What is csrss.exe? Is csrss.exe spyware or a virus?

How to fix csrss.exe related problems?
1. Run Security Task Manager to check your csrss process
2. Run Windows Repair Tool to repair csrss.exe related Windows Errors
3. Run MalwareBytes to remove persistent malware

Process name: Client Server Runtime Process

Product: Windows

Company: Microsoft

File: csrss.exe

Security Rating:

This is the user-mode portion of the Win32 subsystem; Win32.sys is the kernel-mode portion. Csrss stands for Client/Server Run-Time Subsystem, and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and/or deleting threads, and implementing some portions of the 16-bit virtual MS-DOS environment. www.neuber.com/taskmanager/process/csrss.exe.html 

Note: The csrss.exe file is located in the folder C:\Windows\System32. In other cases, csrss.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.

Virus with same file name: Nimda.E

Click to Run a Free Scan for csrss.exe related errors

Users Opinions

Average user rating of csrss.exe: based on 530 votes. Read also the 443 reviews.

  • 27437 users ask for this file. 175 users rated it as not dangerous. 34 users rated it as not so dangerous. 116 users rated it as neutral. 80 users rated it as little bit dangerous. 125 users rated it as dangerous. 47 users didn't rate it ("don't know").

All comments about csrss.exe:
Windows Client/Server Runtime Server Subsystem Alex
can also be put in C:\\Windows directory by the W32.Netsky.AB worm, an SMTP mass-mailer  See also: Link
Windows component if file in folder Windows\System32 Alex
Legit system file Valas
My machine was hacked by someone who put a bogus hidden copy of a spyware program into my System32\dllcache directory. I thus had two processes named csrss.exe running at once--the legitimate one in System32, and the bogus one, that I discovered using Security Task Manager. The bogus one was 5.5 MB whereas the legit one is less than 1 MB. Ben in Pennsylvania, USA
be aware that althought the WXP csrss.exe is 4096kB on disk, it can take more than 4 Meg of RAM nursoda
I opened my windows task manager and saw that I had TWO ccsrss.exe files. one was in capitals... one wasn't. When windows starts, I get a message saying that systask32 isn't functioning. I get the choice to send an error report or not. I am pretty sure the viral one is the one in capitals, but I'm not sure. Rich04
This is a Windows system file, but a lot of viruses will also use this name because the WinXP task manager won't let you close it. (Great idea, Microsoft!) The real one is found in C:\Windows\System32.  See also: Link Inuyasha
Can cause computer to freeze for a second or two or totally bogg down. Work notebook has this on it using zero % cpu - home notebook does too but after installing Panda Internet Security - home notebook's csrss.exe cpu usage went to 20% causing notebook mouse to "stick" for a second every few seconds. Something is definitely "up" with this exe. Herman
It can be a virus, but it is also a Windows file. As a windows file, it can consume high % processor: enable hardware graphic aceleration.  See also: Link nafiton smith
This is the Windows client server run-time subsystem that handles Windows and graphics functions for all subsystems. Another important component of the Windows® Operating System. Nathan
Causes popup windows and cannot be deleted "access denied" and also a "critical system process" Daniel Price
Officially a system file - If you have 2 of this file... one is very likely a virus.. be careful if deleting manually as the real one is an important file needed on your pc... It is suggested you use an up-to-date antivirus software to find and remove the infected file A Techy
This file is actually a Client/Server Runtime Server Subsystem ... This is the user-mode portion of the Win32 subsystem (with Win32.sys being the kernel-mode portion). Csrss stands for client/server run-time subsystem and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and and/or deleting threads, and some parts of the 16-bit virtual MS-DOS environment. The csrss.exe which is from Microsoft is located in the c:\windows\System32 folder. It has been noted that one virus had been found that runs as csrss to hide from you. Tony (Pc Technician)
Even the legit MS-Version of this process can lockup your machine.  See also: Link Martin
Winspy uses this process to keylog, never really got it out.  See also: Link RH
Mot only system file. It is widely used by keyloggers and worms.  See also: Link zero
AdAware from Lavasoft cured this problem for me. I think It is a spyware program using csrss.exe to access the internet. And since spyware writters suck they screw it up so it bogs down your system CyberZilla
The csrss.exe process can be hijacked by several viruses, that pose as a messenger service. Don't believe any unsuspected pop up messages! Max
