genius
    • Thanked: 1020
    • Certifications: List
    • Experience: Expert
    • OS: Windows 10
    Re: Hale.exe and cmd using a lot of CPU
    « Reply #1 on: July 07, 2018, 03:43:11 PM »
    Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

    1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
    2. The fixes are specific to your problem and should only be used for this issue on this machine.
    3. If you don't know or understand something, please don't hesitate to ask.
    4. Please DO NOT run any other tools or scans while I am helping you.
    5. It is important that you reply to this thread. Do not start a new topic.
    6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
    7. Absence of symptoms does not mean that everything is clear.

    If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
    *************************************************************************
    Please download AdwareCleaner onto your Desktop. AdwCleaner

    Before starting AdwCleaner, close all open programs and internet browsers, then double-click on the AdwCleaner icon.



    If Windows prompts you as to whether or not you wish to run AdwCleaner, please allow it to run.
    When the AdwCleaner program will open, click on the Scan button as shown below.



    AdwCleaner will now start to search for malicious files that may be installed on your computer.
    To remove the files that were detected in the previous step, please click on the Clean button.



    AdwCleaner will now prompt you to save any open files or data as the program will need to reboot the computer. Please do so and then click on the OK button. AdwCleaner will now delete all detected adware from your computer. When it is done it will display an alert that explains what PUPs (Potentially Unwanted Programs) and Adware are. Please read through this information and then press the OK button. You will now be presented with an alert that states AdwCleaner needs to reboot your computer.
    Please click on the OK button to allow AdwCleaner reboot your computer.A log will be produced. Please copy and paste this log in your next reply.
    *********************************************
    Download and install: Please download Malwarebytes' scanner to your desktop.
    Double Click mbam-setup.exe to install the application.
    • It should update automatically if the computer is connected to the internet.
    • Click on Threat Scan and click on Scan Now.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete make sure all the infections have "quarantine" selected in the Action box.
    • Click on "Apply actions" You may be asked to Restart your computer to completely remove the infections.
    • When disinfection is completed you can click on "Copy to Clipboard".
    • Paste the log in you next reply (CTRL+ V)
    *************************************************
    Download Security Check by screen317 from the following link and save it to your desktop.

    Security Check

    * Double-click Security Check.bat
    * Follow the on-screen instructions inside of the black box.
    * A Notepad document should open automatically called checkup.txt
    * Post the contents of that document in your next reply.

    Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
    Windows 8 and Windows 10 dual boot with two SSD's

    Centurion

      Topic Starter


      Beginner

    • Wicked!
      Re: Hale.exe and cmd using a lot of CPU
      « Reply #2 on: July 21, 2018, 08:32:59 AM »
      Sorry! I was on a vacation and couldn't get access to my computer. I did the above steps. Scanned with both programs and here's the log:

      Code: [Select]
      Results of screen317's Security Check version 1.014 --- 12/23/15 
       Windows 7 Service Pack 1 x64 (UAC is enabled) 
       Internet Explorer 11 
      [b][u]``````````````Antivirus/Firewall Check:``````````````[/b][/u]
       Windows Firewall Enabled! 
      ESET Smart Security 10.0.386.0   
       Antivirus up to date!   
      [b][u]`````````Anti-malware/Other Utilities Check:`````````[/b][/u]
       Mozilla Thunderbird (52.9.1)
       Google Chrome (67.0.3396.99)
       Google Chrome (SetupMetrics...)
      [b][u]````````Process Check: objlist.exe by Laurent````````[/b][/u] 
       ESET NOD32 Antivirus egui.exe 
       ESET NOD32 Antivirus ekrn.exe 
      [b][u]`````````````````System Health check`````````````````[/b][/u]
       Total Fragmentation on Drive C: 2%
      [b][u]````````````````````End of Log``````````````````````[/b][/u]

      But hale.exe still seems to be here. Here's the log of running tasks in the process editor window.

