| All comments about csrss.exe: |
 Alex | Windows Client/Server Runtime Server Subsystem |
 | can also be put in C:\\Windows directory by the W32.Netsky.AB worm, an SMTP mass-mailer See also: Link |
| Dark | wenn die datei in c:\windows liegt, ist's wahrscheinlich der wurm netsky.AB |
| Alex | Windows component if file in folder Windows\System32 |
| Valas | Legit system file |
 PELIAN | kann mit der gratis Trial- oder käuflichen Vollversion gecheckt werden , dann in Quarantäne abgelegt und von dort endgültig gelöscht werden. Der Security Task Manager von Neuber stuft verdächtige Dateien nach einem Rating und Farbcode ein, listet sie auf und bietet Lösungen an. Auch Wiederherstellung sicherheitshalber isolierter und stillgelegter Dateien aus der Quarantäne ist jederzeit möglich. See also: Link |
| Ben in Pennsylvania, USA | My machine was hacked by someone who put a bogus hidden copy of a spyware program into my System32\dllcache directory. I thus had two processes named csrss.exe running at once--the legitimate one in System32, and the bogus one, that I discovered using Security Task Manager. The bogus one was 5.5 MB whereas the legit one is less than 1 MB. |
| nursoda | be aware that althought the WXP csrss.exe is 4096kB on disk, it can take more than 4 Meg of RAM |
 Romane | El archivo emite un ventana de mensaje regularmente (a veces un verdadero fastidio) sobre una aplicación espía. Al intentar desinstalarlo o eliminarlo resetea la máquina. En algunos sitios web lo describen como un gusano, pero la forma de eliminarlo no corresponde con las características como se haya este en mi sistema |
 Rich04 | I opened my windows task manager and saw that I had TWO ccsrss.exe files. one was in capitals... one wasn't. When windows starts, I get a message saying that systask32 isn't functioning. I get the choice to send an error report or not. I am pretty sure the viral one is the one in capitals, but I'm not sure. |
 Inuyasha | This is a Windows system file, but a lot of viruses will also use this name because the WinXP task manager won't let you close it. (Great idea, Microsoft!) The real one is found in C:\Windows\System32. See also: Link |
| Herman | Can cause computer to freeze for a second or two or totally bogg down. Work notebook has this on it using zero % cpu - home notebook does too but after installing Panda Internet Security - home notebook's csrss.exe cpu usage went to 20% causing notebook mouse to "stick" for a second every few seconds. Something is definitely "up" with this exe. |
| nafiton smith | It can be a virus, but it is also a Windows file. As a windows file, it can consume high % processor: enable hardware graphic aceleration. See also: Link |
| Nathan | This is the Windows client server run-time subsystem that handles Windows and graphics functions for all subsystems. Another important component of the Windows® Operating System. |
| Daniel Price | Causes popup windows and cannot be deleted "access denied" and also a "critical system process" |
| A Techy | Officially a system file - If you have 2 of this file... one is very likely a virus.. be careful if deleting manually as the real one is an important file needed on your pc... It is suggested you use an up-to-date antivirus software to find and remove the infected file |
| Tony (Pc Technician) | This file is actually a Client/Server Runtime Server Subsystem ... This is the user-mode portion of the Win32 subsystem (with Win32.sys being the kernel-mode portion). Csrss stands for client/server run-time subsystem and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and and/or deleting threads, and some parts of the 16-bit virtual MS-DOS environment. The csrss.exe which is from Microsoft is located in the c:\windows\System32 folder. It has been noted that one virus had been found that runs as csrss to hide from you. |
| DataFighter | Die csrss.exe gehört eindeutig zu Windows. Sie ist ein so genanntes Sub System. Aber Achtung: Der Wurm "W32.NIMDA.E@mm" kopiert sich als csrss.exe in Form einer Variablen in die entsprechende Datei! Wenn Sie den Verdacht haben Opfer dieses Virus zu sein, dann empfehle ich Ihnen diesen Link: See also: Link |
| Martin | Even the legit MS-Version of this process can lockup your machine. See also: Link |
| RH | Winspy uses this process to keylog, never really got it out. See also: Link |
| zero | Mot only system file. It is widely used by keyloggers and worms. See also: Link |
| CyberZilla | AdAware from Lavasoft cured this problem for me. I think It is a spyware program using csrss.exe to access the internet. And since spyware writters suck they screw it up so it bogs down your system |
| Max | The csrss.exe process can be hijacked by several viruses, that pose as a messenger service. Don't believe any unsuspected pop up messages! |
| Nick | Picked up by SpySweeper, this nasty was really screwing up my DSL link. Caused issues with my Alcatel modem (config file truncating on load). Pages loaded painfully slowly if at all. Removed and all is now fine. Another Windows feature, thank God I also use a Mac. |
| Joe | Nach csrss.exe suchen, man findet zwei Dateien. Die in Windows\System32 ist die richtige (6KB bei Win2000), die andere der Wurm (816KB bei Win2000). Von CD starten und letzeren löschen - bumm. |
| Hooligan | its a windows file |
| | If it shows with a big green U and small red D, then it's a trojan. |
| Victor | I have a laptop with a NVIDIA GeForce FX Go5650 (video card and/or driver name). Once I disabled it's additions to my system menus my CPU usage when back to normal instead of being slow at each right click or application menu click. csrss.exe was the CPU hog according to task manager, it sits at 5.45 MB on my Windows 2003 Server , and I believe the file is ligitimate on my system. |
| prodigalrat | I am convinced I was infected by csrss.exe by install the win2k sp4 downloaded from microsoft... |
| Christian Gabriel C. | Many Hacking Applications are being downloaded especially vie p2p software and it is being uncomplressed to System32/dllcache/win32. You must delete te entire win32 inside the dllcache to get rid of it. Safe mode booting is required. |
| schindt | ist ein normaler winXP prozess, alles easy |
| Matt | If this file is in more than one instance: virus.... If this file runs out of any folder except system32: virus.... If you have this file, check for the WTools (aka WinTools) files on your computer. I had both, don't know if they're related though. |
| Trystan | just ran a search for crss.exe...no results found! what the heck does it mean, because the process is there in taskmanager |
| Dr. J | Webroot's SpySweeper occasionally wants to access this file. Don't know why........ |
| Kevin | Shound be about 6K file size |
| | it makes me nervous, because its poping up and trying to connect every time to a differetnt serves such as www.porn.com. .... why? |
| Martin | " CSRSS is the Client Server Runtime SubSystem. CSRSS is started by SMSS. When the user application makes a Win32 API call, it is usually CSRSS which communicates with the operating system’s Kernel to execute the API call. 3.368-4.144 kB on my system (21 tasks running, 7 user, 1 local service (svchost.exe), 1 networkservice (svchost.exe) and 12 active system tasks: 3 x svchost.exe, outpost.exe (firewall), AVWUPSRV.EXE (antivirus), avgserv.exe (antivirus), lsass.exe, services.exe, winlogon.exe, csrss.exe, smss.exe and System). |
| PQ | This is a Windows system file. (I love microsoft...) This file very often trying to broadcast to 224.0.0.22............ |
| Luchito_Gallito | In my computer, it is located in this folder : c:\windows\softwaredistribution\download |
| PaddyOz | I discovered csrss.exe & csrss.bin in root directory, after reading this thread I promptly deleted it. Thanks |
| Brent | I found this file running in my processes in caps CSRSS.EXE. It was located next to the acctual file csrss.exe in \windows\system32 This file was part of some spyware that was redirecting my chosen homepage in IE. It also had a buddy file called CTFMONSS.EXE Both of these files needed to be stopped by using the End Process Tree command. This command is located by right clicking on the name of the process that you want to stop in the task manager process tab window. I then deleted the files from the \windows\system32 directory and ran Hijackit to remove the other reg entries made. |
| jeff | the link I posted in my comment was mistaken. This is a correct link to someone who reported a similar problem with this file. See also: Link |
| jeff | I have 2. One is the system file, the other is in the c:\windows directory. It's the cause of a keylogger that's apparently been running on my system for months. The properties say it's created by StarMicrpSdn and it's original name is Winsyst.exe. So far no virusscan or antispyware program has detected it on my system. |
| | This file started poping p suddenly asking for access to internet thru my firewall and I thought it is a spyware |
| | i know it is a system file but i don't have any problems without it, although i only renamed it, lemme restart ;p |
| Frank Kemper | Sygate Personal Firewall meldet das die Datei csrss.exe (Client Server Runtime Process) versucht auf das Netz zuzugreifen. Es befindet sich jedoch nur die orginale 6 kb große Datei (XP SP2) auf dem Rechner. |
| | Windows system file |
| CSsuxx | cs = counterstrike - delete it from ur PC NOW! |
| Jeff Painter | Sounds like a windows subsystem that helps keep your screen cleen between window changes |
| Jopower | I only know about this file from what I saw here. I note it just tried to "broadcast" something as I went online. This is the first time it ever tried to do so and my Sygate firewall caught it. I didn't allow access and nothing evil happened. Sygate reports it's in the System32 dir. Wonder if it's some sort of call home (MicroSoft?) thing? |
| Jopower | Only what I saw here. I note it just tried to "broadcast" something as I went online. This is the first time it ever tried to do so and my Sygate firewall caught it. I didn't allow access and nothing evil happened. Sygate reports it's in the System32 dir. Wonder if it's some sort of call home (MicroSoft?) thing? |
| Horst | It's a Windows file |
| dbpvr | Its fake if anywhere else but in windows/system32/csrss.exe |
| Zach | Windows calls it a system file that you cannot delete. It's a very nice curtian for trojans to hide behind. It cannot be terminated, it is a client server service, so it will be exchanging data over the internet every so often, and apparently, it is modifyable. Proceed with caution |
| Mike | This file hosted a password stealer, I got rid of it with hostdll.exe. |
| Jon | It's a graphics handler for windows |
| Am | It is a Windows file, but some smartass made a trojan with the exact same filename. It embeds itself into the OS and any CDs you burn. The file initially looks like an image or screen saver (.SCR) file. Once run. the script becomes active and loaded into OS. Really hard to remove properly. I still haven't managed to get rid ot if. Puts a bunch of pesky pop-ups on your screen. See also: Link |
| | Is a Windows file.. often manipulated or copied by spyware, virus, worm, trojan |
| otismungus | in win98se it kept trying to access net firewall warned each time. three drive image backups on external hard drive didnt have it, therefore it was not legit. |
| Jeff | It basically renders a computer, including servers, completely useless. I'm finding it extremely difficult to remove, if not impossible. |
| Engineer | it is a virus or spyware the real file is in windows system 32 folder not just the windows folder |
| monika stoces | worm_buchon patch 2.594.00 needsupdate See also: Link |
| daniel goode | it sucks its always poping up a window giving me skit about spyware and such in the middle of games and all i hate it |
| BriBoh | Like prodigalrat, I downloaded Win2k Sp4 (last Monday night [5/11/05]) and got an infected csrss.exe (~800kb) containing New Malware.h. McAfee still can't clean, remove, or quarantine it!! |
| SaBaH007 | Windows Client/Server Runtime Server Subsystem Also, But There Is A Keylogger Have The Same Name But In A Folder In system32 |
| Rafał | If this file is running as a process from folder C:\Windows\System32 then it`s NOT Dangerous because it`s a file system, but if this file is running from another location on your hard drive (c:\, c:\windows ) then it`s a VIRUS and you must kill this proces. |
| Thomas | Is there a problem if I can find the file in /Windows/ServicePackFiles/i386 |
| Marcel von Absinthinenz | Ich weis über die Datei nichts, jedoch macht sie die Programmaböäufe zum Teil langsamer, vor allem Grafiksachen wie Videos und Animationen. Der normale Taskmanager zeigt beim Ruckeln der Bilder in diesem Programm eine hohe Aktivität. Von daher bin ich sehr vorsichtig. Ich habe das CSRCC meiner Meinung nach erst ein paar Tage. Der Rechner funktionierte jedoch ohne dem Teil auch. Also kann es weg. Hoffentlich war meine Einstellung richtig ... |
| Lance | I only have one of the files on my Computer, however everytime I connect to the internet I get multiple popups that are caused by this file and all of time say things like critical error, Immediate attention, go the the website and install this program or it could lead to a system crash. I don't beleive its legit and seems like spyware to me, Whadya think? |
| | look, you need this file... but if it gets infected, it's your worst enemy. I've looked all over the net for how to clean out the trojan from an exe file that can NOT be removed... and no one seems to know how to do it. Good luck... and if you find out, let me know, but i'm going to back up all my files and reformat the disc. |
| SRed13 | I've had this as part of an annoying AIM bug my kid sister installed for me, there were three instances of it running, two of which were MAJOR run-time hogs. Jeeze spyware guys, I would never have known about the problem if not for the CPU moving slow. They should get their act together. |
| Cantaro | Este proceso, al activarse muchisimas veces lo que ocasiona es una baja en el rendimiento del CPU. Si no es dañino y el legitimo iniciador de tal proceso es el propio Windows, quizá entonces se trate de un Error de Windows pues atenta contra si mismo al no optimizar sus procesos. |
