Share via

Suspicious Conhost.exe

Anonymous
2021-09-18T01:48:24+00:00

Hello Everyone.

I was looking into process explorer when I found a new instance of conhost.exe that has no parent and runs with SYSTEM permissions.

I inspect my PC with Process explorer every now and then and I had never seen a solo instance of conhost let alone one with no parent.

As far as I can tell it does not do anything but I am afraid that it could be a Remote Access Tool in disguise.

I have a minidump of this process but I do not know how to attach it to this message.

Neither Windows Defender nor MBAM detect this as malware.

I was wondering if any specialists could explain why this solo process would be running, stopping and killing the process does not affect the system in any way I can tell. Description of the process in itself does not show anything remarkable.

I hope anyone can help me with this issue, thank you in advance for your assistance.

Best Regards - Kenny.

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

7 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. bhringer-9380 4,350 Reputation points Volunteer Moderator
    2021-09-18T02:52:00+00:00

    Click Options tab in Process Explorer and select VirusTotal.com > Check VirusTotal.com for analyses.

    ~bhringer

    Was this answer helpful?

    8 people found this answer helpful.
    0 comments
  2. _AW_ 67,256 Reputation points Volunteer Moderator
    2021-09-25T23:15:11+00:00

    That SafeBoot\AlternateShell entry is needed for the rare occasion that you may want to boot Safe Mode with Command Prompt.

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  3. Anonymous
    2021-09-19T02:23:38+00:00

    Hi.

    VirusTotal says it is fine.

    However the problem is that this is a working process with no parent.

    No idea what spawned it or what is it doing.

    I normally look into my pc for anomalies and I had never seen a lone conhost.exe without a parent. Especially because it is not spawned along other processes.

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  4. Anonymous
    2021-09-25T19:44:28+00:00

    Antimalware finds nothing so perhaps it is an initial process for a service that it is not well configured.

    Gonna check out those other forums.

    Thank you for your reply bhringer.

    Best Regards - Kenny

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  5. bhringer-9380 4,350 Reputation points Volunteer Moderator
    2021-09-21T13:18:25+00:00

    Hi Kenny,

    Apologies for late response. Have been looking at a couple of my own machines for comparison. I don't have any idea either why you have an instance of conhost.exe without a parent. I only have a single conhost.exe running under laptop touch-pad driver and it seems well behaved.

    Image

    There's always a possibility of it being associated with something malicious, but If it's residing in Windows/System32, not consuming resources and VT results are clean I wouldn't consider it suspect.

    Here's a related thread in this community that may be helpful https://answers.microsoft.com/en-us/protect/forum/all/what-is-conhostexe/38a69fb8-ded2-4f35-85c5-4d69cb8d016b

    Your question is somewhat outside the technical scope of this community and might be better addressed in another forum (possibly Bleeepingcomputer.com) or the following Microsoft Q&A resource: https://docs.microsoft.com/en-us/answers/products/

    Sorry I couldn't be more helpful.

    ~bhringer

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments