conhost.exe over working cpu to 100% ??

[kevh]

Hi everyone (HNY !! )

 

Home PC is getting a little old but generally works pretty well until recently , usually when more than one user logged in the CPU shoots up to 100% fan goes to hyperspeed and system slows to a snails pace.

 

Task manager give the crazy repeating of conhost.exe .

 

Could anyone explain this or is it pc on its way out ?? Or does my kids Minecraft addiction have any thing to do with it ?? :)

 

Hoping to make Pc last till Win10 release if possible :)

 

Cheers Kev :cool:

 

 

[ATTACH=CONFIG]1371.vB5-legacyid=2436[/ATTACH]

[Plastic Nev]

Hi Kev, sorry no one seems to have replied, possibly like me and have no clue. However for a process to be doing that it is alarming, have you thought about the fact it might be malware causing it?

Even if your own antivirus or anti malware scans show nothing untoward, it might be an idea to follow instructions and post some logs for our malware guys to check out in the malware removal section.

 

Nev.

[Starbuck]

However for a process to be doing that it is alarming, have you thought about the fact it might be malware causing it?

That amount of conhost.exe running is alarming.

There is malware that will create these entries..... so take Nev's advice and post the reports asked for here;

http://extremetechsupport.com/threads/15547-Before-posting-for-Malware-Removal-help-WinXP-Vista-Win7-Win8-amp-Win8-1#.VLAaBHtCe00

 

Best to be safe, rather than sorry.

[kevh]

Malwarebytes Anti-Malware

www.malwarebytes.org

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 09/01/2015

Scan Time: 20:48:24

Logfile:

Administrator: Yes

Version: 2.00.4.1028

Malware Database: v2015.01.09.16

Rootkit Database: v2015.01.07.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x86

File System: NTFS

User: Kev

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 586770

Time Elapsed: 1 hr, 3 min, 44 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 7

PUP.Optional.MySearchDial.A, HKU\S-1-5-21-2972498859-915069817-1915145066-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}, , [de869f568efb46f02eab63812fd3817f],

PUP.Optional.DigitalSites.A, HKU\S-1-5-21-2972498859-915069817-1915145066-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DSiteProducts, , [bba9d0256d1c4ee861c177758b7953ad],

PUP.Optional.MySearchDial.A, HKU\S-1-5-21-2972498859-915069817-1915145066-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\mysearchdial, , [0460d81d3c4da2945bfc05bf798b31cf],

PUP.Optional.MySearchDial.A, HKU\S-1-5-21-2972498859-915069817-1915145066-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\mysearchdial.com, , [ef7533c20b7ea98dc593a22249bbbb45],

PUP.Optional.InstallCore.A, HKU\S-1-5-21-2972498859-915069817-1915145066-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, , [7ce847ae7b0e0b2b61e45657c73c29d7],

PUP.Optional.MySearchDial.A, HKU\S-1-5-21-2972498859-915069817-1915145066-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\mysearchdial, , [4024e312e0a9e353d72cc9ff32d2d729],

PUP.Optional.InstallCore.A, HKU\S-1-5-21-2972498859-915069817-1915145066-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, , [85dfe80dfa8fb77f5605c300ec184ab6],

Registry Values: 2

PUP.Optional.InstallCore.A, HKU\S-1-5-21-2972498859-915069817-1915145066-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0A2O0R1R1H2Z1S1G0H1F, , [85dfe80dfa8fb77f5605c300ec184ab6]

PUP.Optional.MySearchDial.A, HKU\S-1-5-21-2972498859-915069817-1915145066-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Mysearchdial, , [bca8c134098038fe890cafda9073d42c]

Registry Data: 0

(No malicious items detected)

Folders: 1

PUP.Optional.Updater.A, C:\Users\Tracey\AppData\Roaming\DigitalSites\UpdateProc, , [4e1643b209803006f16096b940c3ab55],

Files: 6

PUP.Optional.JumpyApps.A, C:\Users\Tracey\AppData\Local\Temp\ICReinstall_ZipOpenerSetup.exe, , [abb9ee076e1b290d35dac1375ca8a25e],

PUP.Optional.MySpeedDial.A, C:\Users\Tracey\AppData\Local\Temp\is357113909\11200693_stp\Mysearchdial.exe, , [6afa52a37514a78f758e5be825e08080],

PUP.Optional.Updater.A, C:\Users\Tracey\AppData\Roaming\DigitalSites\UpdateProc\config.dat, , [4e1643b209803006f16096b940c3ab55],

PUP.Optional.Updater.A, C:\Users\Tracey\AppData\Roaming\DigitalSites\UpdateProc\prod.dat, , [4e1643b209803006f16096b940c3ab55],

PUP.Optional.Updater.A, C:\Users\Tracey\AppData\Roaming\DigitalSites\UpdateProc\STTL.DAT, , [4e1643b209803006f16096b940c3ab55],

PUP.Optional.Updater.A, C:\Users\Tracey\AppData\Roaming\DigitalSites\UpdateProc\TTL.DAT, , [4e1643b209803006f16096b940c3ab55],

Physical Sectors: 0

(No malicious items detected)

(end)

[Starbuck]

Hi Kev,

 

I've split the rest of the reports away and created a new thread here:

http://extremetechsupport.com/threads/16649-Multiple-Conhost-exe-entries?p=110346#post110346

 

Please reply to the new thread from now on.

 

I will close this thread to avoid any confusion.

 

Thanks