| DavidC Techman | This file is an important system file for WinOS,its a servcie that must be running at all times, SpySweeper is in fact a spyware in itself (Do not use) Ms-Anti Spy and Spybot Search & Destroy are defensive anti spyware programs. |
| Big Sid87 | I have 2 0f these csrss processes running and one of them uses up to 100% cpu so i have just blocked them with my firewall!!! Reading what u guys have posted, I think I should'nt have done that!!!! |
| | i found 2 copies one in the system32 file then my antivirus found system32\zbefrsdqwj\csrss.exe and deleted it now every time i boot up it says it can't run it |
| Acid Burn | CSRSS.EXE in caps lock is a trojan virus. It sent mass emails from my PC. Was stopped by ZAlarm. Is still undected by most malicious trojan removers. |
| Goro | Maybe starting windows with anti error mode will be posibly delete it but one thing is sure : those Pop-ups are a pain in the ass!!! |
| ryan | this is a windows file that is harmless but is easily confused with a various malware files ( similar names to trick u ) |
| sertach | i lost my csrss.exe file.where or how can i download it |
| Matze | Nix !! War nur 1. plötzlich verschwunden und PC kaputt |
| | this is a pricess,i think ,found in system32 |
| dcl525 | Googled it, screwing up my laptop See also: Link |
| Seth | If this file is in the Windows directory and not in the System32 directory where it belongs, it is probably a virus or worm. In my case, it was popping up something every minute or so, but it was being blocked by windows or explorer. I don't know which. The result was a default beep and the current window losing focus or if playing a game, the game would minimize and I would see my desktop. One of the worst annoying viruses I have ever encountered. I wish I knew where it was from. |
| Whitey | This file is a normal windows file and is used on startup. Although I recently downloaded file from a link from Msn Messenger, and it then copy itself into my registry files so ther was another csrss file. Then it kept sending download links to all my MSN contacts and and created a registry file where I was unable to visit Antivirus website e.g norton.com/help and also it disables your AntiVirus Software but only delete it if you KNOW you have it and you will know about it. |
| Taylor | can or cannot be virus, but you should only have one anti virus runnign at a time or it will slow ur computer. plus some computers with more then oen user will have more then one csrss.exe file runnign at once. this site doesnt really help u fix problem cause different ppl say different things, try callign an it guy or microsoft help desk for information on how to solve this, im still not sure but i used my antivirsu and spyware to take it otua nd im fine. |
| actic | I searched for this file with Agent Ransack and found two copies, one at c:windows\system32 and one at c:windows\system32\dllcache. I went to look at the folder called dllcache and couldn't find it even though my system is set to show all files and folders. Using Agent Ransack I was able to delete the second copy of csrss.exe, but now how do I get rid of the mystery hidden folder dllcache? |
| Kanwar Manish | The information that if in system32 folder was right - I could find csrss.exe at three places - ones in the system32 and i386 folder were 6 kb in size and the one in the winnt folder was 26 kb. I deleted the one 26 kb in size. In the process explorer from sysinternals - the probable virus showed under the Explorer.exe group and the original system csrss.exe showed under the System group. |
| sd | Ice Sword indicates it red that scares my a bit and I don't understand Chinese ;~). But SysInternals Process Explorer tells that it is Client Server Runtime Process from MS and has been started by smss.exe Windows session manager. So I guess it will be ok, I will try Security Task Manager to get a third opinion. See also: Link |
| arasta | nasty bugger. a version of Chode ? i believe will drop this one also - i recieved a 'vbulettin' link via MSN (not VBulletin, note spelling) not realising the dodgy spelling and infected myself...:S bastards. comes with a couple of other nasties also, so thats another infection vector - beware of msn links! |
| Dan | I have two of them running at the moment, one which looks like legit because it is running as a SYSTEM proccess, while another which is using from 95-100% CPU usage is running as my computer proccess. I cannot stop the computer proccess because it just says this is some imporant file and cannot be ended. |
| Curran - Canada | I recieved a mirror file from a mass mailing called csrss.exe. I then started massmailing other people. The programmer entitled it the same as a system process to confuse windows and is thus known as a mirror process. However, this is the first mirror process that i windows has not allowed me to end. |
| =P | This file pop up a window regulary (realy often) says that youa aproblem with you windows or your messenger, but isn't true in many pages sayy that is a virus, but it can't be eliminated like you usually doy whit this thing, I'm traing to take it out... |
| Noel | csrss.exe is it's name, according to Windows Task Manager. It fires off popups that warn of registry corruption and insists i venture to any number of websites (that rotate through popups). It doesn't redirect, however, only disappears when closed |
| Riyad Proshikanet | when i am working with internet suddenly a message displayed you virtual memory is minimum too low. i use task man and found that csrss.exe process is running. i am click ok button of error dialog box to close. then what can i do ?? |
| | bei mir wird , wenn ich im internet bin, etwa alle 5 min. eine nachricht angezeigt, in der steht, dass ich auf eine bestimmte seite gehen soll und mir ein update herunterladen soll, der dazugehörige prozess ist allerdings csrss. |
| Rakeela | My copy of csrss.exe in the windows\system32 folder was replaced by a crippling virus which used it to shut down large portions of my UI, proving that the file can be a danger even if it is apparently in it's proper location. |
| Fuzzy | Okay I'm just going by what Rafal said So I delted it from /Windows/ServicePackFiles/i386, but I was smart and made a restarte point before I dleeted it.. SO Yeah. |
| | It was manipilated by a virus on my system some kind of scanning flooding bot "chodebot" and it was able to add it self back to startup after i had removed it. |
| nick | nothing i need to get riod of it i ccidentally got it from my sister getting it off an msn block chacker ive tried deleting it but it sais cannot delete |
| Shayne Spackman | I found that Google Desktop was causing this process to go through the roof. Once I stopped Google Desktop, it's usage went down to zero. |
| Whitey | Worm which in some cases can change registry files and block some website from being used e.g mcafee, norton |