      Code: [Select]
      Process CPU Private Bytes Working Set PID Description Company Name VirusTotal
      System Idle Process 65.58 0 K 24 K 0
      cmd.exe 11.05 5 352 K 5 852 K 3044 Windows Command Processor Microsoft Corporation 0/65
      procexp64.exe 7.37 31 992 K 47 504 K 5384 Sysinternals Process Explorer Sysinternals - www.sysinternals.com 0/65
      svchost.exe 7.23 58 668 K 36 516 K 3864 Host Process for Windows Services Microsoft Corporation 0/65
      ekrn.exe 1.40 55 000 K 148 720 K 852 ESET Service ESET 0/66
      svchost.exe 1.18 186 560 K 198 752 K 308 Host Process for Windows Services Microsoft Corporation 0/65
      csrss.exe 1.05 3 636 K 25 756 K 528 The system cannot find the file specified.
      dllhost.exe 0.97 2 692 K 6 928 K 6108 COM Surrogate Microsoft Corporation Hash submitted...
      conhost.exe 0.93 2 340 K 5 932 K 3000 Console Window Host Microsoft Corporation 0/67
      System 0.89 128 K 304 K 4
      dwm.exe 0.78 36 256 K 40 328 K 1696 Desktop Window Manager Microsoft Corporation 0/67
      Interrupts 0.58 0 K 0 K n/a Hardware Interrupts and DPCs
      cmd.exe 0.47 2 656 K 4 056 K 4468
      Steam.exe 0.35 51 092 K 70 296 K 2248 Steam Client Bootstrapper Valve Corporation 0/67
      svchost.exe 0.12 5 148 K 9 412 K 920 Host Process for Windows Services Microsoft Corporation 0/65
      lsass.exe 0.11 5 836 K 13 716 K 616 Local Security Authority Process Microsoft Corporation 0/67
      SearchIndexer.exe 0.11 31 328 K 15 128 K 3700 Microsoft Windows Search Indexer Microsoft Corporation 0/68
      svchost.exe 0.09 5 064 K 10 648 K 792 Host Process for Windows Services Microsoft Corporation 0/65
      explorer.exe 0.03 29 952 K 49 228 K 1752 Windows Explorer Microsoft Corporation 0/65
      LMS.exe 0.03 2 352 K 5 188 K 2492 Local Manageability Service Intel Corporation 0/56
      chrome.exe 0.03 63 068 K 127 944 K 4276 Google Chrome Google Inc. 0/66
      SteamService.exe 0.03 11 000 K 16 040 K 1156 Steam Client Service Valve Corporation 0/67
      chrome.exe 0.02 35 072 K 49 348 K 1412 Google Chrome Google Inc. 0/66
      hale.exe 0.01 10 828 K 16 584 K 2212 invisible file monitoring and repair Newline Security Technology 17/62
      services.exe 0.01 6 700 K 11 920 K 572 The system cannot find the file specified.
      chrome.exe 0.01 47 716 K 64 008 K 1600 Google Chrome Google Inc. 0/66
      taskhost.exe 0.01 9 572 K 14 420 K 1628 Host Process for Windows Tasks Microsoft Corporation 0/67
      steamwebhelper.exe < 0.01 15 588 K 34 148 K 4960 Steam Client WebHelper Valve Corporation 0/68
      svchost.exe < 0.01 17 692 K 30 764 K 380 Host Process for Windows Services Microsoft Corporation 0/65
      csrss.exe < 0.01 2 184 K 4 476 K 388 The system cannot find the file specified.
      svchost.exe < 0.01 11 792 K 20 720 K 424 Host Process for Windows Services Microsoft Corporation 0/65
      egui.exe < 0.01 22 652 K 35 552 K 2472 ESET Main GUI ESET 0/66
      svchost.exe < 0.01 6 168 K 11 232 K 4768 Host Process for Windows Services Microsoft Corporation 0/65
      devmonsrv.exe < 0.01 2 524 K 6 716 K 1900 Bluetooth Device Monitor Intel Corporation 0/66
      OfficeClickToRun.exe < 0.01 18 008 K 32 524 K 1824 Microsoft Office Click-to-Run (SxS) Microsoft Corporation 0/67
      svchost.exe < 0.01 15 428 K 16 936 K 1140 Host Process for Windows Services Microsoft Corporation 0/65
      chrome.exe < 0.01 32 460 K 63 452 K 5860 Google Chrome Google Inc. 0/66
