What Is conhost.exe and Why Is It Running?

[Batu69]

 

You are no doubt reading this article because you’ve stumbled across the Console Window Host (conhost.exe) process in Task Manager and are wondering what it is. We’ve got the answer for you.

 

This article is part of our ongoing series explaining various processes found in Task Manager, like svchost.exe, dwm.exe, ctfmon.exe, mDNSResponder.exe, rundll32.exe, Adobe_Updater.exe, and many others. Don’t know what those services are? Better start reading!

 

So What Is the Console Window Host Process?

Understanding the Console Window Host process requires a little bit of history. In the Windows XP days, the Command Prompt was handled by a process named the ClientServer Runtime System Service (CSRSS). As the name implies, CSRSS was a system level service. This created a couple of problems.

 

First, a crash in CSRSS could bring down a whole system, which exposed not just reliability issues, but possible security vulnerabilities as well. The second problem was that CSRSS could not be themed, because the developers didn’t want to risk theme code to run in a system process. So, the Command Prompt always had the classic look rather than using new interface elements.

 

Notice in the screenshot of Windows XP below that the Command Prompt doesn’t get the same styling as an app like Notepad.

 

 

Windows Vista introduced the Desktop Window Manager—a service that “draws” composite views of windows onto your desktop rather than letting each individual app handle that on its own. The Command Prompt gained some superficial theming from this (like the glassy frame present in other windows), but it came at the expense of being able to drag and drop files, text, and so on into the Command Prompt window.

 

Still, that theming only went so far. If you take a look at the console in Windows Vista, it looks like it uses the same theme as everything else, but you’ll notice that the scrollbars are still using the old style. This is because the Desktop Window Manager handles drawing the title bars and frame, but an old-fashioned CSRSS window still sits inside.

 

 

Enter Windows 7 and the Console Window Host process. As the name implies, its a host process for the console window. The process sort of sits in the middle between CSRSS and the Command Prompt (cmd.exe), allowing Windows to fix both of the previous issues—interface elements like scrollbars draw correctly, and you can again drag and drop into the Command Prompt. And that’s the method still used in Windows 8 and 10, allowing all the new interface elements and styling that have come along since Windows 7.

 

Even though the Task Manager presents the Console Window Host as a separate entity, it’s still closely associated with CSRSS. If you check the conhost.exe process out in Process Explorer, you can see that it actually runs under the csrss.ese process.

 

 

In the end, the Console Window Host is something like a shell that maintains the power of running a system-level service like CSRSS, while still securely and reliably granting the ability to integrate modern interface elements.

Why Are There Several Instances of the Process Running?

 

You’ll often see several instances of the Console Window Host process running in Task Manager. Each instance of Command Prompt running will spawn its own Console Window Host process. In addition, other apps that make use of the command line will spawn their own Console Windows Host process—even if you don’t see an active window for them. A good example of this is the Plex Media Server app, which runs as a background app and uses the command line to make itself available to other devices on your network.

 

Many background apps work this way, so it’s not uncommon to see multiple instances of the Console Window Host process running at any given time. This is normal behavior. For the most part, each process should take up very little memory (usually under 10 MB) and almost zero CPU unless the process is active.

 

That said, if you notice that a particular instance of Console Window Host—or a related service—is causing trouble, like continual excessive CPU or RAM usage, you could check into the specific apps that are involved. That might at least give you an idea of where to start troubleshooting.

 

Unfortunately, Task Manager itself doesn’t provide good information about this. The good news is that Microsoft  provides an excellent advanced tool for working with processes as part of its Sysinternals lineup. Just download Process Explorer and run it—it’s a portable app, so no need to install it. Process Explorer provides all kinds of advanced features—and we highly recommend reading our guide to understanding Process Explorer to learn more.

 

The easiest way to track these processes down in Process Explorer is to first hit Ctrl+F to start a search. Search for “conhost” and then click through the results. As you do, you’ll see the main window change to show you the app (or service) associated with that particular instance of Console Window Host.

 

 

If the CPU or RAM usage indicates that this is the instance causing you trouble, then at least you’ve got it narrowed down to a particular app.

Could This Process Be a Virus?

The process itself is an official Windows component. While it’s possible that a virus has replaced the real Console Window Host with an executable of its own, it’s unlikely. If you’d like to be sure, you can check out the underlying file location of the process. In Task Manager, right-click any Service Host process and choose the “Option File Location” option.

 

 

If the file is stored in your Windows\System32 folder, then you can be fairly certain you are not dealing with a virus.

 

 

There is, in fact, a trojan out there named Conhost Miner that masquerades as the Console Window Host Process. In Task Manager, it appears just like the real process, but a little digging will reveal that it’s actually stored in the %userprofile%\AppData\Roaming\Microsoft folder rather than the Windows\System32 folder. The trojan is actually used to hijack your PC to mine Bitcoins, so the other behavior you’ll notice if it’s installed on your system is that the memory usage is higher than you might expect and the CPU usage maintains at very high levels (often above 80%).

 

Of course, using a good virus scanner is the best way to prevent (and remove) malware like the Conhost Miner, and it’s something you should be doing anyway. Better safe than sorry!

 

Article source