Multiple instances of conhost.exe

Conhost runs console services for console windows. It is responsible for drawing the console window and for managing the input/output to the (normally invisible) console application.

Even though you don't have any console windows open, this is likely just a console window on another desktop or a zombie process that you're seeing - in normal Windows operation, conhost.exe is always started from csrss.exe which is a SYSTEM process - and this is the case in your picture which suggests that the conhost.exes are genuine.

If you're particularly worried that these might be malware pretending to be conhost, the best thing to do is to open Task Manager, navigate to the "Processes" tab, right click on the process you're worried about and select "Open File Location".

In the explorer window that opens up, right click on the application and click "View Properties" and look for a "Digital Signatures" tab. All Microsoft executables will have a Digital Signature verifying that the application is a genuine Microsoft application, and forging a Digital Signature is at least as hard as decrypting an SSL session between you and your bank, so you can rest assured that the executable is genuine.

In answer to the second part of your question, the large number being passed to conhost as an argument is a session ID that tells conhost.exe which console application it should be rendering on the screen - essentially it's the console application ID to connect to. The precise details of the number are specific to csrss which brokers the communication between the console application and conhost.exe.

I know bumping an old thread is not a good practice. But I reached here searching for the same problem. And found a reason and it might also be a solution.

In my case there were around a dozen conhost.exe, under the csrss.exe.

I know conhost.exe is for helping console applications but apart from once Command Prompt (cmd.exe) I had nothing running.

I found numerous possibilities in this thread that it might be related to 32-bit iTunes http://answers.microsoft.com/en-us/windows/forum/windows_7-security/multiple-instances-dozens-of-conhostexe-running/6e8c045f-8738-4e20-87e2-56d4360f1bd3

I have no iTunes installed. And looking through TaskManager & Process Explorer I found there was multiple VisualStudio 2012's msbuild.exe. Once I closed VS 2012 it all went away.

devenv.exe and MSBuild.exe are 32-bit programs

I found that my system had two conhost processes running at all times. I noticed that over time, running in my account would result in a growing number of other conhost processes.

It took me some time to search for the source, eliminating suspects like AutoHotKey and Console2. Eventually, I found that Visual Studio (2013) was creating these extra conhost processes, and they disappeared after I closed Visual Studio.

I left the two permanent conhost processes on my system alone, since they came from the SYSTEM Windows account.