What is Csrss.exe? 2 process are seen in task manager?

Norton Security | Norton Internet Security
1

Ok, I'm back AGAIN.

So yeah anyway I am just looking in task manager (Win Vista) and I notice Csrss.exe, there is 2 of them.

So it goes like:

  Csrss.exe | System | 00 | 916K | Client Runtime Server Process

  Csrss.exe | System | 00 | 4840K | Client Runtime Server Process

I googled it and I am worried as some are saying Trojan and some are saying other stuff, I have looked under System32 folder and there is Csrss.exe in there.

But I don't understand why there's 2 of them in task manager.

I have Norton 360 V3, and Malware Bytes Anti-Malware.

I have run scans recently and all has been ok.

 

Can someone please confirm that these aren't a virus or trojan or anything that shouldn't be there?

Thanks in advance, George.

 

P.s I have 70 processes running as well which is quite alot...

 

<<edit: subject edited for clarity>>

Message Edited by JerryM on 11-06-2009 09:36 AM
2

The Microsoft Client Server Runtime Server subsystem utilizes the process csrss.exe for managing the majority of the graphical instruction sets under the Microsoft Windows operating system. As such Csrss.exe provides the critical functions of the operating system, and its termination can result in BSOD. In mobile devices such as notebooks and laptops, the process csrss.exe is closely dependent on power management schemes implemented by the system as defined under the Control Panel option.This process should be treated as suspicious if there are two instances running. Always take note of the process location when trying to determine whether or not the process is genuine or malicious.This Windows component should be located in your Windows System directory ie: C:\Windows\System32.

3

Ok, well I have got csrss.exe in my System32 folder, but as I said, there is 2 processes running.

I cannot open the file location via right clicking the process in task manager, it just doesn't open the location, same with properties.

How can I find out whether they are malicious?

Could someone tell me how to check, and if they are then how to remove as I have no idea.

 

I did a comprehensive Norton 360 scan and I performed a full scan with Malware Bytes Anti Malware and no viruses were found.

4

Hi georgegee

 

Please download HiJackThis from http://majorgeeks.com/Trend_Micro_HijackThis_d5554.html. Choose the executable and save it on your desktop. Run the file and select the first option on the main menu "Do a system scan and save a log file". When this is finished, Notepad will open with the log file in it. Save the log file and attach it to a post here via the Add Attachments under the orange Post button

 

Perhaps seeing the log will help figure this one out.

5

Ok. I've attatched the log to this post.

I must also say that in the processes tab in task manager, 1 csrss.exe appears, but it is when i click "Show processes from all users" that both of the csrss.exe's appear.

 

Please instruct me on what to do next.

Many thanks, George.

6
georgegee wrote:

Ok. I've attatched the log to this post.

I must also say that in the processes tab in task manager, 1 csrss.exe appears, but it is when i click "Show processes from all users" that both of the csrss.exe's appear.

 

Please instruct me on what to do next.

Many thanks, George.

 

Hi georgegee

 

Your system does not have a problem if that is all that you are seeing. You can rest easy

7

Thanks.

So even though there is 2 processes of csrss.exe It isn't a virus or anything?

8
georgegee wrote:

Thanks.

So even though there is 2 processes of csrss.exe It isn't a virus or anything?

Hi georgegee

 

That's correct - it isn't a virus.