Two conhost.exe, one csrss.exe, one winlogon.exe, all (but one conhost.exe) have no location

[GiantBramble]

As I was looking through my Task Manager, I noticed something odd. There were two conhost.exe running. One of them didn't have a file location, description, or even a user name (well, SYSTEM, but not really). Showing all processes made it decide that it had a description. It was also using more memory. The one that was selected didn't reveal a location. Look at the first and second image ("Windows5", "Windows10"). TaskMan (not Task Manager) revealed that the one using less memory was in System32. The other one was in my user folder ("Windows11"), but when I looked, there was nothing new.

Showing all processes also made another csrss.exe appear, which was also using a lot more memory, but I don't think (keyword: think) that's an issue. As for the actual csrss.exe that was running, it didn't reveal a location either ("Windows6"). When showing all processes, both csrss.exe were were claiming to be running from the System32 folder, but so were the two conhost.exe.

The winlogon.exe didn't have a location, TaskMan was also claiming it was in my user folder. (Simple picture to help: "Windows8".) Showing all processes made it give a location.

(Picture to illustrate conhost.exe and csrss.exe: "Windows2", and a picture for winlogon.exe: "Windows4".)

Also, noticed that TaskMan was claiming there were two nvwmi64.exe running, while Task Manager claimed one, but showing all processes revealed another ("Windows3", "Windows7", "Windows12").

Don't worry about the picture naming scheme. The numbers were the order I took them in; nothing else. I left out 1 and 9 because they turned out to be irrelevant.

As a note, Kaspersky and Malwarebytes scans came back clean. My computer appears to be operating normally with no kind of slowdowns. The only problem is the mouse sometimes acting up, but this is the mouse's fault.

If this is Windows being rude, then sorry for wasting your time. But I don't really think it's the fault of Windows. I've read other posts where the processes didn't have a location, like now, and they actually found something. Help is appreciated.

FRST.txt

Addition.txt

[AdvancedSetup]

Actually not necessarily anything wrong based on that. Depending various factors the path in different programs may not be shown or may be locked from showing.

We can go ahead though and run some scan to ensure the system is clean.

 

We'll skip the first 3 steps and move on to the 4th step

Please go ahead and run through the following steps and post back the logs when ready.

STEP 04
Please download Junkware Removal Tool to your desktop.

• Shutdown your antivirus to avoid any conflicts.
• Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next reply message
• When completed make sure to re-enable your antivirus

STEP 05
Lets clean out any adware now: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista / Windows 7/8 users right-click and select Run As Administrator
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• When it's done you'll see: Pending: Please uncheck elements you don't want removed.
• Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
• Look over the log especially under Files/Folders for any program you want to save.
• If there's a program you may want to save, just uncheck it from AdwCleaner.
• If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
• If you're ready to clean it all up.....click the Clean button.
• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.
• Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
• To restore an item that has been deleted:
• Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

STEP 06
Download Sophos Free Virus Removal Tool and save it to your desktop.
 

• Double click the icon and select Run
• Click Next
• Select I accept the terms in this license agreement, then click Next twice
• Click Install
• Click Finish to launch the program
• Once the virus database has been updated click Start Scanning
• If any threats are found click Details, then View log file... (bottom left hand corner)
• Copy and paste the results in your reply
• Close the Notepad document, close the Threat Details screen, then click Start cleanup
• Click Exit to close the program
• If no threats were found please confirm that result....

 

STEP 07
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've run the tool before you'll need to place a check mark here.
• Please attach  the Additions.txt log to your reply as well.

 

Thanks

 

[GiantBramble]

Thanks for helping me on this. JRT and AdwC files are attached.

JRT was fine, AdwC was fine, and Sophos reported no infections.

And I've already run Farbar. If you want me to run it again, just say so.

JRT.txt

AdwCleaner[C1].txt

[AdvancedSetup]

Yes, please restart the computer and then run FRST again and place a check mark in the Additions check box and attach both new logs on your next reply.

Thanks

 

 

[GiantBramble]

Files attached now.

FRST.txt

Addition.txt

[AdvancedSetup]

Unless you're actively coding in this very old version of Java I would recommend that you uninstall it.

Java SE Development Kit 7 Update 55

Let's go ahead and run one more scanner just to make sure, but so far nothing really wrong found. Just a bit of paranoia is all :-)

 

Please visit this webpage and read the ComboFix User's Guide:

• Once you've read the article and are ready to use the program you can download it directly from the link below.
• Important! - Please make sure you save combofix to your desktop and do not run it from your browser
• Direct download link for: ComboFix.exe
• Please make sure you disable your security applications before running ComboFix.
• Once Combofix has completed it will produce and open a log file.  Please be patient as it can take some time to load.
• Please attach that log file to your next reply.
• If needed the file can be located here:  C:\combofix.txt
• NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.
  

 

 

 

[GiantBramble]

I uninstalled that Java thing and ComboFix is attached.

And apparently ComboFix temporarily (maybe permanently) fixed a BIOS issue I was having (because Dell). Neat.

(I don't expect you to show me some software that will fix it. I'll just deal with.)

ComboFix.txt

[AdvancedSetup]

You should uninstall this. No program should be installed and running from the TEMP folder. Temp if for temporary, ie, trash.

R3 cpuz138;cpuz138;c:\users\Parker\AppData\Local\Temp\cpuz138\cpuz138_x64.sys;c:\users\Parker\AppData\Local\Temp\cpuz138\cpuz138_x64.sys [x]
R3 cpuz139;cpuz139;c:\users\Parker\AppData\Local\Temp\cpuz139\cpuz139_x64.sys;c:\users\Parker\AppData\Local\Temp\cpuz139\cpuz139_x64.sys [x]

 

If you want to use it then extract the file from the zip to it's own folder and create a shortcut for it.

Aside from that I'm not really seeing anything out of the ordinary.

 

 

[GiantBramble]

I was only able to see cpuz139, not cpuz138. I deleted it. (The picture doesn't show that, but I did it.)

If that's a problem, then tell me what next. Otherwise, thanks for your time.

[AdvancedSetup]

The current logs are not showing anything at this time that I can see as an issue so unless you have a specific issue we should be done here.

 

[GiantBramble]

Thanks for your time. You definitely relieved my paranoia.

[Some kind of thumbs-up emoji to express gratitude]

[AdvancedSetup]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!