Search the Community
Showing results for tags 'conhost.exe'.
Hi This is my first post here and I'll try to follow the guidelines. I have a problem with a process names svchst.exe using all my CPU. Several instances can occur. If i kill the process it will respawn after a while. The description is Windows Spyware Service. Checking with Process Explorer the svchst.exe process parent is a cmd.exe which is unsigned. The same cmd.exe is also parent to a conhost.exe, also unsigned. I cant see the filepath to any of the files. Checking the properties->TCP/IP tab on svchst.exe it shows there is a connection: TCP MYIP:52361
As I was looking through my Task Manager, I noticed something odd. There were two conhost.exe running. One of them didn't have a file location, description, or even a user name (well, SYSTEM, but not really). Showing all processes made it decide that it had a description. It was also using more memory. The one that was selected didn't reveal a location. Look at the first and second image ("Windows5", "Windows10"). TaskMan (not Task Manager) revealed that the one using less memory was in System32. The other one was in my user folder ("Windows11"), but when I looked, there was nothing new.
This computer has proven to be very difficult to clean. Now after throwing a bunch of tools at it, it seems to scan clean. However, there are processes being spawned that make me nervous. As it is running, there are multiple conhost.exe, cmd.exe and reg.exe processes spawned. if I let it run long enough, they take 100% processor and the system becomes unuseable. I wrote a looping batch file to taskkill the reg.exe task and that makes it possible to do some diagnostics. Please help! I have run the following tools: rkill adwcleaner Malwarebytes Rootkit Scanner Malwarebytes Norton Power Er