# prevhost.exe

Windows Process: Microsoft Corporation

Also called prevhost, preview handler host, preview pane host

Windows, System Component

Preview Handler Host. Explorer loads IPreviewHandler objects here so a preview crash does not take down explorer.exe.

## What you need to know

prevhost isolates preview handlers so a PDF preview crash does not kill Explorer.

prevhost.exe is the surrogate host for Explorer preview handlers. The preview pane loads IPreviewHandler in this process on purpose. explorer.exe stays the shell. Outlook can use the same isolation idea. Ending prevhost blanks the pane, not the desktop.

- **Safe?**: Yes. It isolates preview

  **Same as Explorer?**: No. Explorer is the shell

  **Crash on a PDF?**: The handler died, not the desktop

Feex says

If Explorer keeps running and only the preview pane goes white, I treat that as prevhost doing the job. I turn the pane off as a test before I restart the whole shell.

## What is prevhost.exe?

prevhost.exe is the Preview Handler Host. Explorer asks it to load an IPreviewHandler so a PDF or Office preview crash does not kill explorer.exe. It is not Explorer.

## What does it do?

It hosts the preview DLL for the selected file type. The folder window, taskbar, and desktop stay in explorer.exe. Search preview is not SearchFilterHost.

## Why is it running?

The preview pane (Alt+P) or a similar viewer asked for a preview. Two copies can exist: one low integrity, one for handlers that opted out. No pane means this host should be idle.

## Why are there multiple copies?

Two prevhost.exe copies can exist, one at low integrity and one for handlers that opted out. explorer.exe is still the shell, not the preview host.

## Is it safe?

Usually safe

System32 prevhost.exe is the Microsoft surrogate. A prevhost.exe in a codec pack is not. A crash here is the preview handler, not proof Explorer is infected.

A legitimate copy normally runs from:

`C:\Windows\System32\prevhost.exe`

- IPreviewHandler isolation
- Explorer remains explorer.exe
- Low IL by default for handlers

## Can I end it?

Preview pane goes blank

Ending prevhost.exe unloads that preview. Explorer should keep the window. That is the opposite of ending explorer.exe, which drops the shell.

## Can I remove it?

No

Do not delete prevhost.exe. Turn off the preview pane or remove the bad preview handler. Deleting explorer.exe is also wrong.

## Should it start with Windows?

Opening a preview starts it. It is not a Startup Apps entry.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: A heavy PDF or CAD preview can spike this host

  **Memory**: Follows the handler

  **Disk**: Reads the file being previewed

  **Network**: If the file is on a UNC path

## File information

| Executable name        | prevhost.exe                     |
| ---------------------- | -------------------------------- |
| Common legitimate path | C:\Windows\System32\prevhost.exe |
| Publisher              | Microsoft Corporation            |
| Signature expectation  | Signed by Microsoft Windows      |

## Common problems

### Preview pane crash loop on one extension

That extension's IPreviewHandler is bad. Explorer staying up is isolation working. Disable the pane or update that previewer.

### People restart Explorer for a white pane

End prevhost first. Restarting the shell is a wider hammer than the host was designed for.

## Troubleshooting

Diagnose before you change anything destructive.

### Alt+P to turn the preview pane off as a test

If Explorer then stays calm, the handler is the bug. Update the PDF or Office previewer. Do not replace explorer.exe.

### Note the file type that kills the pane

The handler is registered per extension. SearchFilterHost parsing for the index is a different isolation box.

## Technical details

Technical details

| Image name | prevhost.exe                   |
| ---------- | ------------------------------ |
| Role       | IPreviewHandler surrogate host |

## Related

These entities connect to this article. Type is shown on every link.

[explorer.exe: Windows Process](https://feex.it/wiki/process/explorer.exe)[What is a Windows process: Guide](https://feex.it/wiki/software/system/what-is-a-windows-process)[How to read Task Manager: Guide](https://feex.it/wiki/software/system/how-to-read-task-manager)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: preview handlers ](https://learn.microsoft.com/windows/win32/shell/preview-handlers)· Prevhost.exe is the out-of-process surrogate
- [Microsoft Learn: building preview handlers ](https://learn.microsoft.com/windows/win32/shell/building-preview-handlers)· Handlers run out of process from Explorer
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: prevhost.exe

  **Typical path**: C:\Windows\System32\prevhost.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

  **Related process**: [explorer.exe](https://feex.it/wiki/process/explorer.exe)

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/prevhost.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)