FIXED : Windows Command Processor causing high RAM (2-3 GB RAM) and CPU Usage.
Lately I noticed my laptop being extremely slow. I opened Task Manager to notice 'Windows Command Processor' whose file location points to "C:\Windows\System32\cmd.exe" using upto 2.5 GB of memory. I knew I messed up after downloading shady softwares over time. But this is a symptom I've never seen before. After doing some reseach, I arrived at the conclusion that a shady version of my recently installed Adobe Photoshop 2023 was the culprit, as elaborated in the website https://www.deepwatch.com/ (search for Photoshop in this website to know more).
However I've found a temporary fix to get rid of this virus/miner.
Press Win+R for Run -> taskschd.msc
Welcome to Task Scheduler. You will see a list of tasks rigged to run at specifed times/occassions. Find 'Windows Service Task'.
Be advised, I cannot guarantee that this is the exact name of the task that runs the malicious code/command on your PC. The way I found that this is the culprit is by right-clicking and disabling it, then signing-out and signing back in, then opening Task Manager and finding out that the 'Windows Command Processor' was still there, but it was not using CPU at all and using only 0.6MB of memory only. Additionally, if you delete the task instead of disabling it in Task Scheduler, both should never appear on your PC again.
This means 'Windows Service Task' is the culprit that initiated the malicious 'Windows Command Processor' and we have successfully disabled it.
However, we have only disabled the task that initiates a malicious code which means the malicious file is somewhere on our PC. I tried deleting a lot of suspicious files from Program Data but none worked. This is why I'm calling it a temporary fix. Do not delete anything from Program Data unless you know what you're doing.
Additionally these suspicious tasks are seen to have the trigger 'At log on of any user' in Task Scheduler.
Weirdly enough, after disabling this task, I stopped receiving continuous popups from Microsoft Defender about detecting the infamous threat
C:\Windows\System32\WinRing0x64.sys
which various sources claim is not a threat itself but a doorway for threats.
Posted Apr 1, 2026, 5:44 AM UTC