GoogleCrashHandler.exe is such a process. I recently saw it running on my system and decided to find out why it was running, and how it could be disabled.

Let me start by showing you how you can find out if the process is running on your system.

Press Ctrl-Alt-Esc to open the Windows Task Manager. Switch to the processes tab on the tabbar to see a snapshot of processes that run on your computer system. I suggest you click on the Image Name column header to sort processes alphabetically. Now go down the list and see if you find GoogleCrashHandler.exe as a process there.

The path points to the Google directory under Application Data. The name alone suggests that it is linked to Google software installed on the system. Some users might think that it is caused by Google Chrome installations on the system. While that is true, it is not the only Google desktop application that installs the GoogleCrashHandler.exe on the system.

Google has the following to say about the process:

GoogleCrashHandler.exe runs continuously on your computer if you’ve selected to send anonymous usage statistics and crash reports to Google for certain Google software, like Google Chrome. It helps send crash details to Google when your Google software unexpectedly shuts down. We use this data to help determine how to prevent these errors from happening in the future.

The process runs on the system if usage statistics and crash reports are send to Google which means it is a monitoring tool that sends information from your computer to Google.

You need to disable the monitoring of your browsing and the report sending in all Google applications that support the feature to completely remove GoogleCrashHandler.exe.

An example. I run Google Chrome Canary and Google Chrome Dev on my system. If I disable the setting “Automatically send usage statistics and crash reports to Google” in the Canary version but not the Dev version, then GoogleCrashHandler.exe keeps on running on the system.

The process is only removed from running on the system if I disable the setting in both Chrome versions.

Remove GoogleCrashHandler.exe

Here is how you do that. Open Google Chrome and enter chrome://settings/advanced in the address bar of the browser. You can alternatively click on the Wrench icon and select Options > Under the Hood.

Locate the setting Automatically send usage statistics and crash reports to Google under Privacy and remove the checkmark from it. There is no save button, just close the page once you have removed the checkmark.

If this is your only Google desktop application then GoogleCrashHandler.exe should disappear from the process listing after a few seconds. If it is not, you need to find a similar looking setting in another Google product on your system.

I just found out that I have written about that process back in 2009 for the first time. The problem with GoogleCrashHandler.exe is that you may inadvertently install it again whenever you install a new Google application.

The option to submit anonymous usage statistics is enabled by default when you download the Google Chrome installer. It is likely that the majority of Windows Chrome users have GoogleCrashHandler.exe running on their system because of this.

The only way to prevent the installation of the process is to pay extra attention to Google download pages. You may alternatively disable JavaScript on those pages, as the option to collect anonymous usage statistics is then disabled on the page.

Is GoogleCrashHandler.exe running on your system?

The properties of the conhost.exe process describe it as the Console Windows Host which suggests that it is linked to the command prompt somehow.

But is it safe? If conhost.exe is located in c:\windows\system32 then yes, it is safe. It never fails to check the file for malicious code on the other hand. You can do that for instance on the virustotal website. The process should disappear once the host process is closed in Windows. If that is the case it is fair to assume that it is not a virus that is responsible for the process.

After some testing I discovered that conhost.exe always appeared as a process when I played a video in SMPlayer. The process is killed immediately if the video player window is closed.

Conhost.exe will also appear as a process in the task manager if a command line prompt is opened in Windows 7. The process is always started if a command line window (hidden or visible) is launched in Windows 7.

Microsoft is using the conhost.exe process as a proxy between the crss process which was responsible for the command line in Windows XP & Windows Vista and the cmd.exe program itself. It ensures that the command line window is fully compatible with the theme of the operating system. Another feature that it introduces is the ability to drag and drop files from Windows Explorer directly into the command line prompt.

The software program works with a so called hitlist that is configured in the program’s settings. The hitlist basically contains names of processes that the user wants to include in the kill command. New processes can be added from the list of running processes that are displayed in an extra tab in the program or by entering the name of the process manually in a comma separated list in the interface or the hitlist.txt file directly.

