Advice Request Spyshelter premium lots of conhost.exe in the log file

[patrick85]

Hello, I'm using spyshelter premium version 12.7. I'm also using Avast premium and other security tools on my system. I noticed lots of actions logged in spyshelter for conhost.exe process. This process is excluded from the system protection of spyshelter by default - more specifically it is allowed in rules for "modifying memory of other processes" option and for the rest of the options it is set to default. I see more than 100 allows for conhost.exe by spyshelter in a single day. Is this normal behaviour or should I be suspicious of some malware/rootkit/keylogger or other malicious software on my system? Attaching shelter-log.txt. Thank you.

 

[Venustus]

Hello, I'm using spyshelter premium version 12.7. I'm also using Avast premium and other security tools on my system. I noticed lots of actions logged in spyshelter for conhost.exe process. This process is excluded from the system protection of spyshelter by default - more specifically it is allowed in rules for "modifying memory of other processes" option and for the rest of the options it is set to default. I see more than 100 allows for conhost.exe by spyshelter in a single day. Is this normal behaviour or should I be suspicious of some malware/rootkit/keylogger or other malicious software on my system? Attaching shelter-log.txt. Thank you.

It's pretty normal to have multiple conhost.exe instances...If they are in system32 then I would say it's pretty safe.You could run a scan just to be sure with Malwarebytes.

Sysinternals Process Explorer is also a great tool and helps identify what's running and the threads within.

Process Explorer - Sysinternals

Find out what files, registry keys and other objects processes have open, which DLLs they have loaded, and more.

docs.microsoft.com