kernel_task on Macbook hogging CPU even after OS upgrades/downgrades; possible Flash malware?

Question

On a Macbook Air (13-inch, Early 2015) my girlfriend got one of those "upgrade Flash" pop-ups and hit (Continue/Okay/etc?). This may or may not have anything to do with the current problem but ever since, the kernel_task has been hogging the CPU to the point at which the computer is so slow as to be unusable. In Activity Monitor, the % CPU of kernel_task is is a constant 220-450. The CPU load is a constant 75%-90%, although the computer is not getting hot.

Here is what I have done so far. I've reset the SMC and NVRAM/PRAM multiple times. I upgraded to the newest OS, Catalina. I downgraded to the original OS for this laptop, El Capitan. I upgraded and downgraded more than once and each time, the issue remains. The installation of the OSes took forever, as well; been working on this problem for 4 or 5 days now. Oh, and booting in safe mode doesn't help, either. Anyway, two questions:

1) Is it possible for a Flash malware thing to install/configure something in the kernel that remains after re-installing the OS?

2) Any ideas on how to fix this?

Answer 1

When a system is infected with malware, the best course of action is format the drive and restore known-good backup from before the malware infection.

If you just reinstall the operating system on top of your infected system, while keeping all your own files on your drive, you're in high risk of keeping the malware - and/or simply reinfecting the system quickly after the upgrade.

In theory malware could change the firmware of the SMC or something like that, to persist even when the drive is formatted - but in practice Flash malware is very unlikely to do so.

However, I'm not entirely convinced that your problem with kernel_task is related to the malware. I would suggest rebooting your computer into "Recovery mode" by holding the Command and R buttons during boot. When in "Recovery Mode", open the Terminal and run the command:

top -ocpu

This should show a live updating overview of the currently running processes, sorted with the most CPU using process at the top.

If you still have kernel_task at the top spot with a large percentage, the problem is most likely unrelated to the malware, and could instead indicate a hardware problem regarding cooling. This could be a problem with a fan not operating properly, cooling paste, or even a sensor issue.