What is conhost.exe and why is it Running on my computer?

By Hrishi Updated

You might have seen a process conhost.exe running on your computer. Is it a virus? A malware? Or can it harm my computer? These are few of the normal questions that pop up on your mind seeing an unknown process like conhost.exe running on your PC.

So What Is conhost.exe

Don’t panic conhost.exe is not a virus nor malware nor it cannot do any harm to your computer. So the next question pops up, then what is this conhost.exe? And what is it doing on my computer? The answer can be ruled out basically as, Conhost.exe is a process designed for Windows Vista & Windows 7 and other latest operating systems of Windows which executes a stable and thematic interfaces to operate command prompt better than the older process used.

What conhost.exe does

it untangles a common problem of Windows 7 and Windows vista for you. It helps the operating system to run smoothly without Drag or Drop.

In the previous versions of Windows like Windows XP client-server runtime process (csrss) hosted all the console processes but, the csrss had major issues with aesthetics and security. It cannot execute Windows themes too, as a result the command prompt of these operating systems can be seen in an unpleasant manner or completely in a plain format. These faults of the csrss ­­­resulted in crashing the system multiple times and triggering vast amount of errors repeatedly.

Consider the case of the command prompt console in Windows Vista it may look similar to the old operating systems and the scroll bars are still executed in the same old style. The reason is DWM or Desktop Window Manager Process controls and executes drawing of the title bars. And also as a security measure Windows vista also denied the ability to simply drag and drop required files from the PC directly to command prompt.

Now go ahead and check it on the latest versions of Windows and you can see that conhost.exe is now running under csrss.exe. As a result, now you got a new revised version of the scroll bars with a decent standard look and more overly now you can simply drag and drop a file from your Windows explorer to the command prompt without any security threat.

Hence the birth of conhost.exe resolved all these issues. Providing a much more stable and user friendly experience to the users. To be specific conhost.exe is a major system file it shall never be deleted at any circumstance.

Go through the properties of conhost.exe and you could see that it is mentioned as a Console Window host in the description.

NOTE: In rare cases, users have said that they see two conhost.exe processes running. Then one of the processes could be a virus. Install an antivirus in your system and run a boot time scan and delete it when detected.

How to detect & remove fake conhost.exe

  • Familiarize with the exact names and location of the viruses first since you do not have the option to search in the Recovery console
  • Now make sure that the BIOS setting in your computer allows booting from cd.
  • Now insert the windows installation disk of your OS and reboot your system
  • When the system detects a Windows CD it will ask you to press any key in order to boot from the CD .Do so
  • It will detect hardware’s on your computer and then and give options to Install or for Recovery console
  • Start the Repair console by pressing R
  • The next screen that appears will ask you to choose the windows installation on your computer to repair it
  • Imagine that you have installed windows on C drive then it will be listed as                     1 C:\windows\system
  • Press enter key after typing 1 at the prompt
  • It will now ask for your administrative password, Type In your password and press enter.
  • Such viruses with windows process names can be found on your systems root & system directories, Find them
  • After you have located these files select and delete them.
  • Type cd to go a level back
  • Again type cd enter the required folder
  • Type dir to display files present in the current directory
  • Type delete in order to delete files
  • Type in dir to confirm that the files are already deleted

If the virus file is not still deleted then it simply means that the file has read only / hidden attribute enabled.

  • Type dir from the same directory and press enter
  • Now it will display attributes like –RH before its name
  • R indicate read only file
  • H indicates hidden file
  • To remove these attributes type,
  • attrib –R and press Enter & attrib -H respectively
  • Now go on and use the delete commands mentioned above to delete these files.

Now I will show you how we can trouble shoot Errors triggered by conhost.exe

Method 1

Run Microsoft Safety Scanner which will automatically detect and eliminate error causing malware


Method 2

Check if the issue still remains after rebooting in Safe mode

If the issue still persists then reboot your system in clean boot and look for any third party application which is probably the reason for the issue and clean boot will guide you to eliminate this unwanted software conflicts easily.