| Ajeeth | Client/Server Runtime Subsystem(csrss), its very useful file for console and client/server environment. |
| risa | my McAfee kills it and it come back all so this a is a trojan that is full of spyware 386 in all |
| | Mine is located in C:\WINDOWS\SYSTEM\bccfgkfev. Is that okay, bad or dangerous? No idea. |
| antycsrss:) | It may be dangeours and shutdown your system. did you tray to kill that process? I can't |
| MCB | its a trojan if its in your windows/system.. rather than system32 |
| Archi | im Spyware Doctor Download ist ein Backdoor programm Toll....: ( |
| Juan | a way to remove this virus from your computer... see link See also: Link |
| jamicat | It opened several AOL IM windows spamming every sec... See also: Link |
| | it comes with block checker tapiwa |
| dregs | reloaded windows and after reboot,virus rolled back my computer |
| Henrique | I had an additional csrss.exe file in System32\dllcache, just as Ben from Pennsylvania had. It has made the laptop impossible to use, so slow I could eat dinner waiting for IE to come up. Thanks to the information on this site I have found the culprit, I think. Thanks to Ben also. |
| Shane | Horrible computer destroyer. This was received through Instant Messaging. Beware! system32\yjnceyjkd\csrss.exe |
| Dolan miu | This is a dangourous file. I got the "csrss.exe" virus by installing the msn block cheaker. Because windows task manager detects the name "csrss.exe" as a critical system name, it would not end the virus called csrss.exe.... (stupid i know). I got an alternative task manager caled proccess manager, and it ended the faulty csrss.exe |
| Chaitanya Korde | Its a VIRUS |
| jake_TAPGSM | its a system file,but almost dangerous cause other virus progs can launch this to execute their stealth capability |
| casey | messenger service keeps popping up - talks about critical downloads needed - go to process try to end it - but windows will not let me |
| Alex T | This is one bastard of a file! I know the file is needed by windows, but the needed file can be infected so the required file is in fact a virus. Every few minutes I get a pop up that stops any other program I am running. So the process can't be stopped, the file can't be removed and anti-virus apps say the thing is fine! |
| David Parleur | csrss.exe is mostly the main executable for the microsoft client/server runtime server subsystem. But it can also be an infected file with the worm W32.Netsky.AB@mm worm. i had a problem with this worm before and i couldt use the coumputer after that. My computer just keept restarting every time i log on to Windows! |
| B.J. Dail | CSRSS.EXE was the process found running for a notification. The notification is always on top, so unless you put it off to the side of the screen, all apps will be under it even if the app is the current active window. having network problems. The CSRSS.EXE I got is an ad for www.downloadpatch.net. It's an Win 'Messenger' imposter. Suggestion: Never believe any notification that comes up without the Windows alarm soundbit. Got it while waiting for ISP and Norton lvupdate to load. This is the worst virus for slow dial-up, since it can catch you before you can protect yourself. |
| | My laptop boots up faster due to the files disapearance. It was in a subdirectory of system32. The first time i knew it was there was when i booted up and got the message that the system couldnt find it. Legit one still there. Laptop boots mega faster |
| bandgeekmafia | Still affected my network after re-ghosting some of the machines |
| dark A. | system32 it run sumtimes!! |
| Google (the smart way to research) | If it aint Broke then Leave it Alown. But if it's constantly using CPU Cycles then invistigate thurther, as it just may be a virus or somthing gone wrong with windows. |
| sdirkx | I had popups ("messenger-service") of suggested SYSTEM ERRORS. There were 2 versions of CSRSS.EXE on my HD. One in WINDOWS/SYSTEM32 and one (the bad one!) in capitals in the /I386-folder. I deleted the bad one and don't have the annoying pop-ups anymore. So it seems to be not very harmful and easy to clean. |
| | make sure the file c:\windows\system32\csrss.exe is the one running. If it is in c:\windows\ directory, it could be viral. |
| DominantHeart | A needed Windows file |
| John | it crashes alot with nero show time under hardware acceleration! |
| Willzx | its f'ing spyware under the same name as windows file |
| Thanks | I have it in C:\Windows\system32 and C: \Windows \sytem32\dllcache. There's also one in prefetch dir CRSS.EXE-22452D1B.pf and CRSS.EX_ in C:Windows\I386 Any ideas if these are all legit? |
| Jason, South Korea | As many opinions above, It seems to be one of windows runtime subsystem, and mine is loacated in c:\windows\system32, and c:\windows\system32\dllcache directiories, and it's 6144 bytes. If virus is infected then the csrss.exe file will be bigger than 1MB and located in c:\windows. I use winXP sp2 |
| Peter | It is being used by a rouge program to produces many annoying pop-up messages from the Messanger Service to access a site because your registry could be corrupted. The only extra copy of csrss.exe was in an upgrade dir. It was the same size as the one system32 dir. Still can't get ride of it... |
| BeAn. | Great site Admin, I've checked this csrss.exe (originating from C:\WINDOWS\System 32) with eset's NoD32 antivirus scanner, with xoftspy and NoAdAware 3 and all systems are normal. |
| Javier Arias | Chek version info, & date stamp. If it is the same of all Op. Sys. files, it is authentic. Else... delete. |
| janosch | ist evtl öfters vorhanden. gehört zum system von windows, aber nur im system32 ordner, alle anderen datei diesen namens gehören nicht auf den pc und sollten entfernt werden. aktivieren tun sie sich beim einschalten des pcs |
| Chia | it ran on mine as the bridge virus, computer was not happy, constant hacking and lots of shutting down. |
| TRex2003 | windows file..controls interactions between programs. |
| virus | See also: Link |
| Advis | It made Avast antivirus program go crazy..several pop ups which included email addresses and the file name CSRSS.EXE. Then I ran security task manager scan which found out the file indeed was dangerous and removed it. I really hope it´s gone. In that case,Thanks! |
| JFK2 | All that happens is it pops up when ever my computer logs on. No problems besides that. |
| devotee | Some sypware use this name because windows disallow you to end process it, I found it in copy-protected CDs but now I can kill it See also: Link |
| NoVaTuRiEnT | It's just a windows file that takes up exactly 3,312KB of memory. Also, i don't have virus removal programs installed and the Firewall is disabled lol - If someone stuffs up my os and prevents it from working, i personly wouldn't care (i'ld be like: yay! I get to reinstall XP again :D) |
| harry | path to this file at my pc is ??\c:\windows\system32\csrss.exe |
