Conhost.exe Information

I just noticed the process conhost.exe for the first time in Windows 7. Not sure if it was never there before or if I did not have the Windows Task Manager open at the time it was running on the operating system.

The properties of the conhost.exe process describe it as the Console Windows Host which suggests that it is linked to the command prompt somehow.

But is it safe? If conhost.exe is located in c:\windows\system32 then yes, it is safe. It never fails to check the file for malicious code on the other hand. You can do that for instance on the virustotal website. The process should disappear once the host process is closed in Windows. If that is the case it is fair to assume that it is not a virus that is responsible for the process.

After some testing I discovered that conhost.exe always appeared as a process when I played a video in SMPlayer. The process is killed immediately if the video player window is closed.

Conhost.exe will also appear as a process in the task manager if a command line prompt is opened in Windows 7. The process is always started if a command line window (hidden or visible) is launched in Windows 7.

Microsoft is using the conhost.exe process as a proxy between the crss process which was responsible for the command line in Windows XP & Windows Vista and the cmd.exe program itself. It ensures that the command line window is fully compatible with the theme of the operating system. Another feature that it introduces is the ability to drag and drop files from Windows Explorer directly into the command line prompt.

Related Articles:

Author: Martin Brinkmann, Friday May 7, 2010 -
Tags:conhost, conhost.exe, console windows host, process, windows process

Responses so far:

1. subgrampus says:

   May 8, 2010 at 1:58 am

   Martin, thanks for the ‘heads-up’. Now it won’t be suddenly noticed & mistaken for something that should not be there (a ‘bad’ thing, such as malware, etc.).
   -=)

   Reply