What is conhost.exe? Is it legitimate or should I delete it?

The conhost.exe is required to run in order for Command Prompt to interface with Windows Explorer. Learn more here why you shouldn't delete this file.

When things start going wrong on your computer, your first instinct is probably to pull up the Task Manager and look for files that look like they don’t belong.

Among those files, one that often stands out the most is conhost.exe. 

However, conhost.exe is an important file that should always be running, regardless of which edition of Windows you are using.

To find out more about the file, read more below.

What is conhost.exe?

Conhost.exe is needed to run to allow Command Prompt to work with Windows Explorer. One of its features is that it gives you the ability to drag and drop files/folders straight into Command Prompt. If third parties need access to the command line they are also able to use conhost.exe.

Along with csrss.exe (ClientServer Runtime System Service) and cmd.exe (Command Prompt), it is a key part of run the windows you use on your computer. Conhost.exe is actually a relatively recent addition to this process. It was developed for Windows 7 to help ease some of the heavy burden put on the csrss.exe file.

What does it do?

Let’s talk about the actual conhost.exe process.

The specific job of conhost.exe is to shift some of the elements of running the system-level services from csrss.exe to allow for more customization and security.

By moving these elements, Windows can do more theme-related elements without risking the ever-important csrss.exe file getting corrupted.

Can you remove it?

Since conhost.exe is such an important file, you cannot remove it. Because it is so intimately connected to csrss.exe and cmd.exe, removing this file would mean your Windows operating system couldn’t function.

When you should worry about conhost.exe

There are, however, instances where you can and should remove a file called conhost.exe.

First, it’s important to point out that there’s no need to worry if you see multiple versions of the file in your Task Manager. Every time cmd.exe runs, a new conhost.exe should open. This can be true even if the program running that requires conhost.exe isn’t visibly open.

However, there are some reasons to be concerned if you see one of a few things. First, conhost.exe should use very little CPU or Memory.

  • If you see a conhost.exe file using either of those in a large amount, that’s the sign of a problem.
  • Some malware disguises itself by using the same file name as normal files in order to avoid detection.
  • If you are uncertain if a conhost.exe file is malware or not, right-click the suspect operation in your Task Manager and then click Open file location.

Any legitimate conhost.exe file will open in a Windows\System32 folder. If the file opens anywhere else, it is malware and should be removed.