Picked up by SpySweeper, this nasty was really screwing up my DSL link. Caused issues with my Alcatel modem (config file truncating on load). Pages loaded painfully slowly if at all. Removed and all is now fine. Another Windows feature, thank God I also use a Mac. Nick
its a windows file Hooligan
If it shows with a big green U and small red D, then it's a trojan.
I have a laptop with a NVIDIA GeForce FX Go5650 (video card and/or driver name). Once I disabled it's additions to my system menus my CPU usage when back to normal instead of being slow at each right click or application menu click. csrss.exe was the CPU hog according to task manager, it sits at 5.45 MB on my Windows 2003 Server , and I believe the file is ligitimate on my system. Victor
I am convinced I was infected by csrss.exe by install the win2k sp4 downloaded from microsoft... prodigalrat
Many Hacking Applications are being downloaded especially vie p2p software and it is being uncomplressed to System32/dllcache/win32. You must delete te entire win32 inside the dllcache to get rid of it. Safe mode booting is required. Christian Gabriel C.
If this file is in more than one instance: virus.... If this file runs out of any folder except system32: virus.... If you have this file, check for the WTools (aka WinTools) files on your computer. I had both, don't know if they're related though. Matt
just ran a search for crss.exe...no results found! what the heck does it mean, because the process is there in taskmanager Trystan
Webroot's SpySweeper occasionally wants to access this file. Don't know why........ Dr. J
Shound be about 6K file size Kevin
it makes me nervous, because its poping up and trying to connect every time to a differetnt serves such as www.porn.com. .... why?
" CSRSS is the Client Server Runtime SubSystem. CSRSS is started by SMSS. When the user application makes a Win32 API call, it is usually CSRSS which communicates with the operating system’s Kernel to execute the API call. 3.368-4.144 kB on my system (21 tasks running, 7 user, 1 local service (svchost.exe), 1 networkservice (svchost.exe) and 12 active system tasks: 3 x svchost.exe, outpost.exe (firewall), AVWUPSRV.EXE (antivirus), avgserv.exe (antivirus), lsass.exe, services.exe, winlogon.exe, csrss.exe, smss.exe and System). Martin
This is a Windows system file. (I love microsoft...) This file very often trying to broadcast to PQ
In my computer, it is located in this folder : c:\windows\softwaredistribution\download Luchito_Gallito
I discovered csrss.exe & csrss.bin in root directory, after reading this thread I promptly deleted it. Thanks PaddyOz
I found this file running in my processes in caps CSRSS.EXE. It was located next to the acctual file csrss.exe in \windows\system32 This file was part of some spyware that was redirecting my chosen homepage in IE. It also had a buddy file called CTFMONSS.EXE Both of these files needed to be stopped by using the End Process Tree command. This command is located by right clicking on the name of the process that you want to stop in the task manager process tab window. I then deleted the files from the \windows\system32 directory and ran Hijackit to remove the other reg entries made. Brent
the link I posted in my comment was mistaken. This is a correct link to someone who reported a similar problem with this file.  See also: Link jeff
I have 2. One is the system file, the other is in the c:\windows directory. It's the cause of a keylogger that's apparently been running on my system for months. The properties say it's created by StarMicrpSdn and it's original name is Winsyst.exe. So far no virusscan or antispyware program has detected it on my system. jeff
This file started poping p suddenly asking for access to internet thru my firewall and I thought it is a spyware
i know it is a system file but i don't have any problems without it, although i only renamed it, lemme restart ;p
Windows system file
cs = counterstrike - delete it from ur PC NOW! CSsuxx
Sounds like a windows subsystem that helps keep your screen cleen between window changes Jeff Painter
I only know about this file from what I saw here. I note it just tried to "broadcast" something as I went online. This is the first time it ever tried to do so and my Sygate firewall caught it. I didn't allow access and nothing evil happened. Sygate reports it's in the System32 dir. Wonder if it's some sort of call home (MicroSoft?) thing? Jopower
Only what I saw here. I note it just tried to "broadcast" something as I went online. This is the first time it ever tried to do so and my Sygate firewall caught it. I didn't allow access and nothing evil happened. Sygate reports it's in the System32 dir. Wonder if it's some sort of call home (MicroSoft?) thing? Jopower
It's a Windows file Horst
Its fake if anywhere else but in windows/system32/csrss.exe dbpvr
Windows calls it a system file that you cannot delete. It's a very nice curtian for trojans to hide behind. It cannot be terminated, it is a client server service, so it will be exchanging data over the internet every so often, and apparently, it is modifyable. Proceed with caution Zach
This file hosted a password stealer, I got rid of it with hostdll.exe. Mike
It's a graphics handler for windows Jon
It is a Windows file, but some smartass made a trojan with the exact same filename. It embeds itself into the OS and any CDs you burn. The file initially looks like an image or screen saver (.SCR) file. Once run. the script becomes active and loaded into OS. Really hard to remove properly. I still haven't managed to get rid ot if. Puts a bunch of pesky pop-ups on your screen.  See also: Link Am
Is a Windows file.. often manipulated or copied by spyware, virus, worm, trojan
in win98se it kept trying to access net firewall warned each time. three drive image backups on external hard drive didnt have it, therefore it was not legit. otismungus
It basically renders a computer, including servers, completely useless. I'm finding it extremely difficult to remove, if not impossible. Jeff
it is a virus or spyware the real file is in windows system 32 folder not just the windows folder Engineer
worm_buchon patch 2.594.00 needsupdate  See also: Link monika stoces
it sucks its always poping up a window giving me skit about spyware and such in the middle of games and all i hate it daniel goode
Like prodigalrat, I downloaded Win2k Sp4 (last Monday night [5/11/05]) and got an infected csrss.exe (~800kb) containing New Malware.h. McAfee still can't clean, remove, or quarantine it!! BriBoh
Windows Client/Server Runtime Server Subsystem Also, But There Is A Keylogger Have The Same Name But In A Folder In system32 SaBaH007
If this file is running as a process from folder C:\Windows\System32 then it`s NOT Dangerous because it`s a file system, but if this file is running from another location on your hard drive (c:\, c:\windows ) then it`s a VIRUS and you must kill this proces. Rafał
Is there a problem if I can find the file in /Windows/ServicePackFiles/i386 Thomas
I only have one of the files on my Computer, however everytime I connect to the internet I get multiple popups that are caused by this file and all of time say things like critical error, Immediate attention, go the the website and install this program or it could lead to a system crash. I don't beleive its legit and seems like spyware to me, Whadya think? Lance
look, you need this file... but if it gets infected, it's your worst enemy. I've looked all over the net for how to clean out the trojan from an exe file that can NOT be removed... and no one seems to know how to do it. Good luck... and if you find out, let me know, but i'm going to back up all my files and reformat the disc.
I've had this as part of an annoying AIM bug my kid sister installed for me, there were three instances of it running, two of which were MAJOR run-time hogs. Jeeze spyware guys, I would never have known about the problem if not for the CPU moving slow. They should get their act together. SRed13
This file is an important system file for WinOS,its a servcie that must be running at all times, SpySweeper is in fact a spyware in itself (Do not use) Ms-Anti Spy and Spybot Search & Destroy are defensive anti spyware programs. DavidC Techman
I have 2 0f these csrss processes running and one of them uses up to 100% cpu so i have just blocked them with my firewall!!! Reading what u guys have posted, I think I should'nt have done that!!!! Big Sid87
i found 2 copies one in the system32 file then my antivirus found system32\zbefrsdqwj\csrss.exe and deleted it now every time i boot up it says it can't run it
CSRSS.EXE in caps lock is a trojan virus. It sent mass emails from my PC. Was stopped by ZAlarm. Is still undected by most malicious trojan removers. Acid Burn
Maybe starting windows with anti error mode will be posibly delete it but one thing is sure : those Pop-ups are a pain in the ass!!! Goro
this is a windows file that is harmless but is easily confused with a various malware files ( similar names to trick u ) ryan
i lost my csrss.exe file.where or how can i download it sertach
this is a pricess,i think ,found in system32
Googled it, screwing up my laptop  See also: Link dcl525
If this file is in the Windows directory and not in the System32 directory where it belongs, it is probably a virus or worm. In my case, it was popping up something every minute or so, but it was being blocked by windows or explorer. I don't know which. The result was a default beep and the current window losing focus or if playing a game, the game would minimize and I would see my desktop. One of the worst annoying viruses I have ever encountered. I wish I knew where it was from. Seth
This file is a normal windows file and is used on startup. Although I recently downloaded file from a link from Msn Messenger, and it then copy itself into my registry files so ther was another csrss file. Then it kept sending download links to all my MSN contacts and and created a registry file where I was unable to visit Antivirus website e.g norton.com/help and also it disables your AntiVirus Software but only delete it if you KNOW you have it and you will know about it. Whitey
can or cannot be virus, but you should only have one anti virus runnign at a time or it will slow ur computer. plus some computers with more then oen user will have more then one csrss.exe file runnign at once. this site doesnt really help u fix problem cause different ppl say different things, try callign an it guy or microsoft help desk for information on how to solve this, im still not sure but i used my antivirsu and spyware to take it otua nd im fine. Taylor
I searched for this file with Agent Ransack and found two copies, one at c:windows\system32 and one at c:windows\system32\dllcache. I went to look at the folder called dllcache and couldn't find it even though my system is set to show all files and folders. Using Agent Ransack I was able to delete the second copy of csrss.exe, but now how do I get rid of the mystery hidden folder dllcache? actic
The information that if in system32 folder was right - I could find csrss.exe at three places - ones in the system32 and i386 folder were 6 kb in size and the one in the winnt folder was 26 kb. I deleted the one 26 kb in size. In the process explorer from sysinternals - the probable virus showed under the Explorer.exe group and the original system csrss.exe showed under the System group. Kanwar Manish
Ice Sword indicates it red that scares my a bit and I don't understand Chinese ;~). But SysInternals Process Explorer tells that it is Client Server Runtime Process from MS and has been started by smss.exe Windows session manager. So I guess it will be ok, I will try Security Task Manager to get a third opinion.  See also: Link sd
nasty bugger. a version of Chode ? i believe will drop this one also - i recieved a 'vbulettin' link via MSN (not VBulletin, note spelling) not realising the dodgy spelling and infected myself...:S bastards. comes with a couple of other nasties also, so thats another infection vector - beware of msn links! arasta
I have two of them running at the moment, one which looks like legit because it is running as a SYSTEM proccess, while another which is using from 95-100% CPU usage is running as my computer proccess. I cannot stop the computer proccess because it just says this is some imporant file and cannot be ended. Dan
I recieved a mirror file from a mass mailing called csrss.exe. I then started massmailing other people. The programmer entitled it the same as a system process to confuse windows and is thus known as a mirror process. However, this is the first mirror process that i windows has not allowed me to end. Curran - Canada
This file pop up a window regulary (realy often) says that youa aproblem with you windows or your messenger, but isn't true in many pages sayy that is a virus, but it can't be eliminated like you usually doy whit this thing, I'm traing to take it out... =P
csrss.exe is it's name, according to Windows Task Manager. It fires off popups that warn of registry corruption and insists i venture to any number of websites (that rotate through popups). It doesn't redirect, however, only disappears when closed Noel
when i am working with internet suddenly a message displayed you virtual memory is minimum too low. i use task man and found that csrss.exe process is running. i am click ok button of error dialog box to close. then what can i do ?? Riyad Proshikanet
My copy of csrss.exe in the windows\system32 folder was replaced by a crippling virus which used it to shut down large portions of my UI, proving that the file can be a danger even if it is apparently in it's proper location. Rakeela
Okay I'm just going by what Rafal said So I delted it from /Windows/ServicePackFiles/i386, but I was smart and made a restarte point before I dleeted it.. SO Yeah. Fuzzy
It was manipilated by a virus on my system some kind of scanning flooding bot "chodebot" and it was able to add it self back to startup after i had removed it.
nothing i need to get riod of it i ccidentally got it from my sister getting it off an msn block chacker ive tried deleting it but it sais cannot delete nick
I found that Google Desktop was causing this process to go through the roof. Once I stopped Google Desktop, it's usage went down to zero. Shayne Spackman
Worm which in some cases can change registry files and block some website from being used e.g mcafee, norton Whitey
Client/Server Runtime Subsystem(csrss), its very useful file for console and client/server environment. Ajeeth
my McAfee kills it and it come back all so this a is a trojan that is full of spyware 386 in all risa
