Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Strange processes running: winlogon.exe, csrss.exe


  • Please log in to reply
3 replies to this topic

#1 toronno

toronno

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:06 PM

Posted 08 February 2014 - 02:28 AM

As the title suggests, both programs seem to be running continuously from startup, and nothing happens when I try to locate their file location. When I initially searched the issue through google, a thread on this site was among the top hits so I sought out help here.

 

I am running Windows 7 sp1, I am fairly careful with what I do on this computer, and as such I do not have a kaspersky or AVG. Scans using Malwarebytes and Superantispyware from time to time has yielded hits that have been removed, but never either of these. 

 

edit: clearly I am not as security-savvy as one might expect. Well, at least I'm here now.

 

Any help would be greatly appreciated. 

 

Thank you


Edited by toronno, 08 February 2014 - 02:33 AM.


BC AdBot (Login to Remove)

 


#2 dls62

dls62

  • Members
  • 623 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Berkshire, UK
  • Local time:09:06 PM

Posted 08 February 2014 - 10:07 AM

Hi,

 

Both filenames are for legitimate processes that will be running all the time on your system.  The important question is where they are running from.

 

Right click on the taskbar and select Start Task Manager.  Click on Show processes from all users.

 

Locate each entry with the filename csrss.exe (there will be at least 2 of these) or winlogon.exe, right click on each one and select Properties.

The Location: specified for all of them should be C:\Windows\System32.  Please let us know what you find.

 

Any computer connected to the internet needs to have real-time antivirus protection.  Just because you are careful does not protect your system from malware infection and I suggest you read this article by quietman7 - Answers to common security questions - Best Practices - which contains good advice on internet security with recommendations for appropriate software.



#3 toronno

toronno
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:06 PM

Posted 08 February 2014 - 12:42 PM

Well, although I feel terribly dumb, I'm happy that everything checks out ok (both led to the location you specified). I'm perusing the link you provided, and I sincerely appreciate the response. 

 

Thanks for the help :)



#4 dls62

dls62

  • Members
  • 623 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Berkshire, UK
  • Local time:09:06 PM

Posted 08 February 2014 - 12:45 PM

You are very welcome.  We are here to help.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users