What's Conhost.exe in Windows? What Does it Do?

The conhost.exe (Console Windows Host) file is provided by Microsoft and is usually legitimate and completely safe. It can be seen running on Windows 11, Windows 10, Windows 8, and Windows 7.

Conhost.exe needs to run for Command Prompt to interface with File Explorer. One of its duties is to provide the ability to drag and drop files/folders directly into Command Prompt. Even third-party programs can use conhost.exe if they need access to the command line.

In most circumstances, it's entirely safe and does not need to be deleted or scanned for viruses. It's even normal for this process to be running several times simultaneously (you'll often see multiple instances of conhost.exe in Task Manager).

However, there are situations where a virus could be masquerading as the conhost EXE file. One sign that it's malicious or fake is if it’s using up lots of memory.

Software That Use Conhost.exe

The conhost.exe process is started with each instance of Command Prompt and with any program that utilizes this command-line tool, even if you don’t see the program running (like if it’s running in the background).

Here are some processes known to start conhost.exe:

• Dell’s “DFS.Common.Agent.exe” 
• NVIDIA’s “NVIDIA Web Helper.exe”
• Plex’s “PlexScriptHost.exe”
• Adobe Creative Cloud’s “node.exe”

Is Conhost.exe a Virus?

Most of the time, there's no reason to assume conhost.exe is a virus or that it needs to be deleted. However, there are some things you can check if you’re not sure.

For starters, if you see it running in Windows Vista or XP, then it most certainly is a virus, or at least an unwanted program, because those versions of Windows don't use this file. If you see conhost.exe in either of those Windows versions, skip down to the very bottom of this page to see what you need to do.

Read the file name closely. A clever attacker might purposely misspell the file (e.g., c0nhost.exe) so you think it's a necessary system file. Plenty of other examples could be given, like conhot.exe or conbost.exe.

Another indicator that it might be fake or malicious is if it's stored in the wrong folder. The real conhost.exe file runs from a very specific folder and from that folder only. The easiest way to learn whether the process is dangerous or not is to use Task Manager to do two things: a) verify its description, and b) check the folder that it’s running from.

1. Open Task Manager. The easiest way to do this is by pressing the Ctrl+Shift+Esc keys on your keyboard.

2. Find the conhost.exe process in the Details tab (or Processes tab in Windows 7).

   There might be multiple instances of conhost.exe, so it’s important to follow the next steps for each and every one you see. The best way to gather all of the conhost.exe processes together is to sort the list by selecting the Name column (Image Name in Windows 7).

   Don't see any tabs in Task Manager? Use the More details link at the bottom of Task Manager to expand the program to full size.

3. Within that conhost.exe entry, look to the far right under the Description column, to make sure it reads Console Windows Host.

   The correct description here doesn't necessarily mean the process is safe, since a virus might use the same description. However, if you see any other description, there’s a strong chance that the EXE file isn't the real Console Windows Host process and should be treated as a threat.

4. Right-click or tap-and-hold the process and choose Open file location.

5. The folder that opens will show you exactly where conhost.exe is stored.

This is the real location of the non-harmful process:

C:\Windows\System32\

If this is the folder where conhost.exe is being stored and running from, there’s a really good chance you’re not dealing with a dangerous file. Remember that this is an official file from Microsoft that has a real purpose to be on your computer, but only if it exists in that folder.

However, if the folder that opens at Step 4 is not the System32 folder, or if it's using a ton of memory, and you suspect that it shouldn't need that much, keep reading to learn more about what's happening and how you can remove the conhost.exe virus.

Why Is Conhost.exe Using So Much Memory?

A normal computer running conhost.exe without any malware might see the file use around several hundred kilobytes (e.g., 500 KB) of RAM, but likely no more than 10 MB even when you're using the program that launched conhost.exe. 

If conhost.exe is using a lot more memory than that, and Task Manager shows that the process is utilizing a significant portion of the CPU, there's a good chance the file is fake. This is especially true if the steps above lead you to a folder that isn't C:\Windows\System32\.

There's a particular conhost.exe virus called Conhost Miner that stores itself in this folder, and possibly others:

%userprofile%\AppData\Roaming\Microsoft\

This virus attempts to run a Bitcoin or other cryptocurrency mining operation without you knowing, which can be very demanding of the memory and processor.

How to Remove a Conhost.exe Virus

If you confirm or even suspect that conhost.exe is a virus, it should be fairly straightforward to get rid of it. A super easy way to see if it shows signs of something malicious is to upload the file to VirusTotal. There are lots of free tools available to you that can delete a conhost.exe virus from your computer, and others to help make sure it doesn't come back.

However, your first attempt should be to shut down the parent process that's using the file so it will no longer be running its malicious code, and to make it easier to delete.

1. Download Process Explorer and double-click (or tap-and-hold) the conhost.exe file you want to remove.

2. From the Image tab, select Kill Process.

3. Confirm with an OK.

   If you get an error that the process can't be shut down, skip to the next section below to run a virus scan.

4. Press OK to return to the main screen. You can close Process Explorer at this time if you'd like.

Now that the file is no longer attached to the parent program that started it, it's time to remove the fake conhost.exe file:

1. Try deleting conhost.exe. Open the folder from above and just delete it like you would any file.

   Use the Everything tool to do a full search across your whole computer to make sure the only conhost.exe file you see is in the System32 folder. You might actually find another in the C:\Windows\WinSxS\ folder, but that conhost.exe file should not be what you find running in Task Manager or Process Explorer (it's safe to keep). You can safely delete any other conhost.exe imitation.

2. Install Malwarebytes and run a full system scan to find and remove the conhost.exe virus.

   Malwarebytes is just one program from our Best Free Spyware Removal Tools list that we recommend. Feel free to try the other ones in that list.

3. Install a full antivirus program if Malwarebytes or another spyware removal tool doesn't do the trick. 

   This should not only delete the fake conhost.exe file, but will also to set up your computer with an always-on scanner that can help prevent viruses like this one from getting on your computer again.

4. Use a free bootable antivirus tool to scan the whole computer before the OS even starts up. This will surely work to fix the conhost.exe virus since the process won't be running at the time of the virus scan.