2 csrss.exe files running

[rpattinson]

What do i need to do. Thanks Russ

 

[ratedk]

Having multiple instances of csrss.exe in the task manager is normal. There should be one instance of csrss.exe for system processes and another instance for interactive logons. If you have multiple users logged in, you can have even more instances of crss.exe in the Task Manager.

The "one csrss.exe only" rule applies to XP and earlier.

csrss.exe (Client/Server Runtime Subsystem) is legitimate windows file; and yes it is located in c:\windows\system32; however; if you try to run the original file csrss.exe (in win7 x64) file on a dos prompt it wont run telling you it can not run in win32 mode.

You can double check how many copies of file you have on your system by going to Command prompt, and typeing Dir csrss.exe /s

You should get two instances of file being reported in results:

1. \windows\system32
1. \windows\winsxs\amd....

Size of this file is 7,680 bytes on my system and it is taking about 1,788 kb of mem (mine shows 3892 kb of memory used).

Many places indicate that it *could* be a trojan. Download and run Malwarebytes in safe mode to help rule out trojan as a possibility.