2

From my search in the internet i found out that there should be one csrss.exe

in that article it says i should have only one file named csrss.exe in the task manager ,if there is more then one,one of them is a virus and the file that in the system32 folder is the real one,

in case i have more then one it says i need to stop all the csrss processes(in the Task Manager) and delete the other csrss.exe by clicking on properties,finding its location and delete it there .

i have only one csrss "end process" option in the task manager(i have windows 7 ) is it the same thing as "stop"?

the name in the Task Manager is csrss.exe and not csrss.exe.mui, BUT in the system32 folder i have them both csrss.exe and csrss.exe.mui

what should i do?

(i checked Task Manager again and found out there are indeed 2 csrss.exe files ,the user name of both is SYSTEM (when i checked earlyer task manager there was only one process and its user name was blank)

Help!

Improve this question
1
  • Run a virus scan. It is impossible to stop the csrss process because it is essential to Windows. Luckily, the real csrss process will warn you when you try to end the process, thus if you try to end both and one is illegitimate, the one that doesn't complain is the illegitimate one. But seriously, if you don't know what csrss is, just run a virus scan because if you are somehow successful at removing the wrong one, Windows will not run. – viking Mar 2 '12 at 21:20
4

Having multiple instances of csrss.exe in the task manager is normal. There should be one instance of csrss.exe for system processes and another instance for interactive logons. If you have multiple users logged in, you can have even more instances of crss.exe in the Task Manager.

Improve this answer
1
  • 1
    +1 The "one csrss.exe only" rule applies to XP and earlier. – Andrew Lambert Mar 2 '12 at 23:40
1

You need to download Process Explorer from SysInternals: http://technet.microsoft.com/en-us/sysinternals/bb896653

It will allow you to see the full path of each executable as well as other information that should enable you to determine which csrss.exe is good and which is bad.

ProcExp is a "super-taskmanager" that just shows a whole lot more information than the regular task manager. And it's published by Microsoft now.

Improve this answer
1
  • Note that in the case of csrss.exe, even Process Explorer is limited on what it shows, in this case it will not show the path, nor the company name fields, they are blank. On the properties window it will only show very limited information. Whether you run Process Explorer as admin or not won't matter here. – Abel Nov 28 '15 at 5:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.