For a couple weeks now I've been trying to get rid of malware which keeps popping up on my system. I could tell it was there because I started getting page redirects to random web game sites and suchlike while using Firefox to browse.
I have Norton 360 installed on Windows 7 x64. When I run scans it would flag some adware or tracking cookies but deleting/quarantining made no difference; the problem would still occur.
Searching around the web I found a page that suggested I run the following programs in sequence:
(note: did not use the download links on said page, instead googled a page with a download link from bleeping computer)
Tdsskiller and I think adwcleaner found some risks which I deleted. Hitman pro found a whole bunch of malware which I also cleaned. The other programs found nothing, but the problem stopped occuring for a while.
Shortly after this (couple of days) it started happening again. I ran the same programs, got roughly the same results (though nothing from roguekiller/adwcleaner) and performed the same actions. The problem stopped, then after a short while returned.
I started to wonder whether there is something on my system that could be installing these things but that is hidden from the scans of the programs mentioned. I checked out the processes tab in task manager to see if anything anomolous presented itself and noted there were two active (as in using memory) conhost.exe listings. One of these has my user name and a description under the relevant tabs; the other does not. I tried terminating the anomolous process but got an 'access is denied message'. When I try to open its file location or see its properties to locate it, nothing happens. As in I click the options on the menu and there is no noticeable result. The other, legitimate-looking process responds to these actions as usual. Searching for 'conhost' in the Windows menu returns a legitimate-looking process I can interact with, but no duplicate.
I'm wondering if this could be the Trojan, or at least a tell-tale sign of the presence of one. Can anyone suggest what sort of steps I should take to remove this thing? Any help would be appreciated.