Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Dual csrss.exe and conhost.exe are they virited?

28 May 2015   #1
EJGlass

Win 7 64bit
 
 
Dual csrss.exe and conhost.exe are they virited?

Hi
I have seen two copies of csrss.exe in the run of Process Explorer, and can't figure out why there are two. Also is csrss.exe supposed to have this extra stuff on after the .exe part? (the added stuff looks like opening ports for sharing which is off)

=====
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
=====

The same file is loading up with csrss.exe it is conhost.exe and each occurrence of the conhost file has a different set of numbers after the .exe part as well.

=====(NT Authority/System in PE)
\??\C:\Windows\system32\conhost.exe "-19462917881928618761-14517701611313678421-1909588746-743542847-290976386389256608
=====
and the other is:
=====(NT Authority/Network Service in PE)
\??\C:\Windows\system32\conhost.exe "251829604-254933148129903086818709497291982502722-82799778550413321-274352356
=====

What is all this extra stuff after the .exe part of each file?
Any help would be great or is someone could look at their copies of these files in the system32 folder(win 7 64bit)


My System SpecsSystem Spec
.
28 May 2015   #2
LMiller7

Windows 7 Pro 64 bit
 
 

Everything you are seeing is normal.

Starting with Vista there will be one instance of csrss.exe for the system session plus one for each logged in user. This is done for security reasons. The only time there will be only one is when there is no logged in user, but then there would be no one to see it.

It is not unusual to see one or more instances of conhost.exe.

The data following the process name is the command line passing required information to the process when it starts. Many of the details are undocumented.

It is not unusual to see multiple instances of some other processes as well. There may be a dozen or more instances of svchost.exe.
My System SpecsSystem Spec
28 May 2015   #3
EJGlass

Win 7 64bit
 
 

Quote   Quote: Originally Posted by LMiller7 View Post
Everything you are seeing is normal.

Starting with Vista there will be one instance of csrss.exe for the system session plus one for each logged in user. This is done for security reasons. The only time there will be only one is when there is no logged in user, but then there would be no one to see it.

It is not unusual to see one or more instances of conhost.exe.

The data following the process name is the command line passing required information to the process when it starts. Many of the details are undocumented.

It is not unusual to see multiple instances of some other processes as well. There may be a dozen or more instances of svchost.exe.

Thanks for the quick reply... Guess I should stick to "NOT" reading things into PE's logging...

Oh I just noticed something else though that I had not seen before today. There are two copies of dllhost.exe that load up then shut down within 2 seconds. Why are they doing this? I am logged in as Administrator for PE and this does not happen on normal.

Thanks again!
My System SpecsSystem Spec
.

28 May 2015   #4
LMiller7

Windows 7 Pro 64 bit
 
 

Many programs use dllhost.exe for a variety of purposes. Having several running is not unusual.
My System SpecsSystem Spec
Reply

 Dual csrss.exe and conhost.exe are they virited?




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Conhost.exe error in program
when conhost.exe running in my pc the cpu processing increases rapidly & temp 60 degree above, normal is 39-45 in task manager what's the solution? please .......
General Discussion
Why CONHOST.EXE process starts ONLY when I use TOR?
Hi guys, I have read in other threads the function of CONHOST.EXE process in Windows 7 (the legit process located in SYSTEM32 folder). But I wonder why in my pc this process appears only when I use the Tor Browser, and not when I use the stardard Firefox browser or in any other situation. ...
General Discussion
Conhost exe
I have 26 instances of conhost.exe running at the moment. It's slowing the laptop down. Yesterday there were close to 300 and when it first happened a few days ago there were 240. The only thing I can do is to restart the laptop which clears them for a while. I have AVG with firewall and...
General Discussion
conhost.exe infected. (backdoored)
Hi all.. Well,i dont know if this is normal but why is there always two conhost.exe And i mean its always running.. So i logon to my computer check task mananger and there are two conhost.exe running. So i then check WinPatrol and i go to active tasks and its running there also..But it...
System Security
W32.Sober in conhost.exe?
SpyBot discovered W32.Sober in file Windows\System32\conhost.exe (build 6956). Can somebody confirm it? Or it's fake alert?
System Security
conhost.exe
I keep on getting this message all the time and the only way I can get rid of it is to disable my virus protection any one know how I can solve this
General Discussion


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 10:06.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App