Multiple Conhost.exe Tasks - Potential Malware Concerns

Question

I hope you can help me with an issue I’m experiencing on my Windows computer. I’ve noticed that there are over 11 instances of Console Window Host (conhost.exe) running in Task Manager, and it’s raising some red flags for me.

I have a reasonable suspicion that my system might be compromised, possibly with a cryptocurrency miner (like Bitcoin or XMR). I’m particularly concerned because I see multiple tasks running under NT AUTHORITY\SYSTEM privileges and they appear to be linked to my user account (User/Alex).

Here’s the backstory: recently, while using a public library computer, I stepped away for just a moment. When I returned, my computer was at the BIOS screen, which seemed very unusual. This has led me to believe that someone might have accessed my machine and installed something malicious.

I’ve done quite a bit of searching online and the results point towards possible malware or a trojan, but I’m not sure how to proceed with diagnosing or removing any potential threats.

If anyone has advice or suggestions on how to handle this situation, I would greatly appreciate it. I can provide screenshots for reference as well.

I have ran Rkill, Eset(which never ended up scanning or updating), Process Killer, Malwarebytes, Norton Security, god im running out of options, But I seriously need help..

I finished Mandalorian and thought jack black was a funny character in the tv show so i decided to include him as well.

I'll check in tomorrow morning and see what's going on as far as updates. I cant seem to figure out what is running the background executables and I seriously need help

https://pastebin.com/rAYRxuDj - Hitman Loghttps://pastebin.com/datpCS1M - RKill Log

![](https://learn-attachment.microsoft.com/api/attachments/f673c152-a491-4380-a495-ce8c5edfce48?platform=QnA"https://learn-attachment.microsoft.com/api/attachments/4777d76e-95c3-4db2-bc8c-ae1b0642e40a?platform=QnA" title="filestore.community.support.microsoft.com" rel="ugc nofollow">

Answer 1

hi sir i have 4 instances of conhost open im asking if its something that should concern me or not

Answer 2

AlexanderNicols1, in response to your suggestion, see my screenshot from VirusTotal.

Good morning, as I have read both comments and also ran the Farbar Scanner here are both Txt file logs In Pastebin Version-

PLEASE READ THIS FIRST! - https://github.com/SilentCryptoMiner/SilentCryptoMiner 

I have read a lot in regards to this topic - I know this is a miner that's running in background and coud be using SVSHOST

Answer 3

How do we trust you to be legit with these steps your wrote below, and share OneDrive files with non-Microsoft tech support?

1. Download Farbar Recovery Scan Tool 64-bit (FRST64.exe)

Note: If Microsoft Edge or Chrome mislabels the Farbar Scanner executable as PUA/malware, choose to keep it by tapping … in the bottom bar, choosing Keep, and then choosing Keep anyway in the dialog that appears

Answer 4

There's no malware present. If you check the properties of each Conhost instance and look at the parent process, do they say SteelSeriesSonar.exe?

If you have or install Windows Powershell 7, open an admin instance and run:

Get-Process conhost | Select Id, @{l='Parent';e={$_.Parent.Path}}

Answer 5

Good morning, as I have read both comments and also ran the Farbar Scanner here are both Txt file logs In Pastebin Version-

PLEASE READ THIS FIRST! - https://github.com/SilentCryptoMiner/SilentCryptoMiner 

I have read a lot in regards to this topic - I know this is a miner that's running in background and coud be using SVSHOST

https://pastebin.com/B6pM1tGx -FIRST LOGhttps://pastebin.com/YQhX1HQ4 - Addition LOG Now the only reason why I'm actually using and have to use the SteelseriesGG program is because by default the laptop that I have which is a MSI Raider 18 HX A14V's built in Steel series keyboard and if I don't run or utilize the program then all of the RGB lights start flashing and I love the feature but it distracts me when im using the computer to focus and do other things.. Now hear me out im no hater to RGB or even light keyboards but I'd rather save the life of the Lights and the LED bulbs for when I really want to feel like a POG Champ.

If I need to disable the "Sonar" feature I will more than welcome do that

I will keep my eye on this post because I need to see if this is spyware, malware miner or I have no idea as of right now.

I only notice that when task manager is minimized and the computer is at idle that cpu/gpu/ram start to increase and fans start to go off 3500+ rpm's and that's on idle.

I have to also avoid using anything Cloud or bluetooth when it comes to the computer or my phone because I was a victim of identity theft and fraud. When I was buying this new laptop someone broke into my hotel room and uploaded a crapload of trojans, malware, spyware, bootsector virus and a bunch more. I have reformatted the hard drives, installed new Os and made sure with someone who i personally know to help me recover both laptops with bootable usb drives and to manually do everything. but that's not what this post is in regards to but could possibly still be the last line of Garbage on the laptop. not to get technical but a lot of bs has happened to me in the past couple of months.

I also notice that 15 gigs are always being in use, but cant see or find where this Ram is being utilized.