My desktop has two instances of conhost.exe running in the background at all times. Some googling brought up a few articles, like this one, but they don't explain why I have multiple instances of conhost running. I don't have any console windows open.

Here's a screenshot from Process Explorer:

Process Explorer screenshot

I am cautious by nature. After a clean install of Windows 7, the first thing I did was turn up UAC, get an anti-virus, anti-malware and firewall up and running. I can't rule out a virus, but it's highly unlikely.

What's going on over here? What is that large number being passed as an argument to conhost?

  • 2
    Some services and their helper programs are console applications that needs conhosts.
    – billc.cn
    Commented Dec 14, 2011 at 23:10
  • 1
    Is there any way to find out which applications are spawning these conhost processes? Commented Dec 15, 2011 at 16:46
  • Stopping Serviio and Plex media servers and immediately ended conhost.exe processes for me.
    – user458148
    Commented Jun 12, 2015 at 14:00
  • 2
    I've like hundreds of them.
    – kenorb
    Commented Oct 1, 2016 at 8:29
  • I have hundreds too.
    – Moss
    Commented Jun 29, 2019 at 5:17

6 Answers 6


Conhost runs console services for console windows. It is responsible for drawing the console window and for managing the input/output to the (normally invisible) console application.

Even though you don't have any console windows open, this is likely just a console window on another desktop or a zombie process that you're seeing - in normal Windows operation, conhost.exe is always started from csrss.exe which is a SYSTEM process - and this is the case in your picture which suggests that the conhost.exes are genuine.

If you're particularly worried that these might be malware pretending to be conhost, the best thing to do is to open Task Manager, navigate to the "Processes" tab, right click on the process you're worried about and select "Open File Location".

In the explorer window that opens up, right click on the application and click "View Properties" and look for a "Digital Signatures" tab. All Microsoft executables will have a Digital Signature verifying that the application is a genuine Microsoft application, and forging a Digital Signature is at least as hard as decrypting an SSL session between you and your bank, so you can rest assured that the executable is genuine.

In answer to the second part of your question, the large number being passed to conhost as an argument is a session ID that tells conhost.exe which console application it should be rendering on the screen - essentially it's the console application ID to connect to. The precise details of the number are specific to csrss which brokers the communication between the console application and conhost.exe.

  • 1
    In my case conhost.exe is running even when there are not console windows opened, from system startup (so when it can't be a leftout from a zombie shell process). Also it has not they typcal "c:\" icon in process explorer, but a generic icon. It sits under csrss.exe but if I right click and click properties I get in path: error opening process. If I click on "verify" it says, no digital signature found in file. In "user" it says "access denied". I am system administrator and I can't kill it... any advice please? Thanks
    – red-o-alf
    Commented Jan 12, 2014 at 20:40
  • @jj_, I see the same thing. Find out anything? Commented Apr 21, 2014 at 1:14
  • @PatrickSzalapski I wish I could help but basically I can't remember the specific steps I took to fix the issue and how they impacted it. I was monitoring the system for some time, scanned it for viruses/malware/trojans with couple of tools, uninstalled some stuff I didn't need which probably came with some startup services, then completely forgot about it.. And all of a sudden it was gone.. I can only advice to try to boot the system with barely minimum needed services and see what happens.. keep us posted though, it might be useful for everyone! Cheers
    – red-o-alf
    Commented Apr 22, 2014 at 13:35
  • 1
    If @jj_ comes back or anyone else comes along: ProcessExplorer must be elevated to display full info like commandline and exe-properties for system and service processes (and kill them); start from shortcut or menu entry or search result with rightclick-RunAsAdministrator or search box with control-shift-enter or when already running goto File menu and click Show Details For All Processes. Commented Oct 16, 2015 at 6:17
  • In my case, I knew that :) but it's still worth pointing it out!
    – red-o-alf
    Commented Oct 17, 2015 at 7:30

I know bumping an old thread is not a good practice. But I reached here searching for the same problem. And found a reason and it might also be a solution.

In my case there were around a dozen conhost.exe, under the csrss.exe.

I know conhost.exe is for helping console applications but apart from once Command Prompt (cmd.exe) I had nothing running.