Mine is located in C:\WINDOWS\SYSTEM\bccfgkfev. Is that okay, bad or dangerous? No idea.
It may be dangeours and shutdown your system. did you tray to kill that process? I can't antycsrss:)
its a trojan if its in your windows/system.. rather than system32 MCB
a way to remove this virus from your computer... see link  See also: Link Juan
It opened several AOL IM windows spamming every sec... jamicat
it comes with block checker tapiwa
reloaded windows and after reboot,virus rolled back my computer dregs
I had an additional csrss.exe file in System32\dllcache, just as Ben from Pennsylvania had. It has made the laptop impossible to use, so slow I could eat dinner waiting for IE to come up. Thanks to the information on this site I have found the culprit, I think. Thanks to Ben also. Henrique
Horrible computer destroyer. This was received through Instant Messaging. Beware! system32\yjnceyjkd\csrss.exe Shane
This is a dangourous file. I got the "csrss.exe" virus by installing the msn block cheaker. Because windows task manager detects the name "csrss.exe" as a critical system name, it would not end the virus called csrss.exe.... (stupid i know). I got an alternative task manager caled proccess manager, and it ended the faulty csrss.exe Dolan miu
Its a VIRUS Chaitanya Korde
its a system file,but almost dangerous cause other virus progs can launch this to execute their stealth capability jake_TAPGSM
messenger service keeps popping up - talks about critical downloads needed - go to process try to end it - but windows will not let me casey
This is one bastard of a file! I know the file is needed by windows, but the needed file can be infected so the required file is in fact a virus. Every few minutes I get a pop up that stops any other program I am running. So the process can't be stopped, the file can't be removed and anti-virus apps say the thing is fine! Alex T
csrss.exe is mostly the main executable for the microsoft client/server runtime server subsystem. But it can also be an infected file with the worm [email protected] worm. i had a problem with this worm before and i couldt use the coumputer after that. My computer just keept restarting every time i log on to Windows! David Parleur
CSRSS.EXE was the process found running for a notification. The notification is always on top, so unless you put it off to the side of the screen, all apps will be under it even if the app is the current active window. having network problems. The CSRSS.EXE I got is an ad for www.downloadpatch.net. It's an Win 'Messenger' imposter. Suggestion: Never believe any notification that comes up without the Windows alarm soundbit. Got it while waiting for ISP and Norton lvupdate to load. This is the worst virus for slow dial-up, since it can catch you before you can protect yourself. B.J. Dail
My laptop boots up faster due to the files disapearance. It was in a subdirectory of system32. The first time i knew it was there was when i booted up and got the message that the system couldnt find it. Legit one still there. Laptop boots mega faster
Still affected my network after re-ghosting some of the machines bandgeekmafia
system32 it run sumtimes!! dark A.
If it aint Broke then Leave it Alown. But if it's constantly using CPU Cycles then invistigate thurther, as it just may be a virus or somthing gone wrong with windows. Google (the smart way to research)
I had popups ("messenger-service") of suggested SYSTEM ERRORS. There were 2 versions of CSRSS.EXE on my HD. One in WINDOWS/SYSTEM32 and one (the bad one!) in capitals in the /I386-folder. I deleted the bad one and don't have the annoying pop-ups anymore. So it seems to be not very harmful and easy to clean. sdirkx
make sure the file c:\windows\system32\csrss.exe is the one running. If it is in c:\windows\ directory, it could be viral.
A needed Windows file DominantHeart
it crashes alot with nero show time under hardware acceleration! John
its f'ing spyware under the same name as windows file Willzx
I have it in C:\Windows\system32 and C: \Windows \sytem32\dllcache. There's also one in prefetch dir CRSS.EXE-22452D1B.pf and CRSS.EX_ in C:Windows\I386 Any ideas if these are all legit? Thanks
As many opinions above, It seems to be one of windows runtime subsystem, and mine is loacated in c:\windows\system32, and c:\windows\system32\dllcache directiories, and it's 6144 bytes. If virus is infected then the csrss.exe file will be bigger than 1MB and located in c:\windows. I use winXP sp2 Jason, South Korea
It is being used by a rouge program to produces many annoying pop-up messages from the Messanger Service to access a site because your registry could be corrupted. The only extra copy of csrss.exe was in an upgrade dir. It was the same size as the one system32 dir. Still can't get ride of it... Peter
