NIS 2010 17.8.0.5
Vista Home Premium 32 bit Vista SP2
OK I know that csrss.exe is an important file, but I have to ask if this activity is "normal"
When I shut down or restart my computer I notice this in the
Firewall Activity log of NIS Security History
"an instance of C:\Windows\System32\csrss.exe is preparing to access the internet"
the time of this entry is just before the computer shuts down
I know that the above entry may not really mean that csrss.exe is accessing the internet. But why does it even log as an activity just before shut down?
Plus there seems to be two instances showing in Task manager when I show processes for all users and both indicate user name as "system"
I check the file and it appears legit. I scanned it with NIS and its clean. The modification date coincides with the date and time of Vista SP 2 installation.
But again why would it be indicating activity just before machine shut down?