| -N Gh0st | If this file is running as a process from folder C:\Windows\System32 then it`s NOT Dangerous because it`s a file system, but if this file is running from another location on your hard drive (c:\, c:\windows ) then it`s a VIRUS and you must kill this process. -- quoted from Rafal..This is incorrect! A virus can infect any .exe .com .bat and anything in windows sys32 folder. People that are seeing two instances of this running one of them is dangerous! |
| Will | I have two on my system, one in system 32 other in \Service Pack Files i386m so is it safe to delete the one not in system32 folder? |
| TheYak | CSRSS.EXE (all caps) was causing me problems. I booted into Safe Mode (restart machine, press F8 during bootup), searched for all filenames containing csrss and deleted them ALL except for windows\system32\csrss.exe (the only good file). See also: Link |
| | The csrss.exe was found in C:\WINNT, moreover, my anti-virus software also identified it as a virus. |
| Stanislavs | Microsoft Anti Spyware once popped up and told me that csrss.exe wants to be a startup file. I didn't know what was it so I came over here, and after reading this, denied all access to it. I noticed file in C:/Documents & settings, and C:/windows. As I tried to remove it, it didn't work. However, MS Anti Spyware blocked it from starting up, so I rebooted, and removed the malicious file with no problem. |
| jeff | I suggest to allways have a backup ghost image of your hardisk. Oh yes their is a way:) |
| Dimitris | It's a worm. It sends thousands of emails per minute. My firewall blocked it. |
| Mark S. | I hav WinXP Home & locked this file out N my firewall. I've never had any problems. |
| ?ITGuy | csrss.exe is a windows system level file frinitely. But in my case it's causing the Windows XP system to reboot everytime I install Backup Exec (Deskrop & Laptop Agent) |
| T in Germany | The only way to fix this is to uninstall and then reinstall your AV software. Not good for 2 reasons. 1 if you were successful in using the End Program option on the virus you will have to restart your computer twice to un/reinstall your AV. *SIGH* 2. you'll have to play the catch it at windows load until you beat all of the virus loads again to reinstall your software. Trust me, you'd find it easier to pull your own teeth. I am still looking for a way to get around this thing. The other bad news is eventually this thing will invite another virus to your machine. |
| Rissa | SAFE if in c:\windows\system32, VIRAL if anywhere else - usually a keylogger in this case |
| Adam | well, its a worm, its 155.5kb (or something like that) its the file thats hidden. |
| Glan | When i tried to shut down my computer my cpu usage went to a 100%. I almost couldnt shut down the programs i was running cause my pc was so slow. I checked my taskmanager and i saw that csrss.exe was using 99%! It made my computer nearly freeze so i dont know wath went wrong. |
| jack | should never be in the msconfig.exe/startup, if it is, then it's most likely a virus/worm/trojan |
| Jason D. | I had clicked on a link from an msn contact and downloaded a file, it then added a protected operating system folder in c:\windows\system32\odhrtlkr this folder consisted of csrss.exe win.ini and smss.exe, this files were being used to exploit my system. The best program to Identify this is Hijackthis.exe, i had to log in as a different user and delete this file. Then edit the registry keys located in Hijackthis |
| George | To get rid of malicious csrss.exe, (1) search for all files csrss.exe on your computer. (2) open powerful alternative task manager like "Process Explorer". (3) Now, when you kill the csrss.exe process with "Process explorer", it will be terminated, but will start right back up again. Terminated it, and the immediately switch over to you search results and delete the csrss.exe that isn't in your \system32 folder. |
| Stringer | Download speed dropped from 400kb/s to 20 kb/s about a month ago. ran virus checks, no luck. got modem replaced no luck. reformatted HD and re-installed factory software no luck. deleted the goddamn sob scrss file from i386 and my dowloads are back over 400kb/s! |
| Dino_nut | I can't be sure but I think this thing piggy backed in on something from emule. Anyway, mine is doing the win message warning me about file corruption and virus' and is trying to send me to non-microsoft sites to fix it. Unlike most of you I haven't been able to find a second copy of the csrss.exe, but that is definetly the source, I tried a windows reinstall while saving my files but it must have gotten saved because I still have it. Has anyone contacted or recieved information from Microsoft about this, I'm preparing to cut my losses and do a reformat to kill it. |
| Aaron | I know that I just downloaded this software, and the virus just shuts it down, before it can run. |
| Kent | I had a lot of errors with this program. I say reinstall/reset if your computer is running slow on startup. |
| sreenivas reddy | well this file is troubling me a lot whenever i open any application this file initiates an error command like mvscpr71.dll not found and my system is unable to open any application |
| Noemie | I have one csrss.exe, and it gets frequent pop-ups to buy regfixit, repairmyxp... the popups are fakes and annoying, and I haven't figured out how to get rid of the problem yet |
| Antoneey | A file that I cannot locate and does constant CPU Cycles .. need some help.. slows down just about everything!! |
| Bobby UUU | if you want fast and easy removal instructions without downloading anything because it seems most of the people on this site dont have a clue what they are talking about. |
| RichMobile | I kept seeing Windows Security Center saying my firewall was shut off, as well as automatic updates. Also windows firewall was set to group policy, so you could not enable it even though group policy was not configured. Additionally there was always a mysterious connection to stealth.insert.si Booted in safe mode, deleted the csrss.exe from \windows and all is good now. |
| Crowner | Client Server Runtime Process (csrss.exe) - From Microsoft® Corporation (A standard-process from Windows, the link is for Win 2000 but its the same in Win XP) See also: Link |
| Raj | I went to my Program Manager and saw i have 2 processes running under the name csrss.exe. Both have the exact name (no capitals) - yet one of them is using 80% cpu usage and the other is using 0%. I tried using spysweeper and adaware, but they couldnt detect it, probably because of the name. My spysweeper keeps detecting it on startup and i dont know what to do. |
| SuperMan | The one that has the username SYSTEM is legit the other one that has your username like "John" or "Bob" is probally spyware and should be deleted. See also: Link |
| zoran | I am convinced I was infected by csrss.exe by install the win2k sp4 downloaded from microsoft. |
| bestop | always his prioprity is 13, & his parent process is smss.exe |
| Williggin | Win NT4/200/XP/2003 only CSRSS is alson know a Win32 Subsystem. Integral part of the OS don't change it. |
| John | csrss.exe is the main execultable for MS Client/Server Runtime Server Subsystem. It is not important for stable and scure running of your PC and should be terminated. |