      nvvsvc.exe < 0.01 9 516 K 18 100 K 1232 The system cannot find the file specified.
      devmgrsrv.exe < 0.01 7 108 K 17 224 K 3800 Bluetooth Device Manager Motorola, Inc. 0/58
      audiosrv.exe < 0.01 2 812 K 7 636 K 448 Bluetooth Media Service Motorola, Inc. 0/67
      WmiPrvSE.exe 3 328 K 7 944 K 2888 The system cannot find the file specified.
      winlogon.exe 3 516 K 8 236 K 596 The system cannot find the file specified.
      wininit.exe 2 204 K 5 500 K 508 The system cannot find the file specified.
      unsecapp.exe 2 116 K 5 996 K 1352 The system cannot find the file specified.
      UNS.exe 3 252 K 7 840 K 3728 User Notification Service Intel Corporation 0/57
      svchost.exe 10 508 K 14 760 K 4892 Host Process for Windows Services Microsoft Corporation 0/65
      svchost.exe 11 444 K 15 740 K 1508 Host Process for Windows Services Microsoft Corporation 0/65
      svchost.exe 26 640 K 24 988 K 132 Host Process for Windows Services Microsoft Corporation 0/65
      svchost.exe 2 796 K 6 844 K 3920 Host Process for Windows Services Microsoft Corporation 0/65
      svchost.exe 2 232 K 6 416 K 2188 Host Process for Windows Services Microsoft Corporation 0/65
      svchost.exe 3 328 K 7 196 K 452 Host Process for Windows Services Microsoft Corporation 0/65
      svchost.exe 4 376 K 8 260 K 2600 Host Process for Windows Services Microsoft Corporation 0/65
      steamwebhelper.exe 21 844 K 32 072 K 4708 Steam Client WebHelper Valve Corporation 0/68
      steamwebhelper.exe 14 664 K 18 748 K 1804 Steam Client WebHelper Valve Corporation 0/68
      steamwebhelper.exe 11 632 K 13 424 K 2172 Steam Client WebHelper Valve Corporation 0/68
      spoolsv.exe 7 696 K 13 840 K 1456 Spooler SubSystem App Microsoft Corporation 0/68
      smss.exe 548 K 1 320 K 256 The system cannot find the file specified.
      rundll32.exe 4 000 K 12 528 K 2108 Windows host process (Rundll32) Microsoft Corporation 0/68
      RichVideo64.exe 2 088 K 5 716 K 2664 RichVideo Module 0/68
      RAVCpl64.exe 9 392 K 11 992 K 408 Realtek HD Audio Manager Realtek Semiconductor 0/61
      NvXDSync.exe 7 296 K 17 756 K 1220 The system cannot find the file specified.
      nvvsvc.exe 3 028 K 8 488 K 876 NVIDIA Driver Helper Service, Version 266.74 NVIDIA Corporation 0/51
      nvSCPAPISvr.exe 2 460 K 6 080 K 2936 Stereo Vision Control Panel API Server NVIDIA Corporation 0/54
      lsm.exe 2 736 K 4 828 K 624 The system cannot find the file specified.
      igfxtray.exe 3 272 K 8 020 K 1572 igfxTray Module Intel Corporation 0/66
      igfxpers.exe 3 348 K 8 780 K 2012 persistence Module Intel Corporation 0/66
      hkcmd.exe 3 016 K 7 712 K 2020 hkcmd Module Intel Corporation 0/65
      GoogleCrashHandler64.exe 1 932 K 528 K 2784 The system cannot find the file specified.
      GoogleCrashHandler.exe 1 540 K 528 K 2992 The system cannot find the file specified.
      FNPLicensingService64.exe 2 028 K 5 124 K 3200 Activation Licensing Service Macrovision Europe Ltd. 0/63
      cmd.exe 2 332 K 4 108 K 1392 Windows Command Processor Microsoft Corporation 0/68
      chrome.exe 14 564 K 20 820 K 4548 Google Chrome Google Inc. 0/66
      chrome.exe 113 160 K 126 336 K 2980 Google Chrome Google Inc. 0/66
      chrome.exe 22 152 K 82 428 K 3160 Google Chrome Google Inc. 0/66
      chrome.exe 3 760 K 8 388 K 4692 Google Chrome Google Inc. 0/66
      chrome.exe 3 860 K 8 816 K 3628 Google Chrome Google Inc. 0/66
      btplayerctrl.exe 1 400 K 5 128 K 4168 Bluetooth Media Player Controller Motorola, Inc. 0/64



