Conhost and PresentationHost Malware/Virus

Discussion in 'Malware Help (A Specialist Will Reply)' started by sushirom, Oct 4, 2015.

Thread Status:
Not open for further replies.
  1. sushirom

    sushirom Private E-2

    Hey, was recently having some issues with a infinitely replicating Conhost issue. Did some research then and heard it can be due to just a bug of something else. After some simple cleanup it went away. But today I had a PresentationHost.exe pop up that had a skyrocketing memory usage. I found a thread on this forum where someone got a similar/same problem fixed. I've been following along with it but found some posts that mention fix texts made specifically for them. So I'm opening a thread to see if I can get this fixed. Here's the closed thread I've been referencing.

    http://forums.majorgeeks.com/showthread.php?t=293259

    The HitmanPro Log might show a time after the combo fix log. On the first run I didn't realize you had to manually save its log, so I ran it again afterwards.
     

    Attached Files:

    sushirom, Oct 4, 2015
    #1
  2. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    dr.moriarty, Oct 4, 2015
    #2
  3. sushirom

    sushirom Private E-2

    Okay I've completed the Read&Run. I'd like to mention that some of the issues have already disappeared or gone into hiding. The replicating conhost's have stopped. The PresentationHost has disappeared and stopped running. And another two things that I forgot to mention earlier. When you restart/shutdown your computer, it closest everything down. Windows, programs, explorer.exe goes down. All your icons disappear. When that would happen when I restarted, there would be pop-up windows hidden behind everything. Just the stupid internet browser kind of ads. Just covering up the screen as it was shutting down. That hasn't shown on the last couple restarts. And in the begining, something kept trying to run command prompts (cmd.exe) on its own. That has stopped. I was wary to turn of UAV earlier because it was blocking it. Anyways, here are the log files.
     

    Attached Files:

    sushirom, Oct 4, 2015
    #3
  4. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    My apologies for the delay in replying sushirom, dealing with family issues at the moment.

    Your logs are clear of malware.

    NOTES: I hope that you're using the tools you had already ran before posting here under proper supervision, as they are very powerful.
    You have less than 12% free space remaining on your operating system drive letter "C:\"
    Finally, you need to clear out alot of temporary files by usng a cleaner such as Old Timer's TFC.

    _____________________________

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase it, it provide no protection. It do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 of the READ ME and re-enable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If running Vista, Win 7/8 - it is time to make sure you have re-enabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Go to add/remove programs and uninstall HijackThis.
    7. Go to the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    8. If you are running Win 7/8, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work through the below link:
    Safe surfing! http://i268.photobucket.com/albums/jj5/drmoriarty/Emoticons/char145.gif
     
    Last edited: Oct 12, 2015
    dr.moriarty, Oct 12, 2015
    #4
Thread Status:
Not open for further replies.

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds