I currently have 2 csrss.exe running under system, using 1700kb - 2156kb memory each. Related to them there seems to be 2 conhost.exes, one using roughly 1000kb ram and 1400kb. One is SYSTEM and one is NETWORK. I found 2 csrss.exes in my system, one In system32, one in winsxs/amd64_microsoft (with a large amount of numbers) I found 1 conhost in system32, and 8 conhosts in winsxs/amd64_microsoft followed by numbers Like csrss. Is this normal? I also may have seen a third conhost running, but I dont think it was attached to csrss
using event viewer logs and process explorer I found the 2 conhost files under csrss, were launched (in my test) at 15:33:52. At the same time, in event viewer under system, the MBAMservice entered a running state. Also, the server service entered a running state. Other services that started around a second or two after: Network list service Diagnostic service host Human interface device access Micrsoft network inspection Diagnostic system host Portable device enumerator Computer browser service There was no entry in the application part of event viewer. Under security, at 15:33:52 there was an entry for:
Audit sucess: An account has succesfully logged on. Subject ID: null sid (Further down on the same entry)
New logon: Security id: anonymous logon Account name: anonymous logon Account domain: nt authority
And theres several more sections of that entry. Is this bad? I have found several of those anonymous logon entries back as far as the day I got my pc a year ago, so I don't think its bad. Another pc in the house has the same amount of conhost and csrss.exe files on the hdd (around 8-9, in amd64 install folders, and the one that runs under system32, and the csrss files. The other pc had 2 csrss processes running but no conhost. ) Does it look bad or okay? Im going to run some safemode scans. (Mbam and mse). The scans have come clean.
here is an image of when I run Geforce experience, this conhost appears and shutsdown very quickly.