| Durty Sanchez | It's making my Photoshop Cs2 run slow as hell. Photoshop is using 75% memory, csrss.exe is using the rest 25%, so I'm at 100% !!! WTF??? |
| | well, i know that it was insalled into my computer with the installation of the program "all in one" which is a keylogger i used to log everything on my PC, its reason for stopping your access to stopping or deleting is because it thinks your an intruder trying to terminate this program from logging everything, from my research this file is harmless. |
| Joost | Mine csrss.exe is in the windows 32 folder where it's suppused to be and it is 6kb big, which it is suppused to be. But after I opened a downloaded program which ended in an error. crsrr.exe desperatly wants to modify my register and acces the internet. I don't trust it, but don't know what to do. Can I copy csrss.exe from another computer to mine? |
| Andrew | This file is legit when within the system32 folder. Anywhere else... It is a virus. |
| Kris | A needed windows file that is a 2 sided blade viruses are often writen to target it and do its evil with use of this file |
| Jonathan C. | I got this file through a MSN message saying 'hey is this your profile? [insert link here]'...the file was under C:\windows\system32\qoubicy\csrss.exe! watch out. |
| | We had it come to our computer through an unknown source, perhaps pop-up downloads. it is the worst thing that has happened to our computer, it slows all processes, and attaches itself to any form of media device that comes in contact with the system. IT poeple haven't been able to remove it so we've just had to put up with it. Dont accept this file and if you have it try to get rid of it ASAP |
| Dennis E | This process prevents any link with Google in it to freeze (Not Responding) IE 6 or 7. The process goes to 100% when a Google link is tried. Rebooting will "calm it down". I got rid of all csrss.exe's from the hard drive. Still the problem exists. Starts with "Assert in LSP" anyone else seen this or have a solution for all of us? |
| mark | this is part of the windows messaging service that can cause unwanted pop ups and ads to appear on your computer. it communicates with a remote server without your knowledge and is usually overlooked by many av's and spyware programs because it is a legitimate system process. spysweeper specifically shuts down the windows messaging service and kills this process on my computer with no ill effects whatsever. a few times i've gotten warnings from spysweeper that csrss was tampering with it and caused spysweeper to kill the csrss thread. the tampering csrss.exe was in the system32 folder |
| adul | this file is not dangerous and essensial for windows to run correctly |
| Dan | It's a system file... but it's infected and it keeps trying to uninstall my wireless network... which it once did, and I had to re-install, also seems to bring up that system doctor virus which tries to make me give them money |
| Matt H | just search it under search, look under your HD, its the only one that isnt under system32 and its in all caps. easy to fix, danm. thanks a ton man. |
| | My a-squared anti-virus program detected it as a backdoor/trojan even though it was located in the windows/system32 folder. Then it tried to remove it but it came back after I restarted my computer. It started showing up in the process manager after I accidentally opened a suspicious file from Limewire. |
| Pepe | WINDOWS FILE |
| OvEr-cLoCkEr~UK | If a process is named in upper case letters then it a good chance it a trojan,worm ect,run all of your cleaning software in safe mode with system restore disabled,and all caches emptied ie,internet explorer See also: Link |
| shamugratnam | i keep having popups that when i bring to process using task manager it brings to csrss.exe |
| Ricardo | it never appeared in the taskmanager until i opened an email with an external link to a postcard from a friend. It then started to place a trojan, but my anti-virus (avast home edition) blocked it. Unfortunatly i allowed it in the caution windows from the anti-virus. It then started to open pop ups and didn't allow me to shutdown. The anti-virus was always closed by the trojan. I used the Spyware Doctor to try and remove the trojan. The file itself has no problem, it is a system process usually enabled manually... if it is opened and you didn't activate it... there may be something wrong... |
| heXXen | csrss.exe is legitimate when there is only one actif and in smallcase (do not remove), some adwares exploit it to show messages on the screen. u can disable the csrss.exe's function of showing messages by going to the control panel- performance and maintainance- administrative tools, then doubleclick services then disable messenger See also: Link |
| ©2006 Microsoft Corporation. | This is a basic windows file however as noted above, duplicates can be made. This can be caused by opening the file twice, in which case - creates a ghost file unused in the task bar. Another uncommon cause is infact spyware. No care is needed in deleting it as windows will not allow for the genuine program to be deleted. See also: Link |
| PV2 Brewer | If the U.S. Government lets it run in their computers then how harmful can it be. In AIT we have this file runing all the time so it can't be all bad, but it you need more speed feel free to close it. However do not delete it from the windows folder. |
| mshhour slman ibn sleem | copy itself |
| Jeck Lamnent | Csrss (Client Server Runtime SubSystem) is safe if in your system32 folder. If its being run for other places then maybe you have a fake duplicate. |
| toti hari | Some times its make the pc processor to run at 100% and block the computer to working. |
| | It is yet another Microsoft gifts. It is not a virus. |
| | csrss.exe displays an error box when my dll won't load, it says that under process explorer that csrss creates a thread that displays the rror. I was tracking down the dll error and stumbled across it, I have never heard of it before. |
| shadow | windowsdatei |
| 42 | I have two copies of the file, one in the system32 directory and one in anonther direcotry (system32/drivers) the one not in system32 directory it is not a windows file but a trojan |
| Sekaria | Der Prozess kollidiert mit Antivirus-Software wenn diese mit einer Personal-Firewall verbunden ist. Die Internet-Security-Suite versucht den Datenverkehr zu kontrollieren, csrss ebenfalls. Es muss also nicht unbedingt ein Virus sein, das Störungen verursacht. |
| Staffan | as above it´s a trojan with same name as an essential file. However i don´t know in which world some lives in when they say just delete tha process in taskmanager. GOOD LUCK... this is a critical system can´t delete it. Now my pc bluescreens after 10sec after i logged in. only work in safe mode. And then i try to instal antivirus program but i can´t since i run in safe mode.. ARgghgg. if you have similar problem like i do and have a solution i sure is interested... |
| Tom | Could be Worm Related See also: Link |