All it takes to kill all processes that are listed in the hit list is to double-click the program icon of Auto Kill Any Process. This is a manual process and users who want to automate it need to use different applications like Kill Process (see: Batch Kill Processes with Kill Process) or Process Lasso (see: Process Lasso a Process Manager).

The configuration can be changed at anytime by launching the settings shortcut of the program. Auto Kill Any Process requires the Microsoft .net Framework 2.0. It should be compatible with most versions of Microsoft Windows and was tested on a system running Windows XP SP3. The download is available at the developer’s website.

I never experienced the behavior on my old computer though and it seemed as if the process would not go away on its own. It was there, eating my CPU cycles even after quitting the program installation.

Apparently mscorsvw.exe is precompiling .NET assemblies in the background which can take anywhere from 5 to 10 minutes and then some more for low priority assemblies. So the easiest way to get through it is by sitting it out.

If you want to get rid of it completely immediately you could issue the command ngen.exe executequeueditems. Ngen.exe is located in the Microsoft .net Framework directory in the Windows dir.

Kill Process is a process manager developed by Orange Lamp Software Solutions. The main purpose of the application is to provide the user with means to kill several processes at once and it can also prevent that new blocked processes are spawned on the system. That second feature comes in handy in numerous other occasions, more about that later.

The main interface of Kill Process displays a list of all processes that are currently running on the system. The list contains information about each process that includes its name, description and memory usage. Detailed process information are available by selecting the process and hitting enter or right-clicking it and selecting Process Information from the menu.

Processes are automatically added to the kill list once they have been marked for termination. The kill list can contain multiple processes that can be batch killed easily. This comes in very handy if you want to kill processes that spawn another instance of related processes. If you only use this feature Kill Process stops after killing the selected processes, even if a new process that is in the kill list spawns.

This can be prevented by the second feature of Kill Process: Process Scanning. If you activate Process Scanning Kill Process with actively scan the system for processes in the kill list and terminate those processes as soon as they appear as a process. The time between scans can be defined which is essential to prevent cpu overload.

This feature comes in handy in a number of occasions. Say you want to get rid of that dreaded ctfmon.exe or other processes that appear every time Windows starts and you do not know how to suppress them. It is also possible to prevent that applications that you start spawn new processes.

Kill Process can be configured to run silently in the background by suppressing all errors and disabling confirmations.

The first step was to download the excellent Process Explorer from Sysinternals. This program gives detailed information on all processes currently running on the system including services and files that depend on it as well as the path to the file on the operating system.

All processes that are running on the system are displayed in Process Explorer after starting the application. Press CTRL + L to display a pane at the bottom that displays extensive information about the selected process. Moving the mouse over the process displays information as well but not in depth like the bottom pane does.

Lets take a quick look at what Wikipedia has to say about svchost.exe

In software Svchost.exe is a generic host process name for services that run from dynamic-link libraries (DLLs) within modern versions of the Microsoft Windows operating system.

At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging, but it also causes some difficulty for end users wishing to see the memory usage or vendor legitimacy of individual services and processes.

The last sentence explains pretty much the dilemma that we – the users – are in. How can we figure out if a svchost.exe process is legit and needed or a waste of memory, processing power or even malicious ?

I’m going to explain how you can find out with a good certainty if the process is needed or not. Back to Process Explorer.

Hover the mouse over the first svchost process and take a look at what it is saying. It should display the path plus the services that started this svchost process.

My first service was the HTTP SSL service that was running on my system. A service that is not needed at all on my system. I first thought it had something to do with the ability to open https websites but this is not the case. Completely useless for end users. I opened services.msc and stopped the service and set it to disabled as well.

The svchost process disappeared in Process Explorer. To test that everything was still working I opened a https url in Firefox which was working perfectly fine.

The next svchost.exe process was running because of the Windows Image Acquisition service. I do have a camera that is using this service but I seldom transfer pictures from the camera to my system. I decided to disable and stop this service as well and activate it whenever I want to transfer images. And puff there vanished the second svchost process.

