Download and install Malware Bytes from http://www.malwarebytes.org/mbam.php
The legit csrss.exe file is located in the folder C:\Windows\System32. Win32.sys is the kernel-mode portion. Csrss stands for Client/Server Run-Time Subsystem, and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and/or deleting threads, and implementing some portions of the 16-bit virtual MS-DOS environment. In other cases, csrss.exe (outside legit location) is a virus, spyware, trojan or worm!
The legit winlogon.exe file is located in the folder C:\Windows\System32. Winlogon is a part of the Windows Login subsystem, and is necessary for user authorization and Windows activation checks. In other cases, winlogon.exe (outside of legit location) is a virus, spyware, trojan or worm!