Some processes, like firefox.exe or explorer.exe can be identified immediately by their name while others, like taskhost.exe or dwm.exe, require research to find out what the processes are about.

Taskhost.exe is a generic host process for Windows 7 32-bit services. The location in Windows needs to be taskhost.exe is C:\Windows\System32\Taskhost.exe.

Taskhost.exe is a generic process that acts as a host for processes that run from dynamic link libraries (dll) instead of exe. The process checks the Windows Registry on startup to discover dll-based services that need to be loaded. Several instances of taskhost.exe can be running on the same computer system which is still no cause for concern if the taskhost.exe is located in system32 of the Windows operating system.

Taskhost.exe is therefor a core system process of the Windows 7 operating system.

Users who want to analyze the process further to find out which dll-based services are executed by it should install Process Explorer for that task. The free program will display additional information about the underlying dll-based services.

Some of those are core services that cannot be disabled while others might run dlls that are not necessarily needed. Process Explorer will list the information that are needed to identify those components. It might be necessary to use a search engine to find additional information about a specific dll. Some Windows 7 users have for instance noticed high cpu usage problems with the RACtask (Windows Reliability Monitor) that is run by taskhost.exe.

The properties of the conhost.exe process describe it as the Console Windows Host which suggests that it is linked to the command prompt somehow.

But is it safe? If conhost.exe is located in c:\windows\system32 then yes, it is safe. It never fails to check the file for malicious code on the other hand. You can do that for instance on the virustotal website. The process should disappear once the host process is closed in Windows. If that is the case it is fair to assume that it is not a virus that is responsible for the process.

After some testing I discovered that conhost.exe always appeared as a process when I played a video in SMPlayer. The process is killed immediately if the video player window is closed.

Conhost.exe will also appear as a process in the task manager if a command line prompt is opened in Windows 7. The process is always started if a command line window (hidden or visible) is launched in Windows 7.

Microsoft is using the conhost.exe process as a proxy between the crss process which was responsible for the command line in Windows XP & Windows Vista and the cmd.exe program itself. It ensures that the command line window is fully compatible with the theme of the operating system. Another feature that it introduces is the ability to drag and drop files from Windows Explorer directly into the command line prompt.

A hard to tame application like googleupdate.exe could cause a notification every other second or so which could be really annoying as there is no obvious way to disable the notifications in the review copy.

SPKiller is a similar application that can block processes and services in the Windows operating system. The installation itself requires more work than the usual double-click on a setup file. The installation will simply place the files of the program in a directory on the computer’s hard drive. The user has to click on InstallService.bat to install the Windows Service. After that the Service needs to be started in the Windows Services Overview.

The Windows Process and Services blocker is configured with a simply XML file that is located in the program’s installation directory. The configuration is not more complicated than editing a text document. It is made up of three sections that are of importance to the user. The first is called CycleTime and defines the interval in milliseconds that the running services and processes are checked. ServiceNames contains a list of Windows Services that should be blocked if running while ProcessNames does the same for Windows processes.

The configuration file contains a few example services and processes mainly from McAfee but also Radia in the ServiceNames configuration and annoying processes like GoogleToolbarNotifier or AppleMobileDeviceService in the ProcessNames listing.

SPKiller works well as a process blocker in Windows especially since it blocks both processes and services on the computer system.

Update: SPKiller is no longer available. The developer website and product have been discontinued.

Monitored Windows processes get killed at the moment after they are started instead of being blocked outright so that even a start is not possible anymore. A few small scripts can slip through at the moment because of this behavior as it takes some time to recognize a newly launched application and send the kill command to the computer system.

Process Blocker uses a simple text file that is placed in the same installation directory as the main application. This text file contains names of executables that are not allowed to be launched on a computer system. The program itself is added as a Windows Service to the system which has to be restarted after making changes to the text file.

Process Blocker will display a user notification in the Windows System Tray whenever a process has been blocked by the service. A similar application that provides a better user experience is the process manager Process Lasso. The developers of Process Blocker on the other hand are not even halfway through their roadmap. The next step will move the management of processes from the text file to a Group Policy administrative template. Other planned features are killing processes and applications using its crc (in case they get renamed) or full path, recording process errors and information in Windows Event log, allowing users to only run applications from specified folders (e.g. program files and Windows) and changing process killing to process execution prevention.