I found numerous possibilities in this thread that it might be related to 32-bit iTunes http://answers.microsoft.com/en-us/windows/forum/windows_7-security/multiple-instances-dozens-of-conhostexe-running/6e8c045f-8738-4e20-87e2-56d4360f1bd3

I have no iTunes installed. And looking through TaskManager & Process Explorer I found there was multiple VisualStudio 2012's msbuild.exe. Once I closed VS 2012 it all went away.

devenv.exe and MSBuild.exe are 32-bit programs


I found that my system had two conhost processes running at all times. I noticed that over time, running in my account would result in a growing number of other conhost processes.

It took me some time to search for the source, eliminating suspects like AutoHotKey and Console2. Eventually, I found that Visual Studio (2013) was creating these extra conhost processes, and they disappeared after I closed Visual Studio.

I left the two permanent conhost processes on my system alone, since they came from the SYSTEM Windows account.


My computer was acting slow with iexplorer tab renewals. I decided to check the windows task manager and noticed CPU usage at 14-15% and some of the processes constantly moving up and down. One of these was a second process of conhost.exe. It appeared as if it was running off and on. The conhost.exe process which was flashing on and off was associated with my logon id. I couldn't get the location of this file with right-click and locate file.

AVG-Free v14 process avgidagent.exe was monitoring the computer and causing the 14-15% CPU resource usage.

I also noticed mgusb.exe flashing on and off. An internet search identified this process as part of mobogenie and suggested to uninstall it as a solution to solve this problem. After uninstalling mobogenie (using "uninstall" from the control panel), both the second conhost.exe and mgusb.exe have been removed from the Task manager processes window and it appears to be normal.

CPU usage is back to normal at 0 - 3%. The processes don't constantly move up and down.

thanks for the people whom posted mobogenie information on the internet.


My Win7 laptop has two conhost processes running from boottime. Using ProcExp, looking at the lower window displaying Handles, I determined one was from wlanext.exe, and the other was one of the processes started by the Alps touchpad. It took me a while to figure out what spawned them, I just got in the habit of killing the processes after booting. They don't return until the next boot.

I assume they are for the purpose of opening the taskbar utilities for the touchpad and internet connection that I removed from startup. [Windows is much more reliable for managing internet connection, while the optional software that comes with network card drivers frequently causes problems. And I usually prefer a mouse, having set the system to disable touchpad when the mouse is present.]

  • You have answered a question which is years old and already has an accepted answer. While this is not forbidden or wrong of you to do so, you should be aware you are not likely to get a response or have your answer accepted. That being said; you have done a good job of explaining your experience. By way of improvement, it is advisable to backup your answers with some sort of source to validate your point. It isn't mandatory, but it helps.
    – CharlieRB
    Commented Feb 9, 2016 at 15:17

From a website I googled...

After he explained why Console host was needed, because as old CSRSS was running at system level and a crash could bring the system down, as well as other vulnerabilities, they reworked the console and now it can be called by other apps as follows. They say it's normal to see many instances, usually. Their text is below.

You’ll often see several instances of the Console Window Host process running in Task Manager. Each instance of Command Prompt running will spawn its own Console Window Host process. In addition, other apps that make use of the command line will spawn their own Console Windows Host process—even if you don’t see an active window for them. A good example of this is the Plex Media Server app, which runs as a background app and uses the command line to make itself available to other devices on your network.

Many background apps work this way, so it’s not uncommon to see multiple instances of the Console Window Host process running at any given time. This is normal behavior. For the most part, each process should take up very little memory (usually under 10 MB) and almost zero CPU unless the process is active.

That said, if you notice that a particular instance of Console Window Host—or a related service—is causing trouble, like continual excessive CPU or RAM usage, you could check into the specific apps that are involved. That might at least give you an idea of where to start troubleshooting. Unfortunately, Task Manager itself doesn’t provide good information about this. The good news is that Microsoft provides an excellent advanced tool for working with processes as part of its Sysinternals lineup. Just download Process Explorer and run it—it’s a portable app, so no need to install it. Process Explorer provides all kinds of advanced features—and we highly recommend reading our guide to understanding Process Explorer to learn more.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .