conhost.exe malware

[timbo343]

Just to let eveyone know that we have just been hit with conhost.exe and sophos didn't detect it.

 

It basically installs into a machine and then anyone who logs into the infected machine, their profile gets hit.

[AyatollahPies]

What did detect it?

[timbo343]

In the end we had to use ccleaner and Malwarebytes. We discovered it by uses not been able to use the internet as it sets the proxy address of the machine to 127.0.0.1 and a random port. Fortunately we had about 10 members of staff affected and about 6 machines... not too bad, could have been a lot worse but had to re-create profiles. Also, conhost was starting up at machine startup so had to disable it here too.

[ZeroHour]

Have you submitted it to sophos, MSE and clamav (who submit to others)?

I have submitted 3 bits of crud in recent days to all 3 so if you want details I can pass them on.

[timbo343]

Have you submitted it to sophos, MSE and clamav (who submit to others)?

I have submitted 3 bits of crud in recent days to all 3 so if you want details I can pass them on.

Zerohour, if you could please.

Im surprised it didnt detect it

[ZeroHour]

Microsofts various AV: https://www.microsoft.com/security/portal/Submission/Submit.aspx

Sophos: https://secure.sophos.com/support/samples/

ClamAV: Clam AntiVirus

[SYNACK]

Symantec: https://submit.symantec.com/websubmit/retail.cgi

Eset NOD32: How to submit virus or potential false positive samples to ESET's labs - ESET Knowledgebase

Kaspersky: How to report undetected viruses or false positives to the viruslab - Kaspersky Lab Forum

[rvdmast]

be carefull, conhost.exe is also a legitimate windows process in windows 7, it handles drag & drop for console windows.

What is conhost.exe and Why Is It Running? - How-To Geek