| kkk | i keep having popups that when i bring to process using task manager it brings to csrss.exe See also: Link |
| Alenth Eneil | I had two, both in lowercase, but a second one was in C:\WINDOWS\ServicePackFiles\i386 and was apparently a virus, it ate up my processor power to the point that I couldn't do anything. Apparently not all the malicious versions of it are in caps? |
| uh guy | mine was running from a file \\??\\C:\windows\lastgood\system32 i dont know where it is, its not in my systen 32 file and no virus scanner can find it |
| | Every computer haves a virus or spyware/adware,, you can't do much about it,, pple make it and ppl hate it,, how much you spend on anti-virusses and ....,,, it doesn't matter there will always be some virus that will irritate,, I have norton antivirus 2007,, avg free,, avast! antivirus,, and still I've got these virus, spyware |
| Phil | My avast! antivirus handled this thing well. But still when the system starts up an application called update.exe tries to start with error : system.dll was not found on this system reinstall the application avast deleted system.dll leaving a crippled program which creates a STOOPEED warning screen every time i turn on my PC. Im going to mac anyday now |
| mike382 | Well, i only have 1 process of csrss.exe and it is on system32 and other copy of it on system32/dllcache, but i have none on CAPS but i still get this annoying messages from a "Messenger Service" saying my registry is corrupt and give me tons of different pages i haven´t even visited, still, i have BitDefender 9 Professional Plus and it is not detecting it... I cant get rid of it... im still trying... |
| CyberForceField Creator | Once again, like all system files, even the legitimate system file of Windows called csrss.exe can be used by spyware and keyloggers to attack your computer. Therefore this process has to be monitored closely! The legitimate csrss.exe is important for Windows but can be dangerous and abused by malicious kernel drivers (hard to detect) and should not have Internet access! |
| | The real one is a system file, not a user file right? |
| ultio | Just a Windows process, there isn't a matter ! |
| RoseQ | Running a search for csrss in files and folders on this computer located 1028 entries, maybe 2 of which could be legit Windows (4 KB files in System 32 and DLLs). There's also about 1000 files that are listed as configuration settings and.dat files going back to 2005 and ending the day before I installed AVG Free. I've also got a start-up file called csrss.lnk (which I've disabled) and some recent Internet short-cuts to csrss.ini which i didn't create! What a mess! |
| Thickness | First of all a windows file, but if it's direct in the windows xp root, it's a mass spam mailer, which sends mails trough yahoo! |
| Sherlock Holmes | Infection found on my machine by Acronis True Image team as Windows was spontaneously shutting down during backups. They had me remove this as it appeared in c:\windows\prefetch\CSRSS.EXE.12B63473.pf. There were 2 other files labelled csrss.exe, both in system 32, one a .dll, but I was told to leave these alone (I am no computer whiz). The suspect file deleted easily, and on reboot (which was recommended) I searched again and it was gone from the system. I was told it was a non-dangerous virus by the Acronis techs. |
| hasbriale | I had no Idea this was creating an havoc on my computer every time I log on to the internet. Another screw up of my latest reinstall of XP. DAMN!!! See also: Link |
| kelvinboy | When terminated by another process (not task manager) the system will be rebooted |
| | Do yourself a favor and get a mac. |
| willie ha | Recently found i was sending a tremendous amout of packets and had no programs running, found crss in the internet explorer folder put it in the trash can and internet went back to normal |
| Ovidiu CRISU | My csrss.exe file was located where it was supposed to be, C:\WINDOWS\system32, so no virus, trojan, logger, etc. However, I was experiencing 100% CPU load when working in MS Excel. After reading this info page and a KB article from MS, I decided to erase the profile files stored locally as well those stored on the domain server and voila, no more 100% CPU load, problem solved. Hope this helps See also: Link |
| Xano | csrss.exe is main exe. file and can't be terminated. some trojans can copy themselves right into the csrss file making them impossible to delete. I used norton antivirus to find this out, it can't remove a file that is a critical process.manual deletion will cause crashes. |
| Scribnar | CIA Rate copies the server with this name |
| Ian | Someone please tell me how big winlogon.exe should be... i have found two on my system: c:\windows\winlogon.exe is 152kb, c:\windows\system32\winlogon.exe has a different icon embedded and is 491kb |
| Ian | I now have spam coming out of my computer (sending all sorts of things such as viagra advertisements) thanks to this trojan. Whenver I delete it, it gets created again by 'winlogon.exe' so now I have to investigate how to clean my winlogon.exe |
| Khul | "La actualización de seguridad actualiza un archivo .exe (..) Sin embargo, no puede forzar la detención de este proceso a menos que apague Windows. Por ejemplo, Csrss.exe es un proceso requerido en Windows." de : http://support.microsoft.com/kb/887012 Saludos See also: Link |
| Sandeep Luthra | It is a critical system file. |
| Sandeep Luthra | It is a critical system file. Does this process neeed to access the internet? I've been blocking it. |
| | its a runtime thingie if you have dupilcates of it |
| Paul C | I had to copys of csrss, one real one on system32, the second stashed somewere else as a viruse. I noticed it because the bogus one also seems to constantly run at between 90 and 100% of the CPU ALL THE TIME!! |
| l.thorpe | suspect danger |
| Anonymous | I have two of these, but they are both in safe folders (C:\I386, the drivers, and C:\WINDOWS\SYSTEM32, the win32 folder) so I know I am OK. |
| Gilfumaster | Never Had before and should up about a week ago. Slows down my system when using internet explore....also forces my iexplore.exe to run at all times, even though I have no window open with the program. Slows down, with annoy small freezes. |
| Ucrazy51 | This is normal for Vista See also: Link |
| RNA | This program was using 50% of CPU time untill I stoped nvsvc32.exe (the other ~50%) |
| | Perhaps somebody should sue the company that the pop-up is telling us to visit to cure the probelm. I have emailed them but never get an answer.CSRRS.EXE in upper case does not exist on my machine. Only in lower case in System 32 and you cant delete it, and if you chnage the name another program appears in its place. Its a self scripting thing. |
| Diesel! | It's a Client/Server Runtime Server Subsystem, this is a legitimate process required for the OS itself. Any attempt to end this process will cause to system failure. It can be a virus also!!! It's legitimate place is under the directory System32 , a virus cannot get the same name under the same directory, it will try all ways to be looking as it. U need also to kno the real names of OS processes to not be tricked! A cute example will fit, there is a big difference between csrss.exe and csrs.exe. Clear dude? |
