• Avira: TR/Kazy.2030.3
• Microsoft: Backdoor:Win32/Cycbot.B

What is conhost.exe?

Conhost.exe was discovered by Norton in the year 2010. Conhost.exe virus is a lot similar to dwm.exe that launches itself along with the system processes like crss.exe or works as an individual process called distnoted.exe or nvvsvc.exe. Conhost.exe runs on Windows 7, Windows XP and almost all the operating systems of Microsoft. Conhost saves its executable file in the %HOME%\Application Data\Microsoft directory. From this directory, Conhost executes itself and performs malicious activity that harms the computer.

How did conhost virus enter my system?

Conhost.exe virus Due to the advanced security features launched in Windows 7, the usual spyware weren't able to run on it. Being a Trojan, conhost.exe enters Windows 7 comfortably without any problem. It was designed in such a way that, the security of Windows 7 couldn't stand a chance against the conhost virus. However, the execution of Conhost.exe in Windows 7 is very simple since the conhost virus doesn't target the System 32 folder. Instead, it resides in a folder that is commonly found in any Windows operating system.

What does conhost.exe do to my system?

conhost is a virus cum Trojan that targets the Registry immediately after its first execution. This way, conhost.exe process is launched and during the runtime of this process, the virus conhost.exe also connects to a remote server from which the system can even be controlled. This makes your system vulnerable. Malicious files are downloaded by the Trojan at every startup. This way, the conhost process eats up the memory thus making your computer very slow. Remove conhost.exe process if you find it, just to keep your computer safe(temporarily).

Are you getting an conhost.exe error?

conhost.exe error might popup if you had tried to remove the virus earlier. The main key to removing this conhost.exe virus is in the registry. Even if you had deleted the actual file, conhost errors might crop up saying that one of the files are missing. So please go through the instructions properly to avoid such errors. Follow the instructions given below for conhost.exe removal.

How to remove Conhost.exe?

1. Boot your computer in the Safe Mode. Click here if you're finding trouble doing that.
2. Go to Start --> Run and type regedit to open the Registry Editor. Here, you'll have to delete or modify a few entries to get your system back to its original form.
   
   Go to
   
   

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

   
   Delete the following registry key on your right side
   
• "conhost"="%HOME%\Application Data\Microsoft\conhost.exe"

   Now navigate to the following locations and change the keys as per the specified values
   
   

   HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

   
• "MigrateProxy"=dword:1
• "ProxyEnable"=dword:0
• "ProxyServer"="http=127.0.0.1:58970"(Delete this key)
• "ProxyOverride"=-(Delete this key)
• "AutoConfigURL"=-(Delete this key)
   
   

   HKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings

   
• "ProxyEnable"=dword:0
3. We're almost done. Restart your computer once again in the Safe Mode. Go to the directory %HOME%\Application Data\Microsoft\ and delete the files conhost.exe and dwm.exe. You might not find it directly, so enabling the hidden files and folders option may come in handy here.
4. Now its time to delete multiple files downloaded or created by the conhost virus. For that, you'll need to go to Start --> Run and type %temp% where you'll find several files lined up. All of these files just waste your space anyway. So delete all of them just to be sure that there is no possibility of the virus getting restored.
5. Restart your system and observe the changes. You'll see that your system is free from the multiple conhost viruses.

Posts that might help you here:
Enabling Safe Mode booting, Enabling the Registry , Enable Hidden files and folders option and Enabling the Command Prompt.

Finding this process difficult? Get these anti-viruses to delete the virus:

BitDefender AntiVirus Pro 2011