Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Two csrss.exe processes in task manager


  • Please log in to reply
3 replies to this topic

#1 sbsmanager

sbsmanager

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:10:56 AM

Posted 07 January 2014 - 09:45 PM

Hello,

 

I recently went into task manager to shut down some applications that were misbehaving when I noticed a csrss.exe process that was the only one appearing to be run by the system, and when I looked at a list of processes for all users, csrss.exe shows up twice, with one at about 1MB and the other around 5MB. When I right click and try to open the file location, nothing happens for either of them, but will work for any other process.

 

I googled this, and it is a sever runtime process, but if I have two of them it is likely to be a virus. I ran a full system scan with Norton, but it didn't find anything besides tracking cookies. I then restarted my computer, and found that both processes were still there.

 

Does anyone knows about how I could go about fixing this, or if it is just a normal thing?

 

Thanks



BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 42,668 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:01:56 PM

Posted 08 January 2014 - 10:09 AM

FWIW:  Two seems to be the standard number for this process when using Task Manager.  If you reflect two, you have no problem.

 

http://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/9310fc95-1814-4c60-ad44-d0c80e4a4c6e/how-many-csrssexe-process-should-be-running-in-vista?forum=windowssecurity

 

Louis



#3 sikntired

sikntired

  • Members
  • 502 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:01:56 PM

Posted 08 January 2014 - 10:18 AM

Hi sbsmanager,

The csrss.exe is a very important system file and its not a virus but some times it may get corrupted by virus and some times the virus, trojan and spyware use the same name hat of csrss.exe, just to hide themselves from system users and in return any anti-virus program can be used to scan and eliminate those malicious files.

Original csrss.exe location is C:\Windows\System32\ (your drive may be different from C:)

In case there are more than one instance of csrss.exe running in Task Manger then you check their location by taking their properties. Right click on running csrss.exe process in task manager and select properties or Open file location.

If the file location is different from the above provided address then it means those are not original Windows files and should be killed and removed from its location. You may need administrator privileges to take properties of running process.

You can also identify original csrss.exe file, just navigate to Task Manager > Processes and right click on csrss.exe and click End Process.

If this csrss.exe is a virus then it will not show any critical message about the deletion and complete the process.

Hope this helps

Good Luck

#4 dc3

dc3

    Arachibutyrophobia


  • Members
  • 17,439 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Sierra Foothills of Northern Ca.
  • Local time:11:56 AM

Posted 08 January 2014 - 11:38 AM

Original csrss.exe location is C:\Windows\System32\ (your drive may be different from C:)
 

 

Just a clarification.

 

Usually the hdd or partition on a hdd which contains the operating system is the C: drive.  This is not always the case, so you need to determine if the C: drive contains the operating system.  You can do this in Windows Explorer.

 

Right click on the Start orb, choose Open Windows Explorer.  Click on the C: drive if it is present, if the operating system is on this drive you will see the usual Program Files, Program File (x86), Users, Windows, etc.


Please note:  My wife broke her radius in three places at the wrist.  This required surgery where a plate and nine screws were attached to allow this brake to heal properly.  She is recovering now and should make a full recovery over the next six weeks if all goes well.  She is doing well enough now that I don't need to stick quite so close to her and will be able to start getting back to the amount of time I was able to invest previously.
 
I would like to thank those of you who have expressed your concerns and best wishes for a speedy recovery.  
 
Sincerely,
 
Dan
 
 

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users