      Any thoughts?


      SuperDave

      • Malware Removal Specialist
      • Moderator


      • Genius
      • Thanked: 1020
      • Certifications: List
      • Experience: Expert
      • OS: Windows 10
      Re: Hale.exe and cmd using a lot of CPU
      « Reply #3 on: July 21, 2018, 05:17:00 PM »
      You did not run all the scans I asked for. Please run AdwCleaner and MBAM and post the logs.
      Windows 8 and Windows 10 dual boot with two SSD's

      Centurion

        Topic Starter


        Beginner

      • Wicked!
        Re: Hale.exe and cmd using a lot of CPU
        « Reply #4 on: July 22, 2018, 06:30:17 AM »
        Sorry. I just didn't post the logs. Here we go then.


        Quote
        # -------------------------------
        # Malwarebytes AdwCleaner 7.2.1.0
        # -------------------------------
        # Build:    06-26-2018
        # Database: 2018-07-19.5
        # Support:  https://www.malwarebytes.com/support
        #
        # -------------------------------
        # Mode: Scan
        # -------------------------------
        # Start:    07-22-2018
        # Duration: 00:00:26
        # OS:       Windows 7 Ultimate
        # Scanned:  41453
        # Detected: 0


        ***** [ Services ] *****

        No malicious services found.

        ***** [ Folders ] *****

        No malicious folders found.

        ***** [ Files ] *****

        No malicious files found.

        ***** [ DLL ] *****

        No malicious DLLs found.

        ***** [ WMI ] *****

        No malicious WMI found.

        ***** [ Shortcuts ] *****

        No malicious shortcuts found.

        ***** [ Tasks ] *****

        No malicious tasks found.

        ***** [ Registry ] *****

        No malicious registry entries found.

        ***** [ Chromium (and derivatives) ] *****

        No malicious Chromium entries found.

        ***** [ Chromium URLs ] *****

        No malicious Chromium URLs found.

        ***** [ Firefox (and derivatives) ] *****

        No malicious Firefox entries found.

        ***** [ Firefox URLs ] *****

        No malicious Firefox URLs found.


        AdwCleaner[S00].txt - [3776 octets] - [21/07/2018 17:05:42]
        AdwCleaner[C00].txt - [3468 octets] - [21/07/2018 17:07:06]

        ########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S01].txt ##########

        Quote
        Malwarebytes
        www.malwarebytes.com

        -Log Details-
        Scan Date: 7/22/18
        Scan Time: 2:47 PM
        Log File: fa0663f2-8da4-11e8-a4d4-e89a8f5b880f.json
        Administrator: Yes

        -Software Information-
        Version: 3.4.5.2467
        Components Version: 1.0.342
        Update Package Version: 1.0.6009
        License: Trial

        -System Information-
        OS: Windows 7 Service Pack 1
        CPU: x64
        File System: NTFS
        User: Erlend-PC\Erlend

        -Scan Summary-
        Scan Type: Threat Scan
        Scan Initiated By: Manual
        Result: Completed
        Objects Scanned: 263958
        Threats Detected: 5
        Threats Quarantined: 5
        Time Elapsed: 9 min, 52 sec

        -Scan Options-
        Memory: Enabled
        Startup: Enabled
        Filesystem: Enabled
        Archives: Enabled
        Rootkits: Disabled
        Heuristics: Enabled
        PUP: Detect
        PUM: Detect

        -Scan Details-
        Process: 0
        (No malicious items detected)

        Module: 0
        (No malicious items detected)

        Registry Key: 1
        PUP.Optional.InstallCore, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\KingoSoftService, Quarantined, [396], [527344],1.0.6009

        Registry Value: 0
        (No malicious items detected)

        Registry Data: 0
        (No malicious items detected)

        Data Stream: 0
        (No malicious items detected)

        Folder: 0
        (No malicious items detected)

        File: 4
        PUP.Optional.InstallCore, C:\USERS\ERLEND\APPDATA\LOCAL\KINGOSOFT\KINGO ROOT\UPDATE_27205\BIN\CHECKUPDATE.EXE, Quarantined, [396], [527344],1.0.6009
        PUP.Optional.InstallCore, C:\PROGRAM FILES (X86)\KINGO ROOT\CHECKUPDATE.EXE, Quarantined, [396], [527344],1.0.6009
        Generic.Malware/Suspicious, C:\$RECYCLE.BIN\S-1-5-21-3592460422-1130132556-3560396039-1000\$RJCL5EP.ZIP, Quarantined,
        • , [392686],1.0.6009