| Unidenman | One way to determine if csrss.exe is a legitimate file besides looking at the date modified is to right click on csrss.exe inside Task Manager and attempt to end process. Because csrss is a critical file, Microsoft should inform you with a message that csrss.exe is a critical system process and end it is not possible. |
| GreatSnipe | csrss.exe the most powerfull and intelegient virus i have seen until now.,, i prob got infected trou a msn password finder,, this exe file is a locked by the windows system and cant be ended in task maneger, and it is using 100% cpu and is closing every prog i try to start,,virus prog norton-avg-norman and som spy ware progs cant find it so it is a good one.. i needed to reformat my pc to loos this thing damn this is a good one.. you guys is saying it is just a sys file,, haha damn you are wrong its a virus/trojan made to be protected by the win sys itself. a back door the virus prog cant see |
| WORM CREATOR | Continuation of Post: what i was saying is like the guy above, my computer pauses for about 5 seconds about every 30-60 seconds. I have 512 RAM now, and computer is only using around 200 RAM to run. So when my computer [pauses] like that, it is sending Logged keystrokes to some little jerk some where huh. Gosh, i just reformated my drive and partitioned with partition magic into 8 drives. I am sorry for tryin to be funny- i am about to through my computer through the damn window!!! |
| Comicrack | Meine infizierte Datei befand sich c:\windows\softwaredistribution\download. Ich habe den kompletten Ordner "Download" gelöscht. Seither ist Ruhe - auf Holz klopf! |
| pooperscooper | Client Server Runtime Process |
| Why | This file can be a System File, which would be located in C:\Windows\System32. If it is in there, or if you have two instances, see which one is which, check where the other one is. If it's somewhere else than in the System32, DELETE IT. It will be a virus. |
| listeningriffin | listen to post by heXXen!! I have had this problem awhile and that link explained and cured it instantly. no dowloading or anything. easy 123. thanks! |
| Lappen | -- when it's in Windows/system32 ... its ok athervise destroy it |
| Maniac784265 | I noticed this file after I fully throttled my HARDWARE ACCELARATION in the display because I could not play Age of Empires III with my GeForce 7800 |
| skh | It removed control panel, my adminastrator access, win explorer,all administrator tools and privelages. It keeps changeing homepage to google. Can't access symantic or window updates. Keeps running a spyware popup. Keeps returning after reboot. Keeps loading trojans after cleaning and reboot.It wins this round, time to wipe and reinstall. It maybe just a required system file but there is much more attached to it. Read and tried all the above suggestion and comments. Thanks for the help but it is a bugger. |
| james | i got this error saying that it cant find this file C:\WINDOWS\system32\ltruoggkeo\csrss.exe and their is like something wrong and its been renamed or something???? every time i restart |
| sto | Client/Server-RUntime |
| Kick My A__ Bill | You are so dumb adul, It is true that CRSS.EXE is a file being used by windows to run properly but, viruses or worms can disguise themselves as the CRSS executable. My computer got a bluescreen because of this file. |
| will | this file is driving me crazy! based on info i've found it is a critical file however I only have one of these processes running and it gives me a pop-up every 7 seconds. Can you understand how this would lower my quality of internet? i want to throw my computer in the garbage! I don't know what to do, my computer won't let me end this process and internet says i need it but if this is what internet is going to be like, fuck it coz i have enough stress without closing 72 pop-ups all because i left my computer running for an hour when i went out! |
| SuperUltraMega | When the virus of the same name infects yor computer it will eventually cause process failures all over the place. From my experience after infection it caused IE explorer to foul up, and then a multitude of system process to fail. So much so that a rebuild was in order. I made an image of my PC before rebuild for analysis. It appears this came in with a Microsoft Money Hack my wife found in limeWire. If your Virus detection software is up to date, it will easily detroy this little pest. In all honesty it's an amatuer virus at best. Just goes to show everyone gets caught now and then. |
| Jim | Windows SYS 32 file |
| tarique khan | Every attempt has been made to provide you with the correct information for csrss.exe or AHLEM.A WORM. Many spyware / malware programs use filenames of usual, non-malware programs. If we have included information about csrss.exe that is inaccurate, we would greatly appreciate your help by updating the Process Information database and we will do our best to correct it. |
| Harish | SAFE if in c:\windows\system32, VIRAL if anywhere else - usually a keylogger in this case csrss.exe known as Ahlem.A Worm csrss See also: Link |
| Joshua | This infected my friends laptop, and I finally figured out that it was disguising itself as a folder here: c:\program files\common files\system. There were two such system folders in this directory. One was real and one was the trojan. Unfortunately, I don't have admin priveledges and couldn't delete it. Also, there were two other parts in windows\Prefetch with appended filenames ending in .pf which need to be deleted, and one windows\servicepackfiles\i386, but I couldn't delete that one either. |
| human being | it has been ok 4 me i have it in C:\WINNT\ServicePackFiles\i386 and C:\WINNT\system32 the only weird thing is i keep geting this 1 popup that says that i need 2 restart my computerit comes up every 5 min or so and gives me 4 minutes b4 it restarts my computer unless I press cancel. I am still looking 4 another virus. They are both 6 kb. the 1 in system 32 is capslocked and the 1 in i386 is not can anyone give me any extra info? |
| da-1-to-fix-them-all | legit file |
| gtamad | well i have two of it running and it only found one file... they are exactly the same and both are running with no capital letters so im just gonna say its a duplicate xD |
| dvnt bstrd | csrss.exe is legitimate, but I found a handle called kdmgk.exe embedded in mine. it's redirecting dns :( |
| TechPro5238 | csrss.exe is a main system file for windows. It can only be in C:\WINDOWS\System32 to be safe; otherwise it is apart of a piece of malware. -- Note for all trainees, you will find this in a lot of logs. |
| Tim | Windows Systemdatei - sofern im korrekten Verzeichnis (...\System32\). Client-Server runtime Modul: elementar und wichtig! Kann aber beendet werden, wodurch zumeist die Geschwindigkeit/Leistung des System deutlich zunimmt (meiner subjektiven Beobachtung mit XP SP2 zufolge - nicht unbedingt allgemein gültig!) |
|
|
