[Violet_Shift]

Hello,

I'm at the end of my wits with this problem, and if I can't figure out what to do, I'm likely to just format my drive. I'd rather not do that right now.

Whenever I start my computer, it will immediately be crippled by cvtres.exe (aka Microsoft® Resource File To COFF Object Conversion Utility) either consuming 99% of the CPU on its own, or starting multiple processes that end up consuming 99% of the CPU. I know this is an inbuilt program on the OS, but I can't figure out why it's behaving this way. While it's acting this way, my computer is extremely slow (Firefox -barely- works, and all of my IM programs are basically worthless at this point). I've tried googling the problem, but everything's come up short.

Anyone have any ideas?

Thanks.

[Advertisements]

Hi Violet_Shift,

Before I send you over to the Malware section of our board, can I ask the full path and file size of cvtres.exe? Based on behavior and a quick look at Systemlookup, it doesn't sound good. If you can afford to hold off one the reformat, maybe we can help. Keep in mind, it's New Years, so we're pretty thinly staffed right now.

Biscuithd

[Biscuithd]

Hi Violet_Shift,

Before I send you over to the Malware section of our board, can I ask the full path and file size of cvtres.exe? Based on behavior and a quick look at Systemlookup, it doesn't sound good. If you can afford to hold off one the reformat, maybe we can help. Keep in mind, it's New Years, so we're pretty thinly staffed right now.

Biscuithd

[Violet_Shift]

Sure.

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe (32.1KB)

This has made me think that something in .NET has become corrupted, but I've no idea how to force a reinstall given that it's packaged with Windows now.

[Biscuithd]

Hi again,

At a fast glance, I'm not likening that line, however, one does not (meaning me) conclude that a machine has malware based on one line. However, I am very suspicious of that line and would suggest that you open a topic in the Malware area http://www.geekstogo...alware-removal/. There are instructions there for how to get and post an OTL log, etc.

Biscuithd

[Violet_Shift]

In that case I'll just reformat. It's an inconvenience yeah but I have all of my stuff backed up on a RAID so really I'd rather be absolutely sure the whatever it is is gone.

Thanks a lot for the help

[Machiavelli]

Wait ... You can upload it to Virustotal.com - please post then the link to the analysis.

[Violet_Shift]

Yeah - just tried that.

Here's the analysis:

https://www.virustot...14a65/analysis/

It looks like it's clean, so I'm strongly suspecting the file is corrupted and is misbehaving.

[Machiavelli]

We can try to replace it with another file if you like. But I'm not sure if this helps. The file is related to a FrameWork software (Visual Studio?). BiscuitHD thought it was this Malware here, but luckily it was not.

Which firewall/Anti Virus are you using?

[Violet_Shift]

It actually -was- malware that was causing the problem - some sort of bitcoin miner disguising itself as a legitimate windows process. MBAM removed it and it's no longer hogging the CPU - admittedly I'm still seeing some very strange behaviour such as Skype and Yahoo IM locking up all the time. (This was what prompted my investigations in the first instance). So alas it still seems like a format is on the cards.

Nonetheless, thanks everyone for their help.

[Biscuithd]

Glad to help, but please, open a topic in the Malware site so we can get you the rest of the way clean. It's unlikely that an automated tool like MBAM is going to clean everything.

[Violet_Shift]

Thank you. I'll start up a thread in the Malware section.

[nolacs22]

Is virustotal a downloaded program?

[nolacs22]

Is virustotal a downloaded program?

My question has been answered.

[Maideen Haja]

Is virustotal a downloaded program?

s your PC running high speed than normal? how to know?
install gadget such as CPU speed. from:-
Windows Desktop Gadgets - All CPU Meter Version 4.7.3
It is a free legal program. If using Window 8.you need to install
additional package 8GadgetPack from:- So that the gadget can run.
Windows Desktop Gadgets - Frequently Asked Questions

Look at the speed if it is running more than 50%, when
no program is running there is something wrong. You might
think your PC is slow and decide to get a new PC,

press CTRL ALT DELETE and go to process manager.
see what program is running and CPU usage percentage.

I just located a bug running this way and remove it. No info
about the bug on the internet.

Another problem is program cvtres.exe is always running high and
using the CPU 80% of the time. According to the internet, the program
is Microsoft legal. I search the internet no way of removing it.
Interestingly if you press CTRL ALT DELETE the program will stop
and terminate and return when you exit the Task Manger.
Task hiding .
I run another third party process manager and SPOTTED it !!!
If I terminate it, it will start to run again. hmmm.
Finally, I suspend it !!. It remind suspended and CPU run normal.
Gee I solved it some how.