It can be seen running onWindows 11,Windows 10,Windows 8, andWindows 7.
Conhost.exe needs to run forCommand Promptto interface with File Explorer.
One of its duties is to provide the ability to drag and drop files/folders directly into Command Prompt.
Even third-party programs can use conhost.exe if they need access to thecommand line.
In most circumstances, it’s entirely safe and does not need to be deleted or scanned for viruses.
However, there are situations where a virus could be masquerading as the conhostEXEfile.
One sign that it’s malicious or fake is if its using up lots ofmemory.
Windows VistaandWindows XPuse csrss.exe for a similar purpose.
Here are some processes known to start conhost.exe:
Is Conhost.exe a Virus?
However, there are some things it’s possible for you to find out if youre not sure.
Read the file name closely.
Plenty of other examples could be given, likeconhot.exeorconbost.exe.
Another indicator that it might be fake or malicious is if it’s stored in the wrong folder.
The real conhost.exe file runs from a very specific folderand from that folder only.
The easiest way to do this is by pressing theCtrl+Shift+Esckeys on your keyboard.
Find the conhost.exe process in theDetailstab (orProcessestab in Windows 7).
Don’t see any tabs in Task Manager?
Use theMore detailslink at the bottom of Task Manager to expand the program to full size.
Within that conhost.exe entry, look to the far right under theDescriptioncolumn, to confirm it readsConsole Windows Host.
The correct description here doesn’tnecessarilymean the process is safe, since a virus might use the same description.
Right-click or tap-and-hold the process and chooseOpen file location.
The folder that opens will show you exactly where conhost.exe is stored.
If you could’t fire up the file location this way, useMicrosoft’s Process Explorer programinstead.
To reiterate: conhost.exeshould not be running from any other folder, not even therootof theC:\Windows\folder.
Why Is Conhost.exe Using So Much Memory?
This is especially true if the steps above lead you to a folder that isn’tC:\Windows\System32.
A super easy way to see if it shows signs of something malicious is to upload the file toVirusTotal.
Your best bet is to use afree uninstaller toolto ensure all of it gets deleted.
Download Process Explorerand double-click (or tap-and-hold) the conhost.exe file you want to remove.
From theImagetab, selectKill Process.
PressOKto return to the main screen.
you’re free to close Process Explorer at this time if you’d like.
fire up the folder from above and just delete it like you would any file.
you’re free to safely delete any other conhost.exe imitation.
Install Malwarebytesand run a full system scan to find and remove the conhost.exe virus.
Malwarebytes is just one program from ourBest Free Spyware Removal Toolslist that we recommend.
Feel free to try the other ones in that list.
Install a full antivirus programif Malwarebytes or another spyware removal tool doesn’t do the trick.
Use a freebootable antivirus toolto scan the whole computer before the OS even starts up.
FAQ
No.
The cmd.exe file is theexecutable filefor the Command Prompt, so opening it will bring up the command window.
Watch out for viruses that masquerade as the cmd.exe file.
A running process could be triggering the conhost.exe file.Force quit programsthat you’re free to’t identify.
If the problem persists, it could be a virus.
