GPU stuck at 100% – Found Trojan:Win32/Kepavll!rfn disguised as Windows Defender service

CAD Hardware
1

Recently, I noticed my GPU (NVIDIA Quadro P2200) was constantly running at 100% 3D load, even when no graphics-intensive applications were open. Task Manager showed high GPU usage with no obvious culprit. Chrome was closed, RealView was off in SolidWorks, and idle processes were minimal.

After digging deeper:

  • I checked the Task Manager > Details tab and found a suspicious process named:
    Microsoft Network Realtime lnspection Service.exe
    Note the subtle deception: “lnspection” with an “L” instead of an “I”.
  • The file was located in:
    C:\ProgramData\CABService\
  • I inspected the digital signature and found it was “signed” by lolMiner, a known cryptocurrency mining tool.
  • It was also listed under Windows Defender exclusions (!), meaning it was deliberately excluded from scanning.

Microsoft Defender didn’t detect it due to the exclusion.
I ran a set of reputable antivirus and anti-malware utilities** to detect and remove the threat.
detected:

  • Trojan:Win32/Kepavll!rfn
  • PowerShell.DownLoader.2535

:wrench: Cleanup

  1. Removed Windows Defender exclusions for:
 C:\ProgramData\CABService\
 powershell.exe
  1. Terminated the rogue process from Task Manager
  2. Deleted the entire folder:
    C:\ProgramData\CABService\
  3. Manually removed malicious Scheduled Task
    C:\Windows\System32\Tasks\Microsoft\Windows\Device Information\Device User

→ GPU usage returned to normal levels

Engineering video cards are the target audience for such viruses.

image
image855×465 16.2 KB

3 Likes
2

Do you have any ideas where it came from?

3

The last thing I installed were free programs from official sites:
Captura
LibreCAD

I connected via VPN to one company and got into their network (work disk) to work with files. This is the most likely option, an engineering company is a fertile environment for breeding such an infection.

C:\ProgramData\CABService
C:\ProgramData\AKCService
C:\ProgramData\*Service

There is a topic about this virus on the Microsoft forum, it may be in other places and disguised as other services.

1 Like
4

Off-topic, but I generally recommend Sysinternals Process Explorer
for ‘hunting’ things like that, if you want something more advanced then
Task Manager.
Sysinternals suite tools and Nirsoft launcher
are pretty much essential on a Windows box, IMHO :slight_smile:
And you can use Nirsoft launcher to browse and launch tools from both,
which is neat.