What is conhost.exe?

The .exe extension on a filename indicates an executable file. Executable files may, in some cases, harm your computer. Therefore, please read below to decide for yourself whether the conhost.exe on your computer is a Trojan that you should remove, or whether it is a file belonging to the Windows operating system or to a trusted application.

Click to Run a Free Scan for conhost.exe related errors

Conhost.exe file information

Windows Task Manager with conhost
Conhost.exe process in Windows Task Manager

The process known as Console Window Host or bitcoin-miner or Hôte de la fenêtre de la console or Host Process for Windows Services

belongs to software Microsoft Windows Operating System or Bitcoin Miner or Host Process for Windows Services or Système d’exploitation Microsoft Windows

by Microsoft ( or Ufasoft (

Description: Conhost.exe is not essential for Windows and will often cause problems. The conhost.exe file is located in a subfolder of the user's profile folder. Known file sizes on Windows 8/7/XP are 169,984 bytes (5% of all occurrences), 191,488 bytes and 58 more variants. 
It is a file with no information about its developer. The program is not visible. The file is not a Windows core file. The process is loaded during the Windows boot process (see Registry key: MACHINE\Run, Run, RunOnce, User Shell Folders, MACHINE\RunOnce, exefile, MACHINE\User Shell Folders). Conhost.exe is able to monitor applications. Therefore the technical security rating is 65% dangerous, however you should also read the user reviews.

Recommended: Identify conhost.exe related errors

Important: Some malware camouflages itself as conhost.exe, for example not-a-virus:RiskTool.Win32.BitCoinMiner.amv (detected by Kaspersky), and WS.Reputation.1 (detected by Symantec). Therefore, you should check the conhost.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.


User Comments

Console Window Host from Microsoft Windows Operating System (
conhost.exe is a Console Window Host, part of Microsoft Windows Operating System
  Mike   (further information)
  Der kleine Held  
When Windows 7 was released, conhost.exe (Console Window Host) was born and it solved everything with the groovy side effect of making the system much more stable. This process is a critical system file and should never be deleted.
  Pete J  
It's properties say it was created on the computer days ago but I never authorized it. Computer has been acting crazy all week and Anti-virus program is not working right but flags it.
One is a required file, the other is a trojan.
  Mike   (further information)
some AntiVirus tools marked it as trojan
it's part of windows
I know I have four of these and I dont think it´s normal.
There are two versions. One is a necessary and required file while the other is a virus. If more than one is found, you need to check which one/s is/are the virus.
Microsoft says it's part of the OS.
  tanstaafl   (further information)
conhost.exe is a Windows core file. Though malware does like to disguise itself as conhost...
    (further information)
there are several of them running 1.964K and 2.096K memory
Appears to be part of command prompt. Opens when I open 'cmd' from start menu.
If located in C:\Windows\System32 then it is normal and required. It is part of windows.
  Zenvidia   (further information)
While Conhost may be a Windows system file, it does not appear in task manager on machines in our office. Seeing conhost.exe running in the task manager is a sign for me that the user has malware running on their system. 90% of time, I can rid the system of the running malware, and when I do, conhost.exe no longer appears.
I have four (4) conhost.exe in my system. Three (3) of which are located in C:\Windows\WinSxS\amd64_microsoft-windows-consolehost... and the other on is located in C:\Windows\System32 2 files are unsigned (48 208 bytes)(w/o app info), while 2 are signed (367 616 bytes)
The file is in the system32 folder, but when I check the properties, it says Created: Thursday, September 19, 2013, and Modified: Thursday, august 1, 2013. How is it possible to modify a file before it was created?
I have Windows 8.1. Norton 360 Firewall does not seem to like it. I wanted to "End Task" it but it threatened to shut down my computer if I did.
  Michael Hill  
all I know is that my win 7 has slowed down to a pitiful speed. When I invetigated I found it was the only program I could not delete from my startup menu. I want to delete it even if it is not the slow down problem. jerry
  Jarl Plottner  
Gotta love it when people chime in but don't know about this. conhost.exe IS a MS file, BUT, it can also be used as a Trojan, and with this name, most people will just think "It's a Windows File.
Sometimes, viruses disguise themselves as conhost.exe. I have experienced it 2 months ago, what it does is that it removes explorer.exe from startup. If you are good at computers, you can easily bypass it, but removing it can get you at risk. So you can use an antivirus program like avast(which i used to remove it), kaspersky, etc.
If conhost.exe isn't being displayed in Task Manager as being in the System32 folder, it is a backdoor trojan, and darn near impossible to get rid of. I don't even know where it is in the file system.

Rating chart

Summary: Average user rating of conhost.exe: based on 45 votes with 23 user comments. 16 users think conhost.exe is essential for Windows or an installed application. 7 users think it's probably harmless. 3 users think it's neither essential nor dangerous. 11 users suspect danger. 8 users think conhost.exe is dangerous and recommend removing it. 4 users don't grade conhost.exe ("not sure about it").

Do you have additional information?
What do you know about conhost.exe:
How would you rate it:
Link for more info:
Your Name:

Best practices for resolving conhost issues

A clean and tidy computer is the key requirement for avoiding problems with conhost. This means running a scan for malware, cleaning your hard drive using cleanmgr and sfc /scannow, uninstalling programs that you no longer need, checking for Autostart programs (using msconfig) and enabling Windows' Automatic Update. Always remember to perform periodic backups, or at least to set restore points.

Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off doing a repair of your installation, or in the case of Windows 8, executing the DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.

To help you analyze the conhost.exe process on your computer, the following programs have proven to be helpful: Security Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. Malwarebytes Anti-Malware detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

Other processes

conhost.exe [all]