[SOLVED] 2 of the same process running question

Status
Not open for further replies.

Arbiter051

Distinguished
Mar 28, 2016
375
4
18,795
I see that fontdrvhost.exe is running twice. It is in the system32 folder so I am not worried.

what I am unsure of is why are there 2. They are literally the exact same file. I see the same for rundll32 dllhost and csrss. I googled csrss and i found 2 copies of csrss is normal but the other 3 I can’t find anything.

Just wanting to ask why this is, thank you.
 
Solution
Right click on them, go to information and see if its copyrighted to microsoft.

Fontdrvhost.exe is a Windows system process. Also known as Usermode Font Driver Host, the fontdrvhost.exe process is responsible for managing fonts on your Windows system. It’s around 802KB in size (as of Windows 10 version 1909) and is typically found in the System32 folder.

In early 2020 Microsoft increased security of this executable, and it now runs in an AppContainer. This means that, if this process gets hijacked by malware, it can only breach the container, not the whole kernel. Before fontdrvhost.exe ran within the core and, if hijacked, could potentially risk the security of the entire system.

In Task Manager under tab...

Colif

Win 11 Master
Moderator
Right click on them, go to information and see if its copyrighted to microsoft.

Fontdrvhost.exe is a Windows system process. Also known as Usermode Font Driver Host, the fontdrvhost.exe process is responsible for managing fonts on your Windows system. It’s around 802KB in size (as of Windows 10 version 1909) and is typically found in the System32 folder.

In early 2020 Microsoft increased security of this executable, and it now runs in an AppContainer. This means that, if this process gets hijacked by malware, it can only breach the container, not the whole kernel. Before fontdrvhost.exe ran within the core and, if hijacked, could potentially risk the security of the entire system.

In Task Manager under tab Details and locating fontdrvhost.exe, you will on updated Windows 10 systems see that the executable runs under user name UMFD-0.


have you run an antivirus scan or malware? I can see one case of it being an infection

i hope its normal, I have 2
iqkCkZh.jpg


its common to find windows files running twice or in multiple locations. There are at least 8 copies of explorer on a normal install.
csrss = client server = your user environment
it can run multiple times as well, I have it running twice
rundll is the same. Some processes are used by multiple different programs at once.
runtimebroker running 5 times right now.
and there is a service host for almost every service now.

Its normal.
 
Last edited:
Solution

Arbiter051

Distinguished
Mar 28, 2016
375
4
18,795
Right click on them, go to information and see if its copyrighted to microsoft.






have you run an antivirus scan or malware? I can see one case of it being an infection

i hope its normal, I have 2
iqkCkZh.jpg


its common to find windows files running twice or in multiple locations. There are at least 8 copies of explorer on a normal install.
csrss = client server = your user environment
it can run multiple times as well, I have it running twice
rundll is the same. Some processes are used by multiple different programs at once.
runtimebroker running 5 times right now.
and there is a service host for almost every service now.

Its normal.

I have and they all are. Also did a virus scan with 2 different second opinion. Both found nothing.

I figured it was normal but just wanted to make sure. Tyvm for your answer. Makes me wonder what triggers them in the first place haha.
 
Status
Not open for further replies.