Solved Found 2 instances of csrss.exe in Resource Monitor

[xDavidx77]

Just as the title states, I have found two instances of csrss.exe in Resource Monitor under "CPU". However, there is only one running under "Processes" in Task Manager, also when I click on "Go to File Location" or "Properties" nothing happens. The "Session ID", "Command Line" and "Description" columns are all blank (the same is also happening with winlogon.exe, although there is only one instance of it in both Task Manager and Resource Monitor). In Resource Monitor both csrss.exe instances say 0 under the "CPU" column. I know that csrss.exe is crucial for my OS, but I also know that multiple instances can mean a Trojan. I have identified the instance that is shown in both Task Manager and Resource Monitor using the "PID". What I want to know is if I should remove the instance that I cannot open it's file location, or if it is normal and I should just leave it as be.

Also, pertaining to winlogon.exe; should I also remove that?

Thanks in advance.

 

[UsernameIssues]

Just as the title states, I have found two instances of csrss.exe in Resource Monitor under "CPU". However, there is only one running under "Processes" in Task Manager,...

Was Task Manager running with admin rights? (High Integrity level)

...in Task Manager, also when I click on "Go to File Location" or "Properties" nothing happens....

This is normal for Task Manager if is has not been running as admin. Task Manager cannot access the info needed for a process that is running at the System level while Task Manager is running at the Medium Integrity level.

...The "Session ID", "Command Line" and "Description" columns are all blank...

Some items will be blank for the same reason mentioned above: Integrity levels. Session ID should not be blank. Please post a screenshot. (http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html)

(the same is also happening with winlogon.exe, although there is only one instance of it in both Task Manager and Resource Monitor).

Both tools (Task Manager and Resource Monitor) need to be running at the High Integrity level (admin rights) to be able to show you the same info.

...I know that csrss.exe is crucial for my OS, but I also know that multiple instances can mean a Trojan...

You probably would like Process Explorer with the Virus Total option turned on. See this tutorial: http://www.sevenforums.com/tutorial...er-virustotal-check-all-processes-50-avs.html

...I have identified the instance that is shown in both Task Manager and Resource Monitor using the "PID". What I want to know is if I should remove the instance that I cannot open it's file location, or if it is normal and I should just leave it as be....

Leave it be until you know more by running Task Manager with admin rights.

...Also, pertaining to winlogon.exe; should I also remove that?...

No - until you know more by running Task Manager with admin rights.