2

enter image description hereI currently have 2 csrss.exe running under system, using 1700kb - 2156kb memory each. Related to them there seems to be 2 conhost.exes, one using roughly 1000kb ram and 1400kb. One is SYSTEM and one is NETWORK. I found 2 csrss.exes in my system, one In system32, one in winsxs/amd64_microsoft (with a large amount of numbers) I found 1 conhost in system32, and 8 conhosts in winsxs/amd64_microsoft followed by numbers Like csrss. Is this normal? I also may have seen a third conhost running, but I dont think it was attached to csrss

using event viewer logs and process explorer I found the 2 conhost files under csrss, were launched (in my test) at 15:33:52. At the same time, in event viewer under system, the MBAMservice entered a running state. Also, the server service entered a running state. Other services that started around a second or two after: Network list service Diagnostic service host Human interface device access Micrsoft network inspection Diagnostic system host Portable device enumerator Computer browser service There was no entry in the application part of event viewer. Under security, at 15:33:52 there was an entry for:

Audit sucess: An account has succesfully logged on. Subject ID: null sid (Further down on the same entry)

New logon: Security id: anonymous logon Account name: anonymous logon Account domain: nt authority

And theres several more sections of that entry. Is this bad? I have found several of those anonymous logon entries back as far as the day I got my pc a year ago, so I don't think its bad. Another pc in the house has the same amount of conhost and csrss.exe files on the hdd (around 8-9, in amd64 install folders, and the one that runs under system32, and the csrss files. The other pc had 2 csrss processes running but no conhost. ) Does it look bad or okay? Im going to run some safemode scans. (Mbam and mse). The scans have come clean.

here is an image of when I run Geforce experience, this conhost appears and shutsdown very quickly. enter image description here

  • I also have 2 csrss.exe. Run ProcessExplorer (as admin), select that the commandline is shown and post a picture so that I can see the commandline of the conhost and csrss.exe processes. – magicandre1981 Jul 30 '14 at 17:58
  • What exactly is the question. What makes you think these processes are malicious ( they likely are not ) – Ramhound Jul 30 '14 at 18:19
  • Well at one stage I saw a conhost process appear but it didnt seem to be attached to csrss. My guess was that it was nvidia geforce experience as it seems when I run it a conhost process appears briefly without being attached to csrss (but its not attached to geforce either, yet it only comes up when I run it). – Keyes Jul 30 '14 at 18:29
  • @magicandre1981 I will do so 10 minutes. – Keyes Jul 30 '14 at 18:31
  • @magicandre1981 I need 10 reputation to add the image, but I only have 6. Will I do? I have 11 on the Information Security stackexchange so I could post it there.? – Keyes Jul 30 '14 at 19:26
4

Any time you see ConHost.exe it means that a non-GUI program is being executed. This happens when you open the Command Prompt or when an application installer needs to run a standard "DOS" command as part of the installation routine. It's very normal to have the ConHost.exe process come and go, and should only be cause for concern if you have many (20-30+) instances for more than a few moments. Further, it's quite proper that you would observe program and service start/stop activity in connection with ConHost.exe processes starting and stopping, as it is at these times in a program's lifecycle that they'll often need to interact with a non-GUI application.

If you wish to dig in more deeply, the article http://blogs.technet.com/b/askperf/archive/2009/10/05/windows-7-windows-server-2008-r2-console-host.aspx explains the new addition (as of Windows 7) that is ConHost.exe and the problem it is meant to solve::

In previous versions of Windows [that is, prior to Windows 7], all GUI activity on behalf of non-GUI applications that ran on the desktop (console applications) was brokered by the system process CSRSS.exe.

If you know much about how Windows handles separation of privilege between users, you might correctly see a potential weakness, confirm as the article continues:

The problem with this was that even if an application ran in the context of a regular user’s account, CSRSS.EXE runs under the Local System account. So it was possible under certain circumstances for malware to exploit weaknesses in an application in order to execute code under the more privileged Local System account in CSRSS.EXE.

Windows 7 permanently changed that model by introducing the ConHost.exe process:

This exposure was addressed in Windows 7 and Windows Server 2008 R2 by running the console messaging code in the context of a new process, ConHost.exe. ConHost (Console Host) runs in the same security context as its associated console application. Instead of issuing an LPC request to CSRSS for message-handling, the request goes to ConHost.

Hope that helps!

EDIT:

Two instances of csrss.exe is not abnormal. I've observed this plenty of times on known-clean computers. If you don't have two instances running, simply start CMD.EXE and you'll likely end up with a second instance of csrss.exe hosting a child instance of conhost.exe.

In your case I don't see any evidence of their being a malicious reason for the second instance of csrss.exe or the multiple instances of conhost.exe.

  • So in my case, is it malicious? On the tomshardware forum I was told it was a straight up "virus trojan." (The guy had a terrible source so I came here since people know what they're talking about). How can I go about finding what service associates with the conhost? When I use the go to services on task manager I cant find anything – Keyes Jul 31 '14 at 0:05
  • The most useful way I've found to find the process (or service) associated with an instance of ConHost.exe is to sort by the Start Time column in Process Explorer and see what other process started at the same time ConHost.exe did. I don't see any reason to suspect this a malicious in your case. I've edited my answer accordingly. – Twisty Impersonator Aug 5 '14 at 17:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.