I think I have a Console Window Host virus and I am unsure how to fix it

[AdvancedSetup]

Great, thank you for the log. Overall it ran well and removed the files requested.

Are you still seeing the Alert or Block message or any other signs of infection?

 

Please run the following AV scanner

 

Please run the following ESET Online Scanner and perform a Full Scan

 

Click the following link to save the installer for ESET Online Scanner

https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

• It will start a download of "esetonlinescanner.exe"
• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get started. 
• When presented with the initial ESET screen, click on "Get Started". Read and accept the Terms of use
• On the "Before we start..." screen chose if you want to send anonymous data and if you want to provide feedback or not, then click Continue
• When prompted for scan type, Click on the Full Scan button
• Enable  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click the Start scan button.
• Have patience.  The entire process may take a few hours or more.
• When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
• Click The blue “Save scan log” to save the log and give it a name and location you remember.
• If something was removed and you know it is a false postive, you may click on the blue ”Restore cleaned files”  ( in blue, at the bottom).
• Press Continue when all done.  You should click to turn off the offer for “periodic scanning”.
• Enable "Delete application data on closing" - You do not need to submit feedback unless you want to. Simply ignore and close the program.

 

Note: If you do need to do a File Restore from ESET please follow the directions below

[KB2915] Restore files quarantined by the ESET Online Scanner version 3

https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner

 

Please attach the ESET scan log you saved at the end to your next reply

 

[IP1ayGam3]

Only sign of possible infection I can find is the MASSIVE amount of scvhosts that are running at once , I'll run what you sent now

[IP1ayGam3]

Scan Log.txt

[AdvancedSetup]

ESET found no issues @IP1ayGam3

The scan log found no issues.

Please click on START and type in CMD.EXE and when it shows on the menu, right-click and run as Administrator

Then copy and paste the following and press the Enter key. When done, post back the results

tasklist /svc /fi "imagename eq svchost.exe" 

 

Thanks

 

 

 

[IP1ayGam3]

Here are the results

 

[IP1ayGam3]

These are also popping up again...

[IP1ayGam3]

Only one belonged to my CMD.exe

[AdvancedSetup]

Nothing wrong in you svchost list

We need logs to show if there is an issue. Screenshots alone don't tell the story

 

Scan with SecurityCheck by glax24
https://forums.malwarebytes.com/topic/307301-scan-with-securitycheck-by-glax24/

Scan with FSS Farbar Service Scanner
https://forums.malwarebytes.com/topic/306736-scan-with-fss-farbar-service-scanner/

Scan with Farbar Recovery Scan Tool
https://forums.malwarebytes.com/topic/306601-scan-with-farbar-recovery-scan-tool/

Scan with Malwarebytes
https://forums.malwarebytes.com/topic/304827-scan-with-malwarebytes/

Scan with AdwCleaner
https://forums.malwarebytes.com/topic/304822-scan-with-adwcleaner/

 

 

 

 

 

[IP1ayGam3]

Sorry for being late I have been busy I will run these today do not worry. I am also going to say that I may have *****ed up, that or I am just making a uneducated guess. When I got home today my PC updated and when I looked at task manager this popped up and there are 2-4 randomly popping up and disapearing. I will run the scanner today, just thought I'd be transparent just so I don't keep any information that can ultimately help me get rid of possible malware

[AdvancedSetup]

Thanks for the update

[IP1ayGam3]

Addition.txt FRST.txt FSS.txt SecurityCheck.txt AdwCleaner[S03].txt Malwarebytes Scan Report 2024-07-16 192529.txt

[AdvancedSetup]

The Farbar log did not complete. Please RESTART the computer and make a NEW scan.

 

Scan with Farbar Recovery Scan Tool
https://forums.malwarebytes.com/topic/306601-scan-with-farbar-recovery-scan-tool/

 

[IP1ayGam3]

Addition.txtFRST.txt

[AdvancedSetup]

Please run the following fix

 

NOTE: Please read all of the information below before running this fix.

• NOTICE: This script was written specifically for this user, for use on this particular machine.
• Running this on another machine may cause damage to your operating system that cannot be undone.

Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program:   FRSTEnglish.exe

Save the attached file:  FIXLIST.TXT to this folder C:\Users\Micky\Downloads\

NOTE. It's important that both files, FRSTEnglish.exe, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

 

 

Run the Farbar program with Admin rights and press the Fix button just once and wait.

The fix may possibly take up to 60 minutes to complete

If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply.

 

1. NOTE:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity.
2. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed.
               Also, make sure you know the passwords for all websites as cookies may possibly be removed in some cases, but not all cases.
3. NOTE: As part of this fix, it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[IP1ayGam3]

Fixlog.txt

[AdvancedSetup]

Thank. The fix ran well.

Please RESTART the computer one more time. Then grab me the following

 

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to the Public desktop, please upload that file on your next reply

Thank you

 

[IP1ayGam3]

mbst-grab-results.zip

[AdvancedSetup]

Thank you for the logs

The logs indicate that you need to clean up your Opera browser cache, etc. There appears to be either some extension or java script or other unwanted object that is causing it to be blocked.

Personally I'd HIGHLY recommend uninstalling Opera and not using it. The Opera browser used to be a great alternative browser but today it simply does not care about your privacy at all.

I'd use Firefox or Brave as a much better recommendation. I would not allow Opera on any computer I manage, but the choice is yours.

 

OPERA: How to clean your browser and remove trackers
https://blogs.opera.com/tips-and-tricks/2023/04/clean-browser-and-remove-trackers/

 

Once you've cleaned the browser, please RESTART the computer and let me know if you're still getting any blocks or alerts from Malwarebytes or Windows Defender

 

[IP1ayGam3]

I'll download and try Brave since I've heard only good things

[IP1ayGam3]

Do you have a link?

[AdvancedSetup]

https://brave.com/download/

[IP1ayGam3]

I transferred over to brave and deleted opera and the cashe. I'm not going to restart my pc and see what happened cmd.exe wise

[IP1ayGam3]

YIkes

[AdvancedSetup]

There is nothing wrong or bad with Conhost.exe running unless it were a fake. The scans do not show any fake or Trojan entries for it.

 

This is from my own machine

 

https://learn.microsoft.com/en-us/windows/console/definitions

 

[IP1ayGam3]

Ahh mb, I guess I just panicked There is one cohost that runs 24/7 and is there from startup to shut down. Any ideas?