What I did was always the same for every remaining svchost process. Hover the mouse over it, type the service in question into a search engine, read up on it and make a decision if I really needed it. Users who want to be on the safe side stop the service and test if everything is still working as usual. They could alternatively set the service to manual if first tests are successful.

The only application that I did install the other day was NBC Direct. A quick check of the NBC Direct FAQ revealed that they were indeed using the OpenCASE Media Agent “that manages your video downloads and monitors for any updates and/or new content to be downloaded”.

This means that this thirty Megabyte process MediaAgent.exe is wasting RAM and CPU cycles for doing nothing most of the time. I can understand that this process is started when starting NBC Direct but not if NBC Direct is not running at all.

The OpenCase Media Agent is a service that is installed with NBC Direct in Windows that is automatically started when Windows starts. The option would be to either disable the service which would surely make NBC Direct stop working or uninstall both NBC Direct and the OpenCase Media Agent to get rid of it.

Config Inspector is a nice little freeware application for windows operating systems that could be described as an advanced task manager. Besides offering more information about loaded applications and processes it also displays vital information about memory and cpu usage, network utilization and general windows information.

A nice handy utility which is only 125K zipped. Just unpack and run, no installation required.

ConfigInspector: The Next Generation of Windows Task Manager

For the average user, Windows Task Manager probably doesn’t come into play very much at all, though this is just a guess. Users who are more particular and curious from moderate to advanced abilities are definitely familiar with Task Manager. It is a go-to for controlling application usage, active process identification, observation of services and performance and CPU usage among other things. From the Task Manager, the user is able to terminate processes and applications that are unnecessary or interfering with other applications.

ConfigInspector is a free utility that displays the most pertinent information about your operating system. It is like Task Manager on steroids. For the user who utilizes Windows Task Manager regularly, this is a must-have utility. It is more precise than Task Manager and offers more features, yet you still have the control that you normally would, if not more. The specific features that it offers, as per the specs, are as follows:

Displays list of working applications;
Displays list of working processes;
Monitors the memory status;
Monitors the CPU and network utilization;
Displays the full list of CPU capabilities;
Displays important Windows OS parameters;
Displays Windows Network parameters;
Displays HDD status and information;
Displays videocard information;
Displays soundcard information;
ConfigInspector works under Windows 2000/XP/2003 only.

The last part is interesting. “ConfigInspector works under Windows 2000/ XP/2003 only. It works under Windows 7 as well. Perhaps that is because many XP applications are compatible with Windows 7. There is no mention of Vista compatibility at the download site. To examine the capabilities of ConfigInspector, download the .zip free version from this link.

Double-click the .exe file to extract and ConfigInspector opens immediately without any installation. It is a stand-alone utility that can be turned on and off as needed, though it would be reasonable to assume that the advanced user would use it on a regular basis and perhaps leave Windows Task Manager aside.
For example, here is a screenshot of the CPU usage monitor:

There is a constant and indelibly accurate readout of CPU Load and Kernel Usage. Load is indicated by the green line and Kernel is indicated by the red. You will see rapid and continuous fluctuations every second. This CPU is running 12 applications at once, so it is interesting to see the activity.

Specific activity can be identified with ConfigInspector for Applications, Processes, CPU Usage, Memory, Network Utilization, CPU, Windows, Machine, Display, Media, Network and IDE/Drives. All of these are tabs in the utility and each can be appropriately manipulated as needed. The following screenshot shows the Memory tab:

It is visible, right down to the exact number of bytes, how the memory is allocated. This is definitely a pristine diagnostic tool. As stated, the PC used in the demonstration is running 12 applications so there is a great deal of activity and only 16% of the Physical Memory is free at the time of the screenshot.

Much can be ascertained and controlled with this utility and it is certainly worth taking for a test drive. In terms of memory, it only occupies 125KB, so there is nothing to lose – just much to see.