What is Conhost.exe in Windows?

Microsoft provides the conhost.exe file which is completely safe. It runs on Windows 7, Windows 8, and Windows 10. Conhost.exe is required to start for the command prompt to interact with Windows Explorer. If you want to learn a little more about what Conhost.exe is in Windows, stay and read on …

One of its duties is to provide the ability to drag and drop files. Even third-party programs can use conhost.exe if they need to access the command line. In most circumstances, conhost.exe is completely safe and does not need to be removed. It is even normal for this process to run multiple times simultaneously. However, there are situations in which a virus can impersonate the conhost EXE file. A sign that this is malicious or false if it is taking up a lot of memory space.

Windows XP and Windows Vista use crss.exe for a similar purpose.

What Software does Conhost.exe use on Windows?

The conhost.exe process occurs with each instance of the command prompt and with any program that uses this command-line tool. Here are some processes that we know start conhost.exe:

1. Dell “DFS.Common.Agent.exe”
2. NVIDIA’s “NVIDIA Web Helper.exe”
3. Plex’s “PlexScriptHost.exe”
4. “Node.exe” from Adobe Creative Cloud

Is it a Conhost.exe virus?

In many cases, there is no reason to assume that conhost.exe is a virus or needs to be removed. However, there are a few things you can make sure of. For starters, if you see conhost.exe starting in Windows Vista or Windows XP, it is probably a virus. If you see conhost.exe on any of those versions of Windows, go to the bottom of this page to see what to do. Another indicator that conhost.exe may be false or malicious is if it is stored in the wrong folder. The actual conhost.exe file runs from a very specific folder. The easiest way to tell if the conhost.exe process is dangerous is to use Task Manager to do two things: a) check its description and b) check the folder it is running from.

To do so, follow the steps that we provide below

1. Open the Task Manager. The easiest way to do this is by pressing the Ctrl + Shift + Esc keys on your keyboard.
2. Look for the process conhost.exe in the tab Details. There may be multiple instances of conhost.exe, so it is important to follow the steps below for each and every one you see.
3. Inside that conhost.exe entry, look to the right under the “Description” column to make sure it reads Windows Host Console. The correct description here does not necessarily mean that the process is safe.
4. Right-click or hold the process and choose Open file location.
5. The folder that starts up will show you exactly where conhost.exe is stored.

This is the actual location of the harmless process

C:  Windows  System32 

If this is the folder where conhost.exe is stored and started, it is very likely that you are not dealing with a malicious file. Remember that conhost.exe is an official Microsoft file that is meant to be on your computer, but only if it exists in that folder. However, if the folder that is opened in step 4 no is the System32 folder, or if you are using a lot of memory and suspect you shouldn’t need that much. To reiterate: conhost.exe should not be run from any other folder, including the folder root C: Windows . It may seem correct that this EXE file is stored there, but it actually only serves its purpose in the folder system32, not in C: Users [username] , C: Program Files , etc.

Why is Conhost.exe using so much memory?

A normal computer running conhost.exe without any malware you might see that the file uses around several hundred kilobytes (for example, 300KB) of RAM, but probably no more than 10MB. If conhost.exe is using much more memory than that. There is a good chance that the file is fake. This is especially true if the steps above take you to a folder that is not C: Windows System32 .

There is a conhost.exe virus called Conhost Miner that stores the “conhost.exe” files in this folder and possibly others:

% perfil de usuario%  AppData  Roaming  Microsoft 

This virus tries to open a Bitcoin or other cryptocurrency mining operation without your knowledge, which can be very demanding on memory and processor.

How to remove a Conhost.exe virus?

If you suspect that conhost.exe is a virus, it is very easy to get rid of it. There are many free tools available that you can use to remove the conhost.exe virus from your computer. However, the first attempt should be to shut down the main process that is using the conhost.exe file so that it no longer runs the malicious code and is easier to kill. If you know what program conhost.exe uses, you can skip these steps below and try to remove the application in the hope that the associated conhost.exe virus will be removed as well.

Here are the steps to remove the virus

1. Download Process Explorer and double-click the conhost.exe file that you want to remove.
2. In the tab Image, Choose Delete process.
3. Confirm with a okay. If you receive an error that the process cannot be closed, please skip to the next section below to run a virus scan.
4. Press okay to return to the main screen. You can close Process Explorer at this time.

Now that the conhost.exe file is no longer attached to the main program that started it, it’s time for you to remove the fake conhost.exe file:

Follow the steps below in order and restart your computer after each one

1. Try removing conhost.exe. Open the folder from step 4 above and simply delete it. You can also use Everything to do a full search of your entire computer to make sure the only conhost.exe file you see is in the folder system32
2. Install Malwarebytes and run a full system scan to find and remove the conhost.exe virus. Malwarebytes is just one program on our list of Best Free Spyware Removal Tools that we recommend.
3. Start a full antivirus program if Malwarebytes or another removal tool doesn’t work. Not only should this remove the fake conhost.exe file, but it will also set up your computer with an always-on scanner that can help prevent viruses like this from entering your computer again.
4. Use a totally free antivirus tool to scan your entire computer before the operating system starts. This will surely work to fix the conhost.exe virus as the process will not run at the time of the virus scan.

Related articles that you might find interesting