You might have seen Conhost.exe in your Task Manager and wondered about what it is and why is it running. In this article, we will discuss everything about conhost.exe in detail, so later all your doubts about it will be resolved.
You might be interested in following related articles about, what is:
To fully understand the Console Window Host process, we’ll go through some history. Back in days of Windows XP, the Command Prompt was handled by a Process named Client Server Runtime System Service(CSRSS). This CSRSS was a system level service and this lead to many problems such as:
If a crash occurs in CSRSS then the whole system would go down and this caused reliability and security issues.
CSRSS could not be themed as Developers didn’t want to take risk of running theme code in the System process. That’s why command prompt had a very basic look those days.
Notice the difference between styling of Notepad and Command Prompt in Windows XP.
In Windows Vista, a new service was introduced named “Desktop Window Manager“. This service created a glassy frame view of all the Apps in Windows. Due to this command prompt gained some Outer Theme giving it Glassy Frame look from outside.
When you open Command Prompt in Windows Vista, you will see some themes in the outer portion of it but inside you will observe same old style. This is because the Desktop Window Manager handles drawing title bar and frame for every app, but inside it is the same old-fashioned CSRSS window. It was like old thing wrapped up in a new wrapper.
In Windows 7, the Console Window Host Process was introduced which serves as a host process for the console window. This Console Window Host Process acts as a middleman connecting CSRSS and the Command Prompt(cmd.exe). It allowed to fix both of the previous issues:
Window Elements such as Scroll Bars were drawn correctly.
It allowed drag and drop into Command Prompt.
Now, this method is used in all later versions of Windows which are Windows 8 and 10. It gave Command Prompt a new look.
Viewing conhost.exe in Process Explorer
As we know that the Console Window is a separate entity but Windows closely associates it with CSRSS therefore in Process Explorer, you will see it running under csrss.exe.
So basically what Conhost.exe or the Console Window provides is that a Shell that has:
Why do you see Several Instances of “Conhost.exe” or “Console Window Host” in Task Manager?
If you have opened multiple Command Prompt then for each of them there will be a Console Window Host Process started. Also, if there is any application that uses command line will have its own Console Window Host Process- Even though these applications may be running in the background. For example, there is an app called Plex Media Server app, which runs as a background app and uses the command line to make itself available for other devices in your network.
Multiple background apps work using command line so it’s not uncommon to see multiple instances of the Console Window Host process running at a single time. This is completely normal behavior. Also, they consume very little CPU and RAM, so no need to worry about them.
What if Console Window Host or Conhost.exe is taking too much RAM or CPU?
First, you need to check to which Application that instance of Conhost.exe is associated with. Then only you could know the culprit or the application that’s causing the trouble. But you cannot view it directly, for that you need to download Process Explorer and just run it- You don’t need to install it. It’s a portable app, just double click and run it.
When you have opened Process Explorer, then:
First search for Conhost.exe by pressing Ctrl+F key in the search and search for “conhost”.
Now it will show you the app or service to which this conhost is associated with.
If you observe that its consuming lot of memory and RAM, then you can close the app which is causing it or you know which is the culprit app that’s causing the trouble.
You can finally close the app causing trouble or do an Antivirus Scan.
Can “Conhost.exe” be a virus?
As it’s a Windows Official service then it’s definitely not a virus. But it can be the case that someone had replaced the real Console Window Host with an executable of its own with the same name. Although happening of this is very unlikely. However, if you want to be sure that its System Process and not a virus.
Then right-click on it and select the Open file location
If the file is stored in WindowsSystem32 folder, then no need to worry its definitely a System process and not a virus
But the interesting fact is that there is a trojan horse named “Conhost Miner” which masquerades the actual Console Window Host Process. If you search conhost.exe file location you will get it at %userprofile%AppDataRoamingMicrosoft folder instead of WindowsSystem32 folder. This trojan uses the computer to do Bitcoin mining, that’s why the system CPU usage goes up to 80% and memory usage also increases to very high level.
The best way to get rid of this software is to use a Good Antivirus Software and remove these malware from your PC.
Conclusion – Conhost.exe or the Console Windows Host
So, basically, Conhost.exe is an interface that combines Apps that use command line interface with CSRSS process in order to add functionality to the App along with the services provided by CSRSS.
Hope, you would have got a deep insight into what is Conhost.exe process.
