2 Tasks Running and it's not letting me open file location (VIRUS?)

[angelt]

winlogon.exe
csrss.exe

I tried to open the file location and nothing happens.
I googled the files and the 2 MAY be potenttial viruses.
Any comments?
Maby I hope that they are just normal Win7 Tasks and not viruses
Instructions on how to know if they are not viruses.

THANKS

 

[Layback Bear]

Welcome to our forum angelt.

Could you put in your (My System Specs) what security programs you have installed.

Could you also let us know exactly what files are in question?

 

[LMiller7]

winlogon.exe and csrss.exe are both critical system processes. With UAC enabled and using an admin account you really only have the rights of a standard account. This is a good thing. Such an account does not have the rights to access the file location and some other information for system processes. To see this information you must select "Show processes from all users". Task Manager will then be running under an elevated account that has such rights. Even then some information may be inaccessible for some high privilege system processes.

Viruses go to great lengths to hide their presence and are unlikely to be detected by such simple means. Sufficiently sophisticated malware (and these days most of it is) has the ability to manipulate the information shown by Task Manager and similar utilities to show what it wants you to see.

 

[UsernameIssues]

> I tried to open the file location and nothing happens.
I am going to guess that you tried to "open the file location" from within Task Manager. If you do as LMiller7 says, you will see even more processes running for which "nothing happens" when you select Open File Location. Task Manger can be set to show a column named Image Path Name. In the screenshot below, I sorted the processes by that column. If the Image Path Name is blank, then "nothing happens" when you select Open File Location.



The process that the arrow is pointing to is from Intel. Simply put: Task Manager asks for the location using code that does not always work.

msinfo32 is another tool that comes with Windows 7. Simply put: that tool asks for the location using code that works a bit better.

Process Explorer does an even better job of getting the location of a process that is running. You might want to use the info in this post (http://www.sevenforums.com/system-security/320426-process-explorer-16-a.html#post2681060) to setup Process Monitor to check each process with Google's Virus Total website.


> I googled the files and the 2 MAY be potenttial viruses.
Almost every file that you Google will have many websites that tell you it could be infected. The websites want to scare you into visiting. They get paid when you visit.


> Maby I hope that they are just normal Win7 Tasks and not viruses
They are probably not infected... but you cannot know for sure.


> Instructions on how to know if they are not viruses.
After you scan the files using various security related tools (antivirus, anti-malware and/or offline scanners), all that you can say is: the tools did not find any infections. Sadly, some infections cannot be detected at this time.

 

[mdd1963]

The two processes you listed are indeed typical; my advice....don't worry about them

 

[Callender]

In addition to what Usernameissues suggests it is also possible to set Process Explorer to verify file signatures. If either of those processes you mentioned are unsigned it would indicate problems. They should be signed by Microsoft.

​

Currently I also use a task manager add on that highlights unsigned running processes in red.

​

 

[Layback Bear]

That is exactly why I asked for a list of security programs.
Using proper security programs to check for infection is the best way to know whether something is a infection and trying to hide and that is not 100%.
Their is no 100%. Their are just best practices one should follow.
Everything in a computer can hide a infection. The people who create these infection are not dumb. They know Windows and programs a lot better than I do or ever will.