Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

From my search in the internet i found out that there should be one csrss.exe

in that article it says i should have only one file named csrss.exe in the task manager ,if there is more then one,one of them is a virus and the file that in the system32 folder is the real one,

in case i have more then one it says i need to stop all the csrss processes(in the Task Manager) and delete the other csrss.exe by clicking on properties,finding its location and delete it there .

i have only one csrss "end process" option in the task manager(i have windows 7 ) is it the same thing as "stop"?

the name in the Task Manager is csrss.exe and not csrss.exe.mui, BUT in the system32 folder i have them both csrss.exe and csrss.exe.mui

what should i do?

(i checked Task Manager again and found out there are indeed 2 csrss.exe files ,the user name of both is SYSTEM (when i checked earlyer task manager there was only one process and its user name was blank)


share|improve this question
Run a virus scan. It is impossible to stop the csrss process because it is essential to Windows. Luckily, the real csrss process will warn you when you try to end the process, thus if you try to end both and one is illegitimate, the one that doesn't complain is the illegitimate one. But seriously, if you don't know what csrss is, just run a virus scan because if you are somehow successful at removing the wrong one, Windows will not run. –  viking Mar 2 '12 at 21:20

2 Answers 2

Having multiple instances of csrss.exe in the task manager is normal. There should be one instance of csrss.exe for system processes and another instance for interactive logons. If you have multiple users logged in, you can have even more instances of crss.exe in the Task Manager.

share|improve this answer
+1 The "one csrss.exe only" rule applies to XP and earlier. –  Andrew Lambert Mar 2 '12 at 23:40

You need to download Process Explorer from SysInternals: http://technet.microsoft.com/en-us/sysinternals/bb896653

It will allow you to see the full path of each executable as well as other information that should enable you to determine which csrss.exe is good and which is bad.

ProcExp is a "super-taskmanager" that just shows a whole lot more information than the regular task manager. And it's published by Microsoft now.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.