        RiskWare.Agent, C:\USERS\ERLEND\APPDATA\LOCAL\TEMP\~NSU.TMP\AU_.EXE, Quarantined, [3846], [352776],1.0.6009

        Physical Sector: 0
        (No malicious items detected)

        WMI: 0
        (No malicious items detected)


        (end)

        And Security Check:

        Quote
        Results of screen317's Security Check version 1.014 --- 12/23/15 
         Windows 7 Service Pack 1 x64 (UAC is enabled) 
         Internet Explorer 11 
        ``````````````Antivirus/Firewall Check:``````````````[/u]
         Windows Firewall Enabled! 
        Malwarebytes                     
        ESET Smart Security 10.0.386.0   
         Antivirus up to date!   
        `````````Anti-malware/Other Utilities Check:`````````[/u]
         Mozilla Thunderbird (52.9.1)
         Google Chrome (67.0.3396.99)
         Google Chrome (SetupMetrics...)
        ````````Process Check: objlist.exe by Laurent````````[/u] 
         ESET NOD32 Antivirus egui.exe 
         ESET NOD32 Antivirus ekrn.exe 
         Malwarebytes Anti-Malware mbamservice.exe 
         Malwarebytes Anti-Malware mbamtray.exe 
        `````````````````System Health check`````````````````[/u]
         Total Fragmentation on Drive C: 2%
        ````````````````````End of Log``````````````````````[/u]


        SuperDave

        • Malware Removal Specialist
        • Moderator


        • Genius
        • Thanked: 1020
        • Certifications: List
        • Experience: Expert
        • OS: Windows 10
        Re: Hale.exe and cmd using a lot of CPU
        « Reply #5 on: July 22, 2018, 04:57:08 PM »
        ESET Online Scanner
        Note : If you use Internet Explorer to get the ESET Online Scanner, you won't have to download, nor install the tool, as everything will be ran in a contextual (pop-up) window of Internet Explorer. However, for every other browsers, you will have to download and install ESET Online Scanner. In this set of instruction, I'll use Google Chrome to download it and run it (since a lot of people will do it), however, except for the download and installation procedure, the same instructions applies if you use Internet Explorer. Please note that two or three prompts will appear if you use Internet Explorer asking you to reload the page, authorize the application, execute it, etc. Accept all of them in order to run ESET Online Scanner.

            Download and execute ESET OnlineScan (on this window, click on ESET Smart Installer to trigger the download). People accessing this URL via Internet Explorer will start the integration process of ESET Online Scanner in their browser;
            Once the installation is done (it requires Admin Rights), check the following settings (two of them are under Advanced Settings, click on it to display them) :

                Enable detection of potentially unwanted applications;
                Scan archives;
                Scan for potentially unsafe applications;
                Optional : If you want to scan more drives, click on Change... and select the drives you want to include in the scan;

           

            After you're done checking these options, click on Start and ESET Online Scanner will download it's virus signature database before starting the scan;
           

            Once done, the scan will start automatically. Detections will appear at the bottom of the window. ESET Online Scanner can have an extremely long scan time that can last between 2 or 3 hours. So if you start the scan, do not interrupt it, let it complete until the end;
           

            After the scan is finished, a summary window will appear to give you the information about the scan. Then you'll have to the option to see what threads were found and to manage the threats that were quarantined;
           


            Click on List of found threats, it'll display every threat identified during that scan, their type and what action was taken against them. Click on Copy to clipboard to copy these results on our clipboard and post them in your next reply;
           


            Once you're done, click on the Back button;
            Check both checkboxes at the bottom: Uninstall application on close and Delete quarantined files before clicking on the Finish button;
        Windows 8 and Windows 10 dual boot with two SSD's

        denisehilton



          Greenhorn

          Thanked: 1
          • Experience: Experienced
          • OS: Windows 10
          Re: Hale.exe and cmd using a lot of CPU
          « Reply #6 on: October 04, 2018, 11:25:21 AM »
          Your comment has been removed. Please do not post malware advice, or post here in the malware forum, unless you need help.Superdave.
          « Last Edit: October 04, 2018, 04:06:16 PM by SuperDave »