What is Conhost.EXE Windows?

On any Windows-based computer, you will find that many strange processes appear in the Task Manager, and one of them is conhost.exe – which we will discuss thoroughly. than in the article below.

It’s not a virus or any other malicious program, but why always work?

In essence, this is a process Microsoft has “reserved” for the Windows Vista operating system and 7. In previous versions of Windows XP, Microsoft has used csrss (client-server runtime process) to implement the core of this command, but the real issue here is related to security. The most obvious problem is that csrss.exe can not execute and respond to the needs of the Windows theme set, so the cmd command is very difficult to use. Based on a number of security and stability standards, storing and using the cmd prompt associated with csrss will entail many problems, causing a series of errors and instability in the system:

In Windows Vista, Microsoft has temporarily overcome this phenomenon by granting access, using programs based on account levels and the relationship between those accounts. At the same time, Microsoft has fixed and improved some of the functionality of the dwm.exe process to correctly display the title of the Windows window, but with some interface parts having scrollbars, the situation remains the same. And since cmd and csrss.exe run at different levels of authorization, it also breaks handy drag-and-drop between the rest of Windows and text in the cmd window. Until the Windows 7 operating system, conhost.exe (Console Window Host) can be said to have been “regenerated”, solve all the problems and problems as above, and enhance security. and stability.

How to distinguish the conhost.exe process properly or some malicious program is “disguised”?

Firstly, to ensure your system is safe, select some stable antivirus program settings such as Avira, Microsoft Security Essentials … In fact, there are several ways to check the accuracy of the conhost process. .exe on your computer.

First of all, the real conhost.exe program is always stored in the following system directory:


If you detect a conhost.exe process in any other location, it is definitely a fake software. When using the Process Explorer tool, we will have some additional information. Specifically, at the csrss.exe, under Properties> Environment you will see ComSpec is cmd.exe program:

At the same time, conhost.exe only works if we open the cmd again. This is also the application, the basic and essential process of Windows 7, which allows us to execute cmd commands, the nature of conhost.exe is safe and does not endanger the system, we It should not be deleted, but also make sure that it is not a fake security program by checking the above. Good luck!