Multiple Conhost.exe Tasks - Potential Malware Concerns

Windows PowerShell Copyright (C) Microsoft Corporation. All rights reserved. Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows PS C:\Users\Alex> Get-Process conhost | Select Id, @{l='Parent';e={$_.Parent.Path}}

Id Parent -- ------

8516

8556

8688

8880

9124

9360

9504

9612

10300

21052

24992

31124

32880

PS C:\Users\Alex>

give me a moment to look and find out

I took the time to prt scrn the parent id's 1 by 1 and we'll go through them one by one:

wlan.exe (must be the vpn wlan I have configured through DDG browser vpn) wlanext.exe Windows Wireless LAN KEWL BEANS

NVidia (Good)

Gotta be the Razer Basilik Mouse Device I have

Razer App Manager (looking gewd)

Razer Diagnostics (supra ultra gewd)

Razer Synapse (totally gewd)

Razer Device manager (looks gewd)

Razer Smart Light (looking gewwd)

KAPSService.exe (Looking into this one) killer analytics service

Msi bloatware (Looks Good)

SteelSeriesSonar(Good)

So as I see it's just mostly Razer Bloatware and some other functions. How were you able to tell and come to the conclusion from looking at the

First + Additon logs files to determine if there were any Malware or if there's any trojans? Also I'm curious to know because im learning and getting more into OS and other functionalities as far as computers, does a computer usually need and require so much RAM even at IDLE? I'm trying to see and figure out why maybe a article or if you can point me into a direction that can initially explain for the High RAM usage as far as the computer being at idle.

This post has been solved! If it's of use to anyone else Partition Reader is an amazing tool to use to check PID and task's from Task Manager!

I would Like to thank both _AW_ + Ramesh Srinivason for taking the time to read, take their time and also to pin point the issues in regards to double triple quadruple checking to see if any Malware/Trojans were on the gigga chad laptop! Thank you guys again

you guys are the bomb! Here's a Tribute!

That's Powershell 5 output. To get the parent in Powershell 5, run:

$obj = Get-Process conhost | % {
    $ppid = (Get-CimInstance CIM_Process | ? ProcessId -eq $_.id).ParentProcessId
    [PSCustomObject]@{
        Id = $_.Id
        ParentId = $ppid
        ParentPath = ((Get-Process | ? Id -eq $ppid).Path)
    }
}
$obj | ft -auto

Thank you for your help and your fast responses. 👍

Hi Alexander, This is Ramesh.

The system might be infected by miners. To verify that, please run the Farbar Scanner and share your logs on OneDrive.

1. Download Farbar Recovery Scan Tool 64-bit (FRST64.exe)

https://www.bleepingcomputer.com/download/farba...

Note: If Microsoft Edge or Chrome mislabels the Farbar Scanner executable as PUA/malware, choose to keep it by tapping … in the bottom bar, choosing Keep, and then choosing Keep anyway in the dialog that appears. See this screenshot: https://learn.microsoft.com/en-us/deployedge/me...

2. If the OS language is non-English, rename FRST64.exe to FRST64English.exe.
3. Run the program. Don't check or uncheck any options. Click "Scan".
4. Zip the two logs, FRST.txt and Addition.txt, upload them to your OneDrive and share the link here.

How-To: Share OneDrive files and folders - Microsoft Support

https://support.microsoft.com/en-us/office/shar...

OneDrive sharing options - screenshot

https://imgur.com/a/vZyxpY9

Standard Disclaimer: There is a link to a non-Microsoft website. The page appears to provide accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as PUPs (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.

Do you know what steelseriessonar.exe is?

To thoroughly check for malware, please run a scan with Farbar Recovery Scan Tool (FRST) and share your logs.

https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

Note: If you are using Edge, SmartScreen may initially block the download.

Click on the three dots next to the warning and select Keep => Show more => Keep anyway.

• If your computer's language is not English, rename FRST64.exe to FRST64English.exe
• Run the tool, leave the default settings, and press Scan.
• Zip the logs, FRST.txt and Addition.txt, then upload to a cloud storage service like OneDrive or Google Drive.
• Post the share link.

Share OneDrive files and folders - Microsoft Support