Here is the explanation for the processes csrss.exe, smss.exe and lsass.exe. The process smss.exe is the Session Manager Subsystem located in C:\Windows\System32. If this file is located somewhere else it is most likely a trojan or virus. It is a critical Windows process launching, amongst other things, the Winlogon and Win32 processes.

Next in the line is the process csrss.exe which stands for Windows Client/Server Runtime Server Subsystem. It should be located in C:\Windows\System32 as well. If csrss.exe is located in another location it is most likely a virus or trojan. Like smss.exe csrss.exe is important for Windows to run.

Last in the line we have lsass.exe which is the Local Security Authentication Server. If lsass.exe is executed from C:\Windows\System32 everything is fine. If it is not it could be a virus or trojan again. All three processes are important Windows system processes and should not be terminated.