Most probably you landed on this article because you came across Console Window Host process or conhost.exe on your Windows task manager. There might be more than one Console Window Host (conhost.exe) processes visible on the Windows task manager eating up your system memory with high CPU usage.
You may have many questions about this process. Is this process really unnecessary? Do I need to close this process? Is conhost.exe a virus? We will answer all of these questions and many more in this article.
What is conhost.exe?
Conhost.exe is a process which you can see running on Windows task manager if you use Windows 7 and above as your operating system. It is an executable file and hence extension .exe, created by Microsoft. It is really normal to see it running on your Windows Task Manager.
Conhost.exe allows command prompt to perform its multiple functionalities. Command Prompt, also known as cmd.exe is an application which interprets the command line. The main functionality of the command prompt is an execution of the commands. Most of the commands are automated with the help of scripts and batch files. The command prompt is also useful for administrative tasks and troubleshooting Windows errors.
Conhost.exe adds more features to command prompt. It allows users to directly drag and drop folders/files into the command prompt. Also, modern window style which you see on command prompt was not possible on previous versions of Windows such as Windows XP. Conhost.exe made this possible. Reason for this is explained in the next section.
Why conhost.exe?
In the previous versions of Windows like Windows XP, Command prompt was handled by CSRSS. CSRSS stands for ClientServer Runtime System Service. It was a system-level service with few issues. The biggest problem with CSRSS was if it crashed, it was capable of bringing the whole system down with it. It wasn’t reliable at all. Another issue (Not that big though) with CSRSS was the old classic look of the command prompt. CSRSS was the reason command prompt had simple look opposed to other windows.
Take a look at this image of cmd on Windows XP: See how command prompt window is different than the normal window.
An upgrade of the Windows to Windows 7 solved these issues with CSRSS. Console Window host (conhost.exe) is a middleman between CSRSS and command prompt. It did not only solved these issue but also added features like drag and drop functionality into the command prompt.
Multiple conhost.exe Running on task manager?
Mostly multiple Console Window Host (conhost.exe) on task manager is also a perfectly normal situation.
Sometimes third party software uses a command prompt. But while using this software you won’t see command prompt pop up because it runs in the background.
Multiple Console Window Host may not be always a thing to ignore.
One of these processes might be a virus!
Go through the next section to know how to identify if Console Window Host (conhost.exe) is a virus or not and also how to get rid of it if it’s a virus.
Is Console Window Host conhost.exe a virus?
As mentioned earlier if conhost.exe is used by third-party software you will see multiple Console Window host (Conhost.exe) processes on your task manager. But if you are using Windows XP, Vista or older then Conhost.exe on your task manager is virus.
Also for other Windows Operating systems, if Console Window Host on your task manager is eating too much system memory and CPU usage it might be a virus.
Hijackers use a virus called trojan disguised as Console Window Host for the processes such as bitcoin mining.
To check if your conhost.exe is original or not follow the following steps:
Step 1: Open task manager. Right click on the start button and select Task Manager from the list or you can access task manager by pressing Ctrl+Shift+Esc.
Step 2: Search for Console Window Host on your task manager. Right click on it and choose “Open file location”
Step 3: If you see the directory of Console Window Host is “C:\Windows\System32″ then no need to worry. Conhost.exe is original. But if a directory is something else then conhost.exe on task manager is a virus. Most probably if it is a virus “%userprofile%\AppData\Roaming\Microsoft” folder will open.
How to get rid of a conhost.exe virus?
It’s not rocket science. You can end conhost.exe task by right-clicking on Console Window Host file on your task manager and then clicking on End task. Then use antivirus and scan your system to permanently remove this virus.
Also Read: How to force delete a file?
Conhost.exe eating too much memory and CPU usage?
Let’s say you checked on task manager and Console Windows Host is located in the right directory still it is using too much of memory. What will you do? We have a solution for you. This will not exactly solve your problem but by following this solution you can identify the root of the problem. Then you can perform troubleshooting procedure for that particular software and get rid of the problem.
Method 1
All you need to do is download Process Explorer from this link. Open this software and press “Ctrl+F”. This will open Process Explorer search window. Type conhost in the search bar and press Enter. Then you will list of all conost.exe processes running on your system.
Check which one is eating too much memory and CPU usage and perform troubleshooting for that software. If your Conhost.exe is not eating too much of memory, it is fully normal. You don’t have to do anything. But if is eating too much of memory, you can end task whenever needed.
Method 2: Run System File Checker tool
The sfc /scannow command will check all your Windows files and find incorrect versions. Not only that, it will prompt you if it finds anything suspicious. So, use this command to see if your Microsoft files are corrupted or not
- Open Command Prompt as Administrator
- Type sfc<space>/scannow
It takes a few minutes to complete the scan.
Hope you find this article helpful. Thank for reading!
