Multiple instances of conhost.exe

Question

My desktop has two instances of conhost.exe running in the background at all times. Some googling brought up a few articles, like this one, but they don't explain why I have multiple instances of conhost running. I don't have any console windows open.

Here's a screenshot from Process Explorer:

I am cautious by nature. After a clean install of Windows 7, the first thing I did was turn up UAC, get an anti-virus, anti-malware and firewall up and running. I can't rule out a virus, but it's highly unlikely.

What's going on over here? What is that large number being passed as an argument to conhost?

Answer 1

Conhost runs console services for console windows. It is responsible for drawing the console window and for managing the input/output to the (normally invisible) console application.

Even though you don't have any console windows open, this is likely just a console window on another desktop or a zombie process that you're seeing - in normal Windows operation, conhost.exe is always started from csrss.exe which is a SYSTEM process - and this is the case in your picture which suggests that the conhost.exes are genuine.

If you're particularly worried that these might be malware pretending to be conhost, the best thing to do is to open Task Manager, navigate to the "Processes" tab, right click on the process you're worried about and select "Open File Location".

In the explorer window that opens up, right click on the application and click "View Properties" and look for a "Digital Signatures" tab. All Microsoft executables will have a Digital Signature verifying that the application is a genuine Microsoft application, and forging a Digital Signature is at least as hard as decrypting an SSL session between you and your bank, so you can rest assured that the executable is genuine.

In answer to the second part of your question, the large number being passed to conhost as an argument is a session ID that tells conhost.exe which console application it should be rendering on the screen - essentially it's the console application ID to connect to. The precise details of the number are specific to csrss which brokers the communication between the console application and conhost.exe.

Answer 2

I know bumping an old thread is not a good practice. But I reached here searching for the same problem. And found a reason and it might also be a solution.

In my case there were around a dozen conhost.exe, under the csrss.exe.

I know conhost.exe is for helping console applications but apart from once Command Prompt (cmd.exe) I had nothing running.

I found numerous possibilities in this thread that it might be related to 32-bit iTunes http://answers.microsoft.com/en-us/windows/forum/windows_7-security/multiple-instances-dozens-of-conhostexe-running/6e8c045f-8738-4e20-87e2-56d4360f1bd3

I have no iTunes installed. And looking through TaskManager & Process Explorer I found there was multiple VisualStudio 2012's msbuild.exe. Once I closed VS 2012 it all went away.

devenv.exe and MSBuild.exe are 32-bit programs

Answer 3

I found that my system had two conhost processes running at all times. I noticed that over time, running in my account would result in a growing number of other conhost processes.

It took me some time to search for the source, eliminating suspects like AutoHotKey and Console2. Eventually, I found that Visual Studio (2013) was creating these extra conhost processes, and they disappeared after I closed Visual Studio.

I left the two permanent conhost processes on my system alone, since they came from the SYSTEM Windows account.

Answer 4

My computer was acting slow with iexplorer tab renewals. I decided to check the windows task manager and noticed CPU usage at 14-15% and some of the processes constantly moving up and down. One of these was a second process of conhost.exe. It appeared as if it was running off and on. The conhost.exe process which was flashing on and off was associated with my logon id. I couldn't get the location of this file with right-click and locate file.

AVG-Free v14 process avgidagent.exe was monitoring the computer and causing the 14-15% CPU resource usage.

I also noticed mgusb.exe flashing on and off. An internet search identified this process as part of mobogenie and suggested to uninstall it as a solution to solve this problem. After uninstalling mobogenie (using "uninstall" from the control panel), both the second conhost.exe and mgusb.exe have been removed from the Task manager processes window and it appears to be normal.

CPU usage is back to normal at 0 - 3%. The processes don't constantly move up and down.

thanks for the people whom posted mobogenie information on the internet.

Answer 5

My Win7 laptop has two conhost processes running from boottime. Using ProcExp, looking at the lower window displaying Handles, I determined one was from wlanext.exe, and the other was one of the processes started by the Alps touchpad. It took me a while to figure out what spawned them, I just got in the habit of killing the processes after booting. They don't return until the next boot.

I assume they are for the purpose of opening the taskbar utilities for the touchpad and internet connection that I removed from startup. [Windows is much more reliable for managing internet connection, while the optional software that comes with network card drivers frequently causes problems. And I usually prefer a mouse, having set the system to disable touchpad when the mouse is present.]

Answer 6

From a website I googled...

After he explained why Console host was needed, because as old CSRSS was running at system level and a crash could bring the system down, as well as other vulnerabilities, they reworked the console and now it can be called by other apps as follows. They say it's normal to see many instances, usually. Their text is below.

You’ll often see several instances of the Console Window Host process running in Task Manager. Each instance of Command Prompt running will spawn its own Console Window Host process. In addition, other apps that make use of the command line will spawn their own Console Windows Host process—even if you don’t see an active window for them. A good example of this is the Plex Media Server app, which runs as a background app and uses the command line to make itself available to other devices on your network.

Many background apps work this way, so it’s not uncommon to see multiple instances of the Console Window Host process running at any given time. This is normal behavior. For the most part, each process should take up very little memory (usually under 10 MB) and almost zero CPU unless the process is active.

That said, if you notice that a particular instance of Console Window Host—or a related service—is causing trouble, like continual excessive CPU or RAM usage, you could check into the specific apps that are involved. That might at least give you an idea of where to start troubleshooting. Unfortunately, Task Manager itself doesn’t provide good information about this. The good news is that Microsoft provides an excellent advanced tool for working with processes as part of its Sysinternals lineup. Just download Process Explorer and run it—it’s a portable app, so no need to install it. Process Explorer provides all kinds of advanced features—and we highly recommend reading our guide to understanding Process Explorer to learn more.