EVE General Discussion

Is anyone else noticing that each time you start EVE, one of both of those programs will start up as well, And stay running in the background?

Bug or Feature?

I'm putting on my tin-foil hat just in case.

Dont be alarmed. It's just scanning your computer for photos of young boys.

You did delete them, right?

****! BRB

Google is your best friend:
"This conhost.exe program is part of the cmd.exe file, when you run cmd.exe on windows, you will also see conhost.exe in your tasklist. Closing the cmd.exe dos window will also terminate conhost.exe."

And cmd is dos command prompt - write cmd.exe in win7 start search box and you will see what that is, if you don't know.

The conhost.exe process fixes a fundamental problem in the way previous versions of Windows handled console windows, which broke drag & drop in Vista.

It’s a completely legitimate executable—as long as it’s running from the system32 folder, and is signed by Microsoft.

No I am not.

Yes.

For the computer illiterate its perfectly okay for them to refer to it as a DOS prompt. Black and white text display with c:\ is DOS to them. Now excuse me while I go run Powershell.

Both of those processes are harmless. I would like to know why the Launcher or the Client would need a command prompt instance opened as there's nothing you can do in a command prompt that can't be done with the Windows API which they could just call from the launcher or client.

I'll just chalk it up to CPP being CCP and go back up my boot.ini.

I guess its hard to sort through the opinions already but I'll add another

I do not have conhost, I run XP still. Conhost is specific to windows 7 as already mentioned and should be running out of the system32 directory to be valid. Supposedly its a MS fix to a problem with drag and drop that was found to occur on Windows Vista that is related to the cmd box being themed whereas it was not themed before Vista.

Some questions were raised as to using a cmd line box. A hint as to why CCP might use a cmd in the first place can be gleaned from looking at EXEfile, EXEfile is called from the cmd line with the noconsole switch

..\bin\ExeFile.exe /noconsol




I guess thy are writing a log for crashes during startup that couldn't be captured with ingame mechanics.

Sometimes it is interesting to look at all the libraries called, especially when looking for malware

This is an old standby too

[url=http://technet.microsoft.com/en-us/sysinternals/bb896653]Process explorer[/url

Written before Microsoft knew how their OS operated so they bought it and its author. If you click on a running file in the upper window, the bottom window shows all the DLL's that process is calling on to do its task. A rightclick give a properties box of nine tabs

Of particular interest in regards to this question is an implied question: is this process communicating with the outside in some manner that may indicate that its a threat worth looking at in deeper detail

Lets say I look at exefile and eve as expected has two connections to the outside world. One for voice and another for data. Its also got 4 internal paths working

I go to cmd and r-click and the properties show me no external connections at all and its drawing no resources other than 2.7 megs of memory holding it open. Peanuts

If YOU did the same for conhost, you could verify whether or not it has an outside connection. It probably has internal connections for drag and drop data, just guessing, wouldn't surprise or alarm me, if it has an external connection on external ports, click the resolve host box and see if they are going to CCP, If they are not google them, they may still be related to other eve services. It looks like they have a chat server I have not spotted before loading a dll into my eve exefile that I had not spotted before this host.

So there's a generic tool that won't get you into trouble but will give you enough info that you can relax or act as the case may be.