*So What Is It? The conhost.exe process fixes a fundamental problem in the way previous versions of Windows handled console windows, which broke drag & drop in Vista. Its a completely legitimate executableas long as its running from the system32 folder, and is signed by Microsoft. Scanning your computer for viruses is never a bad idea, though. * Wait, What? So Why Do I Need It? Oh, you wanted more information? I suppose I can oblige with some background information. Essentially, theres a problem with the way the console process works on previous versions of Windowsthey are all hosted under the csrss.exe (Client Server Runtime Process) service. This process runs as a system-privileged account. If you take a look at the command prompt on Windows XP, youll probably notice that the window doesnt use the active theme at all. This is because the CSRSS process doesnt have the ability to be themed.

If you take a look at the console in Windows Vista, it looks like it uses the same theme as everything else, but youll notice that the scrollbars are still using the old style (look closely). This is because the DWM (Desktop Window Manager) process handles drawing the title bars, but underneath it still works the same way, and the scrollbars are part of the window itself. You might also notice that Windows Vista broke the ability to drag and drop files from Explorer straight into the command prompt. It just flat out doesnt work, because of security issues between the CSRSS process running with a higher level of privileges. * Windows 7 Does It Differently Checking it out in Process Explorer under Windows 7 shows that the conhost.exe process is running underneath the csrss.exe process. The conhost.exe process sitting in the middle between CSRSS and cmd.exe allows Windows 7 to fix both of the problems in previous versions of Windowsnot only do the scrollbars draw correctly, but you can actually drag and drop a file from Explorer straight into the command prompt: And itll paste in the path onto the command line. (of course this example isnt very useful). * Still Arent Convinced? I can see our relationship has some trust issues. If you really want to be sure, check out the file properties for the conhost.exe executable, and youll see that the description says Console Window Host: If you look at the details of the process from within Process Explorer, youll notice that the ComSpec is set to cmd.exe, a clear indication that its hosting the command prompt. So now you know what the conhost.exe process does, and why you should never attempt to delete it. Ever.

Lol i thought it was a virus !