Client server runtime process & csrss.exe

Question

Windows 8.1 64bit,  9/30/2014

i have 2 client server runtime process running, is it normal? when i click on them & chose open file location both show csrss.exe as source, so it should be normal?

so if open file location shows csrss.exe located in C:\Windows\System32 with both, then its normal?

Task Manger under Detail Tab i see 16 csrss.exe running & all are running under System, is that also normal?

11/10/2014:

today there is 26 csrss.exe running

Answer 1

I only see two in Task Manager.   You could try a Clean Boot to see if that cuts down the number you see.

How to perform a clean boot in Windows

http://support.microsoft.com/kb/929135/en-au

How to perform a clean boot to troubleshoot a problem in Windows Vista, Windows 7, or Windows 8

http://support.microsoft.com/default.aspx/kb/929135

Why is csrss.exe running 169 times?

http://superuser.com/questions/350741/why-is-csrss-exe-running-169-times

Multiple csrss.exe processes running

http://answers.microsoft.com/en-us/windows/forum/windows_vista-system/multiple-csrssexe-processes-running/f1674fb0-8af4-4b8a-8f91-a3d4244916e1

https://www.google.com.au/search?q=csrss.exe+multiple+task+manager&sourceid=ie7&rls=com.microsoft:en-AU:IE-Address&ie=&oe=&gfe_rd=cr&ei=nIo5VN6LG8_C8gf444GwBg&gws_rd=ssl#rls=com.microsoft:en-AU:IE-Address&q=csrss.exe+multiple+task+manager+windows+8

I see lots of recommendations here for programs like -

Malwarebytes' Anti-Malware

http://www.malwarebytes.org/products/malwarebytes_free

SuperAntispyware

http://superantispyware.com/

Answer 2

i have Avast Free, Malwarebytes Free & SpyBot Free, last scan with the 2 last was 7/10/2014

I only see one in Task Manager under Processes, & only if i click on client server runntime process & open file location, but in Task Mange under Detail i see more

clean boot, that's out of my league, not experienced enough 

& i mentioned, i have Windows 8.1

does Process Explorer work like this to like example, Task manger-Firefox open file location-Firefox.exe & it tells what other program activated Firefox.exe? i just use Firefox.exe as a easy example :), i have no problems with my waterfox, what is 64bit ver of Firefox, i men it opens up the chain & shows what programs are using that exe file?

Answer 3

In Task Manager you should be looking under the Details Tab, and that is what your image confirms.  Under the Process Tab I have 2 (Client Runtime), and under the Details Tab I have also 2 (csrss.exe)

Process Monitor (not Explorer) is a bit more detailed than Task Manager.  "Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity".   It shows (I believe) what process causes the creation of Registry Entries, or files being created.  It allows you to set conditions and monitor results in an evolving log.  In other words it allows you to explore the processes responsible for events "under the hood".

Process Monitor v3.04

http://technet.microsoft.com/en-au/sysinternals/bb896645.aspx

Process Monitor Forum

http://forum.sysinternals.com/forum_topics.asp?FID=19

The Clean Boot is not that complicated, I will try to explain the logic behind it.

If the problem is bothering you then you have to use the Clean Boot procedure and isolate the cause by stopping half the Startup Programs and non-Microsoft Services and then checking if the problem is still there.  If it is still there then you stop half of the remaining non-Microsoft Services and Startup Programs until you isolate the cause.  If it is not there then you put the ticks back in half of the stopped non-Microsoft Services and Startup Programs.  It is a fiddley process of elimination until you find the cause there is no way around it.

If you were to check in Safe Mode, I bet there would not be multiple instances of csrss.exe.  That's why you need to Clean Boot to see what is causing them.  Perhaps if you were to temporarily disable Avast Free, Malwarebytes Free & SpyBot Free, you might have a few less.  Again this is the purpose of a Clean Boot.

How to start Windows 8 in Safe Mode

http://www.bleepingcomputer.com/tutorials/start-windows-8-in-safe-mode/

On the other hand if you are clear of malware you could just forget about your perceived problem and ignore it (or them).

Answer 4

dunno is it bothering me, but i just want to know is it normal for windows 8 that so meany csrss.exe are running, it seems to have no impact on performance, is it coincidence or not 16 was before i installed spybot & malwarebyte & new there is 26

does Process Monitor show what programs are running csrss.exe?

i looked the instructions on how to get in safe-mode on Win8, i need a laptop with Wi-Fi so i can see the instruction video & do it step by step, that's one thing why i like Win7 more, easy access to safe-mode, it would be pain if getting out safe mode is as complicated as getting in

if there is no issues, no performance issues not errors & all csrss.exe are system & WinSys32 folder then it is normal?, i just wonder about the numbers of csrss.exe, is it normal or not

also there are 2 csrss.exe on my PC, both locations should be legitimate? i just added csrss.exe to search out of curiosity & found 2

C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_6.3.9600.16384_none_49a243e2b80cb4c0\

C:\Windows\System32\

does the number of csrss.exe even matter if they don't take much memory & cpu & if all csrss.exe processes shown in task manager are system & in windows folder, i mean, this means that all of them are legitimate?  

i wonder do i know what to do with Process Monitor there is so much things i don't know about it, does Process Monitor v3.1 do some things automatically to? looking at the pictures i think, even if i get it i don't know how to use it, well not 100%, some things i may able to figure out, i wonder is with out install like Process Explorer?

Answer 5

Try the Process Monitor Forum for your questions about Process Monitor.  I have never really used it myself.

Don't worry about the WinSxS Folder.  It contains many copies of older versions of files, that is normal.

You can access the recovery console/safe mode menu by:

Depressing the Shift Key while clicking on Restart at the Login Screen (Bottom right corner).

Manually shutting down (forcibly) three times in a row will bring you to the same screen.

You can also use the MsConfig tool to enter Safe Mode.  The Safe Mode options screen can be set to display via the MsConfig tool where you would set it via the Boot Tab.

Try using the Clean Boot tool (which is the MsConfig tool under another name) and do the Clean Boot procedure.