# GPU stuck at 100% – Found Trojan:Win32/Kepavll!rfn disguised as Windows Defender service

**URL:** <https://forum.cadmunity.com/t/gpu-stuck-at-100-found-trojan-win32-kepavll-rfn-disguised-as-windows-defender-service/5753>\
**Category:** Hardware\
**Created:** [July 23, 2025, 8:33am UTC](https://forum.cadmunity.com/t/gpu-stuck-at-100-found-trojan-win32-kepavll-rfn-disguised-as-windows-defender-service/5753 "2025-07-23T08:33:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mihkov](https://forum.cadmunity.com/user_avatar/forum.cadmunity.com/mihkov/32/135_2.png) [@mihkov](https://forum.cadmunity.com/u/mihkov)\
**Post date:** [July 23, 2025, 8:33am UTC](https://forum.cadmunity.com/t/gpu-stuck-at-100-found-trojan-win32-kepavll-rfn-disguised-as-windows-defender-service/5753/1 "2025-07-23T08:33:25Z")

</div>

Recently, I noticed my **GPU (NVIDIA Quadro P2200)** was constantly running at **100% 3D load** , even when no graphics-intensive applications were open. Task Manager showed high GPU usage with no obvious culprit. Chrome was closed, RealView was off in SolidWorks, and idle processes were minimal.

After digging deeper:

- I checked the **Task Manager \> Details** tab and found a suspicious process named:  
`Microsoft Network Realtime lnspection Service.exe`  
_Note the subtle deception: **“lnspection”** with an **“L”** instead of an **“I”**._
- The file was located in:  
`C:\ProgramData\CABService\`
- I inspected the digital signature and found it was **“signed” by lolMiner** , a known cryptocurrency mining tool.
- It was also listed under **Windows Defender exclusions** (!), meaning it was deliberately excluded from scanning.

**Microsoft Defender** didn’t detect it due to the exclusion.  
I ran a set of reputable antivirus and anti-malware utilities\*\* to detect and remove the threat.  
detected:

- `Trojan:Win32/Kepavll!rfn`
- `PowerShell.DownLoader.2535`

🔧 **Cleanup**

1. **Removed Windows Defender exclusions** for:

```auto
 C:\ProgramData\CABService\
 powershell.exe

```

1. Terminated the rogue process from Task Manager
2. Deleted the entire folder:  
`C:\ProgramData\CABService\`
3. Manually removed malicious **Scheduled Task**  
`C:\Windows\System32\Tasks\Microsoft\Windows\Device Information\Device User`

**→ GPU usage returned to normal levels**

Engineering video cards are the target audience for such viruses.

 ![image](https://forum.cadmunity.com/uploads/default/original/2X/4/43b6225375c3fbaf26cfb7011a9fc38005a9e5bb.png)

---

<div class="post-metadata">

**Author:** ![doobes](https://forum.cadmunity.com/user_avatar/forum.cadmunity.com/doobes/32/125_2.png) [@doobes](https://forum.cadmunity.com/u/doobes)\
**Post date:** [July 23, 2025, 11:30am UTC](https://forum.cadmunity.com/t/gpu-stuck-at-100-found-trojan-win32-kepavll-rfn-disguised-as-windows-defender-service/5753/2 "2025-07-23T11:30:24Z")

</div>

Do you have any ideas where it came from?

---

<div class="post-metadata">

**Author:** ![mihkov](https://forum.cadmunity.com/user_avatar/forum.cadmunity.com/mihkov/32/135_2.png) [@mihkov](https://forum.cadmunity.com/u/mihkov)\
**Post date:** [July 24, 2025, 5:37am UTC](https://forum.cadmunity.com/t/gpu-stuck-at-100-found-trojan-win32-kepavll-rfn-disguised-as-windows-defender-service/5753/3 "2025-07-24T05:37:18Z")

</div>

The last thing I installed were free programs from official sites:  
**Captura**  
**LibreCAD**

I connected via VPN to one company and got into their network (work disk) to work with files. This is the most likely option, an engineering company is a fertile environment for breeding such an infection.

```auto
C:\ProgramData\CABService
C:\ProgramData\AKCService
C:\ProgramData\*Service

```

There is a [topic about this virus on the Microsoft forum](https://learn.microsoft.com/en-us/answers/questions/4343847/my-gpu-100-usage-by-ms-network-realtime-inspection), it may be in other places and disguised as other services.

---

<div class="post-metadata">

**Author:** ![pedja](https://forum.cadmunity.com/user_avatar/forum.cadmunity.com/pedja/32/151_2.png) [@pedja](https://forum.cadmunity.com/u/pedja)\
**Post date:** [July 24, 2025, 10:55am UTC](https://forum.cadmunity.com/t/gpu-stuck-at-100-found-trojan-win32-kepavll-rfn-disguised-as-windows-defender-service/5753/4 "2025-07-24T10:55:51Z")

</div>

Off-topic, but I generally recommend [Sysinternals Process Explorer](https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer)  
for ‘hunting’ things like that, if you want something more advanced then  
Task Manager.  
[Sysinternals suite tools](https://learn.microsoft.com/en-us/sysinternals/) and [Nirsoft launcher](https://launcher.nirsoft.net/)  
are pretty much essential on a Windows box, IMHO 🙂  
And you can use Nirsoft launcher to browse and launch tools from both,  
which is neat.