csrss.exe is supposed to be running in system*2. If it is anywhere else, it is malware