Is there malware in my system?

redivcram · **Author**

I'm on windows 8.1 (Asus laptop), when I open the task manager there are executable files opened more than just one instance.

csrss.exe (Client Server Runtime Process) - 16 of them are opened
dwm.exe (Desktop Window Manager) - 15 of them
LogonUI.exe (Windows Logon User Interface Host) - 14 of them
svchost.exe (Host Process for Windows Services) - 10 of them
winlogon.exe (Windows Logon Application) - 15 of them

I never seen my task manager spammed with so much instanced... what does this mean? Why are there so much exe files opened? Some people say they're important system files while others say that It's malware... help?

klippy · 03-15-2017 , 08:15 Re: Is there malware in my system?

It's normal that there are many svchost.exe processes, but not sure about others ones, that seems sketchy.

redivcram · 03-15-2017 , 11:23 Re: Is there malware in my system?

Quote:

Originally Posted by KliPPy

It's normal that there are many svchost.exe processes, but not sure about others ones, that seems sketchy.

I never had that many svchost processes IIRC, but I remember having more than one svchost...

klippy · 03-15-2017 , 11:49 Re: Is there malware in my system?

Should be alright, I currently have 18 of them running. The more running services you have, the more likely it is to have more svchost.exe processes.

CreativeTR · 03-15-2017 , 16:01 Re: Is there malware in my system?

csrss.exe - i really dont know :/
dwm.exe - can be a service for window list (ALT+TAB)
LogonUI.exe (Windows Logon User Interface Host)
svchost.exe - windows services required for work (network service etc.)
winlogon.exe - service required to sign in and keep open

asherkin · 03-15-2017 , 19:32 Re: Is there malware in my system?

Quote:

Originally Posted by redivcram

csrss.exe (Client Server Runtime Process) - 16 of them are opened
dwm.exe (Desktop Window Manager) - 15 of them
LogonUI.exe (Windows Logon User Interface Host) - 14 of them
winlogon.exe (Windows Logon Application) - 15 of them

Windows will only spawn one of each of these - it certainly sounds like malware masquerading as syste processes. If you find them in the Details tab of Task Manager you can right-click and select "Properties...", which will allow you to see the path on disk and if they are digitally signed by Microsoft.

**sneaK** · *Last edited by sneaK; 03-16-2017 at 03:02.*

No viruses/malware here (windows 7), but still have 2 csrss.exe's running.

Sure seems like you do have something fishy going on, as asherkin pointed out.

ddhoward · *Last edited by ddhoward; 03-16-2017 at 03:10.*

Having multiple instances of csrss is normal. Two is what most of us should have, from what I understand.

http://www.tomshardware.com/forum/70...-files-running
http://www.techspot.com/community/to...64-bit.142833/
https://superuser.com/questions/3963...ve-one-of-them

As for your 16 instances, or all the other processes? Yeahhhh you've got something fucky going on.

redivcram · 03-16-2017 , 10:19 Re: Is there malware in my system?

It appears that all instances are located in the same directory (System32), like It's meant to and all have Microsoft Windows as their signature. Also, forgot to mention that I'm using a windows 7 shell on win8.1, I don't know whether it should have anything to do with this but I'd like to find out whether it's meant to do any bad to my system xd

Depresie · 03-21-2017 , 23:03 Re: Is there malware in my system?

Do you have an antivirus ? if yes, then which ?