What Is Conhost.exe?

Definition of conhost.exe and how to delete conhost.exe viruses

Screenshot of the conhost.exe process running in Windows 10 task manager
Conhost.exe (Console Windows Host).

The conhost.exe (Console Windows Host) file is provided by Microsoft and is usually legitimate and completely safe. It can be seen running on Windows 10, Windows 8, and Windows 7.

Conhost.exe is required to run in order for Command Prompt to interface with Windows Explorer. One of its duties is to provide the ability to drag and drop files/folders directly into Command Prompt. Even third-party programs can use conhost.exe if they need access to the command line.

In most circumstances, conhost.exe is entirely safe and does not need to be deleted or scanned for viruses. It's even normal for this process to be running several times simultaneously (you'll often see multiple instances of conhost.exe in Task Manager).

However, there are situations where a virus could be masquerading as the conhost EXE file. One sign that conhost.exe is malicious or fake is if it’s using up lots of memory.

Note: Windows Vista and Windows XP use crss.exe for a similar purpose.

Software That Use Conhost.exe

The conhost.exe process is started with each instance of Command Prompt and with any program that utilizes this command line tool, even if you don’t see the program running (like if it’s running in the background).

Here are some processes known to start conhost.exe:

  • Dell’s “DFS.Common.Agent.exe” 
  • NVIDIA’s “NVIDIA Web Helper.exe”
  • Plex’s “PlexScriptHost.exe”
  • Adobe Creative Cloud’s “node.exe”

    Is Conhost.exe a Virus?

    Most of the time there's no reason to assume conhost.exe is a virus or that it needs deleted. However, there are some things you can check if you’re not sure.

    For starters, if you see conhost.exe running in Windows Vista or Windows XP, then it most certainly is a virus, or at least an unwanted program, because those versions of Windows do not use this file.

    If you see conhost.exe in either of those Windows versions, skip down to the very bottom of this page to see what you need to do.

    Another indicator that conhost.exe might be fake or malicious is if it's stored in the wrong folder. The real conhost.exe file runs from a very specific folder and from that folder only. The easiest way to learn whether the conhost.exe process is dangerous or not is to use Task Manager to do two things: a) verify its description, and b) check the folder that it’s running from.

    1. Open Task Manager. The easiest way to do this is by pressing the Ctrl+Shift+Esc keys on your keyboard.
    2. Find the conhost.exe process in the Details tab (or Processes tab in Windows 7).

      Note: There might be multiple instances of conhost.exe, so it’s important to follow the next steps for each and every one you see. The best way to gather all of the conhost.exe processes together is to sort the list by selecting the Name column (Image Name in Windows 7).

      Tip: Don't see any tabs in Task Manager? Use the More details link at the bottom of Task Manager to expand the program to full size.
    3. Within that conhost.exe entry, look to the far right under the “Description” column to make sure it reads Console Windows Host.

      Note: The correct description here does not necessarily mean that the process is safe since a virus might use the same description. However, if you see any other description, there’s a strong chance that the EXE file is not the real Console Windows Host process and should be treated as a threat.
    1. Right-click or tap-and-hold the process and choose Open file location.

      The folder that opens will show you exactly where conhost.exe is stored.

      Note: If you can't open the file location this way, use Microsoft's Process Explorer program instead. In that tool, double-click or tap-and-hold conhost.exe to open its Properties window, and then use the Image tab to find the Explore button next to the file's path.

    This is the real location of the non-harmful process:


    If this is the folder where conhost.exe is being stored and running from, there’s a really good chance that you’re not dealing with a dangerous file.

    Remember that conhost.exe is an official file from Microsoft that has a real purpose to be on your computer, but only if it exists in that folder.

    However, if the folder that opens at Step 4 is not the \system32\ folder, or if it's using a ton of memory and you suspect that it shouldn't need that much, keep reading to learn more about what's happening and how you can remove the conhost.exe virus.

    Important: To reiterate: conhost.exe should not be running from any other folder, including the root of the C:\Window\ folder. It might seem fine for this EXE file to be stored there but it really only serves its purpose in the system32 folder, not in C:\Users\[username]\, C:\Program Files\, etc.

    Why Is Conhost.exe Using So Much Memory?

    A normal computer running conhost.exe without any malware might see the file use around several hundred kilobytes (e.g. 300 KB) of RAM, but likely no more than 10 MB even when you're using the program that launched conhost.exe. 

    If conhost.exe is using a lot more memory than that, and Task Manager shows that the process is utilizing a significant portion of the CPU, there's a really good chance that the file is fake. This is especially true if the steps above lead you to a folder that is not C:\Windows\System32\.

    There's a particular conhost.exe virus called Conhost Miner (an offshoot of CPUMiner) that stores it's "conhost.exe" file in the %userprofile%\AppData\Roaming\Microsoft\ folder (and possibly others). This virus attempts to run a Bitcoin or other cryptocoin mining operation without you knowing, which can be very demanding of the memory and processor.

    How to Remove a Conhost.exe Virus

    If you confirm, or even suspect, that conhost.exe is a virus, it should be fairly straightforward to get rid of it. There are lots of free tools available that you can use to delete the conhost.exe virus from your computer, and others to help make sure it doesn't come back.

    However, your first attempt should be to shut down the parent process that's using the conhost.exe file so that a) it will no longer be running its malicious code and b) to make it easier to delete.

    Note: If you know which program is using conhost.exe, you can skip these steps below and just try to remove the application in hopes that the associated conhost.exe virus gets removed too. Your best bet is to use a free uninstaller tool to make sure all of it gets deleted.

    1. Download Process Explorer and double-click (or tap-and-hold) the conhost.exe file you want to remove.
    2. From the Image tab, select Kill Process.
    3. Confirm with an OK.

      Note: If you get an error that the process cannot be shutdown, skip down to the next section below to run a virus scan.
    4. Press OK again to exit the Properties window.

    Now that the conhost.exe file is no longer attached to the parent program that started it, it's time to remove the fake conhost.exe file:

    Note: Follow the steps below in order, restarting your computer after each one and then checking to see if conhost.exe is really gone. To do that, run Task Manager or Process Explorer after each reboot to make sure the conhost.exe virus has been deleted.

    1. Try deleting conhost.exe. Open the folder from Step 4 above and just delete it like you would any file.

      Tip: You might also use Everything to do a full search across your whole computer to make sure the only conhost.exe file you see is in the \system32\ folder. You might actually find another in the C:\Windows\WinSxS\ folder but that conhost.exe file should not be what you find running in Task Manager or Process Explorer (it's safe to keep). You can safely delete any other conhost.exe imitation.
    1. Install Malwarebytes and run a full system scan to find and remove the conhost.exe virus.

      Note: Malwarebytes is just one program from our Best Free Spyware Removal Tools list that we recommend. Feel free to try the other ones in that list.
    2. Install a full antivirus program if Malwarebytes or another spyware removal tool doesn't do the trick. See our favorites in this list of Windows AV programs and this one for Mac computers.

      Tip: This should not only delete the fake conhost.exe file but will also to set up your computer with an always-on scanner that can help prevent viruses like this one from getting on your computer again.

    3. Use a free bootable antivirus tool to scan the whole computer before the OS even starts up. This will surely work to fix the conhost.exe virus since the process won't be running at the time of the virus scan.

    Was this page helpful?