you see if you remove the conhost.exe
you essentially cant run command prompts...
i will do a network log on a idle machine running 6956 and another 6801 and see...
btw i have MS network monitor if you want to try it too [so far so good with this app]
i will check with you guys latter about this and compare notes....
I read somewhere, that conhost.exe hosting cmd's window. It's something like an emulator.
Win32:Sober-A
is an email worm written in Visual Basic and packed with the modified version of UPX packer. The infected message could contain one of many different subject lines either in English or German language.
Some of the messages pretend to be the an update from an anti-virus company.
Win32:Sober-A contains its own SMTP routine for sending the e-mails. The recipient addresess are harvested from different files on the local machine. The worm installs itself into the system directory on the infected machine under the name SIMILARE.EXE. Two other copies of the worm are stored on the local disk as well. This worm has a special mechanism which is responsible for the keeping the worm active in the memory: it has two processes running and when one of them is terminated, the other one will restart it very quickly.
Win32:Sober-A adds a filename to the following registry entry so that the worm runs when you logon to your computer:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
It also creates the following file in the Windows system folder:
Macromed\Help\Media.dll
This file contains e-mail addresses collected from the system.
That is the extract from the Avast definitions. I use Avast on 7 and Vista and it did not detect it. A more thorough check also showed nix so I don't think it is a natural occurrence from all the current downloads.
i think its there is very good chance that its a false positve as believe the worm would be requesting access to the net wihich (even if it was dns packets) MS monitor would see those....
i have not seen anything different in the conhost from other builds apart from the fact that now it will close when i close cmd....
link: http://www.neowin.net/forum/index.ph...entry590257792
neowin....
edit: posted scan no av has reported sober worm...
http://www.virustotal.com/analisis/5...e67dc20ef2d348
Last edited by darkassain; 19 Dec 2008 at 02:14. Reason: typos link scan
Hello alon210, welcome to Se7en Forums!
As I'm sure you're aware; it is generally believed that it is a false detection.
LaterTed
Hello again!
Yes; that's fine. You can call me anything you like; just don't call me late for meals.
Later
Quote