Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My desktop has two instances of conhost.exe running in the background at all times. Some googling brought up a few articles, like this one, but they don't explain why I have multiple instances of conhost running. I don't have any console windows open.

Here's a screenshot from Process Explorer:

Process Explorer screenshot

I am cautious by nature. After a clean install of Windows 7, the first thing I did was turn up UAC, get an anti-virus, anti-malware and firewall up and running. I can't rule out a virus, but it's highly unlikely.

What's going on over here? What is that large number being passed as an argument to conhost?

share|improve this question
1  
Some services and their helper programs are console applications that needs conhosts. –  billc.cn Dec 14 '11 at 23:10
    
Is there any way to find out which applications are spawning these conhost processes? –  George P. Burdell Dec 15 '11 at 16:46
add comment

4 Answers 4

up vote 6 down vote accepted

Conhost runs console services for console windows. It is responsible for drawing the console window and for managing the input/output to the (normally invisible) console application.

Even though you don't have any console windows open, this is likely just a console window on another desktop or a zombie process that you're seeing - in normal Windows operation, conhost.exe is always started from csrss.exe which is a SYSTEM process - and this is the case in your picture which suggests that the conhost.exes are genuine.

If you're particularly worried that these might be malware pretending to be conhost, the best thing to do is to open Task Manager, navigate to the "Processes" tab, right click on the process you're worried about and select "Open File Location".

In the explorer window that opens up, right click on the application and click "View Properties" and look for a "Digital Signatures" tab. All Microsoft executables will have a Digital Signature verifying that the application is a genuine Microsoft application, and forging a Digital Signature is at least as hard as decrypting an SSL session between you and your bank, so you can rest assured that the executable is genuine.

In answer to the second part of your question, the large number being passed to conhost as an argument is a session ID that tells conhost.exe which console application it should be rendering on the screen - essentially it's the console application ID to connect to. The precise details of the number are specific to csrss which brokers the communication between the console application and conhost.exe.

share|improve this answer
1  
In my case conhost.exe is running even when there are not console windows opened, from system startup (so when it can't be a leftout from a zombie shell process). Also it has not they typcal "c:\" icon in process explorer, but a generic icon. It sits under csrss.exe but if I right click and click properties I get in path: error opening process. If I click on "verify" it says, no digital signature found in file. In "user" it says "access denied". I am system administrator and I can't kill it... any advice please? Thanks –  jj_ Jan 12 at 20:40
    
@jj_, I see the same thing. Find out anything? –  Patrick Szalapski Apr 21 at 1:14
    
@PatrickSzalapski I wish I could help but basically I can't remember the specific steps I took to fix the issue and how they impacted it. I was monitoring the system for some time, scanned it for viruses/malware/trojans with couple of tools, uninstalled some stuff I didn't need which probably came with some startup services, then completely forgot about it.. And all of a sudden it was gone.. I can only advice to try to boot the system with barely minimum needed services and see what happens.. keep us posted though, it might be useful for everyone! Cheers –  jj_ Apr 22 at 13:35
add comment

I know bumping an old thread is not a good practice. But I reached here searching for the same problem. And found a reason and it might also be a solution.

In my case there were around a dozen conhost.exe, under the csrss.exe.

I know conhost.exe is for helping console applications but apart from once Command Prompt (cmd.exe) I had nothing running.

I found numerous possibilities in this thread that it might be related to 32-bit iTunes http://answers.microsoft.com/en-us/windows/forum/windows_7-security/multiple-instances-dozens-of-conhostexe-running/6e8c045f-8738-4e20-87e2-56d4360f1bd3

I have no iTunes installed. And looking through TaskManager & Process Explorer I found there was multiple VisualStudio 2012's msbuild.exe. Once I closed VS 2012 it all went away.

devenv.exe and MSBuild.exe are 32-bit programs

share|improve this answer
add comment

My computer was acting slow with iexplorer tab renewals. I decided to check the windows task manager and noticed CPU usage at 14-15% and some of the processes constantly moving up and down. One of these was a second process of conhost.exe. It appeared as if it was running off and on. The conhost.exe process which was flashing on and off was associated with my logon id. I couldn't get the location of this file with right-click and locate file.

AVG-Free v14 process avgidagent.exe was monitoring the computer and causing the 14-15% CPU resource usage.

I also noticed mgusb.exe flashing on and off. An internet search identified this process as part of mobogenie and suggested to uninstall it as a solution to solve this problem. After uninstalling mobogenie (using "uninstall" from the control panel), both the second conhost.exe and mgusb.exe have been removed from the Task manager processes window and it appears to be normal.

CPU usage is back to normal at 0 - 3%. The processes don't constantly move up and down.

thanks for the people whom posted mobogenie information on the internet.

share|improve this answer
add comment

This article could be useful if you want to kill unnecessary conhost processes

http://mnaoumov.wordpress.com/2013/03/09/kill-the-bill-w-conhost/

share|improve this answer
1  
instead of linking to another site, it would have been better to post the content here, unless your purpose is to create traffic for your site. Also, the suggestion is not suitable for SuperUser, because it is a code suggestion that most here would not know how to start. It would be fine on StackOverflow. –  teylyn Mar 8 '13 at 22:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.