Great site Admin, I've checked this csrss.exe (originating from C:\WINDOWS\System 32) with eset's NoD32 antivirus scanner, with xoftspy and NoAdAware 3 and all systems are normal. BeAn.
Chek version info, & date stamp. If it is the same of all Op. Sys. files, it is authentic. Else... delete. Javier Arias
it ran on mine as the bridge virus, computer was not happy, constant hacking and lots of shutting down. Chia
windows file..controls interactions between programs. TRex2003
 See also: Link virus
It made Avast antivirus program go crazy..several pop ups which included email addresses and the file name CSRSS.EXE. Then I ran security task manager scan which found out the file indeed was dangerous and removed it. I really hope it´s gone. In that case,Thanks! Advis
All that happens is it pops up when ever my computer logs on. No problems besides that. JFK2
Some sypware use this name because windows disallow you to end process it, I found it in copy-protected CDs but now I can kill it  See also: Link devotee
It's just a windows file that takes up exactly 3,312KB of memory. Also, i don't have virus removal programs installed and the Firewall is disabled lol - If someone stuffs up my os and prevents it from working, i personly wouldn't care (i'ld be like: yay! I get to reinstall XP again :D) NoVaTuRiEnT
path to this file at my pc is ??\c:\windows\system32\csrss.exe harry
If this file is running as a process from folder C:\Windows\System32 then it`s NOT Dangerous because it`s a file system, but if this file is running from another location on your hard drive (c:\, c:\windows ) then it`s a VIRUS and you must kill this process. -- quoted from Rafal..This is incorrect! A virus can infect any .exe .com .bat and anything in windows sys32 folder. People that are seeing two instances of this running one of them is dangerous! -N Gh0st
I have two on my system, one in system 32 other in \Service Pack Files i386m so is it safe to delete the one not in system32 folder? Will
CSRSS.EXE (all caps) was causing me problems. I booted into Safe Mode (restart machine, press F8 during bootup), searched for all filenames containing csrss and deleted them ALL except for windows\system32\csrss.exe (the only good file).  See also: Link TheYak
The csrss.exe was found in C:\WINNT, moreover, my anti-virus software also identified it as a virus.
Microsoft Anti Spyware once popped up and told me that csrss.exe wants to be a startup file. I didn't know what was it so I came over here, and after reading this, denied all access to it. I noticed file in C:/Documents & settings, and C:/windows. As I tried to remove it, it didn't work. However, MS Anti Spyware blocked it from starting up, so I rebooted, and removed the malicious file with no problem. Stanislavs
I suggest to allways have a backup ghost image of your hardisk. Oh yes their is a way:) jeff
It's a worm. It sends thousands of emails per minute. My firewall blocked it. Dimitris
I hav WinXP Home & locked this file out N my firewall. I've never had any problems. Mark S.
csrss.exe is a windows system level file frinitely. But in my case it's causing the Windows XP system to reboot everytime I install Backup Exec (Deskrop & Laptop Agent) ?ITGuy
The only way to fix this is to uninstall and then reinstall your AV software. Not good for 2 reasons. 1 if you were successful in using the End Program option on the virus you will have to restart your computer twice to un/reinstall your AV. *SIGH* 2. you'll have to play the catch it at windows load until you beat all of the virus loads again to reinstall your software. Trust me, you'd find it easier to pull your own teeth. I am still looking for a way to get around this thing. The other bad news is eventually this thing will invite another virus to your machine. T in Germany
SAFE if in c:\windows\system32, VIRAL if anywhere else - usually a keylogger in this case Rissa
well, its a worm, its 155.5kb (or something like that) its the file thats hidden. Adam
When i tried to shut down my computer my cpu usage went to a 100%. I almost couldnt shut down the programs i was running cause my pc was so slow. I checked my taskmanager and i saw that csrss.exe was using 99%! It made my computer nearly freeze so i dont know wath went wrong. Glan
should never be in the msconfig.exe/startup, if it is, then it's most likely a virus/worm/trojan jack
I had clicked on a link from an msn contact and downloaded a file, it then added a protected operating system folder in c:\windows\system32\odhrtlkr this folder consisted of csrss.exe win.ini and smss.exe, this files were being used to exploit my system. The best program to Identify this is Hijackthis.exe, i had to log in as a different user and delete this file. Then edit the registry keys located in Hijackthis Jason D.
To get rid of malicious csrss.exe, (1) search for all files csrss.exe on your computer. (2) open powerful alternative task manager like "Process Explorer". (3) Now, when you kill the csrss.exe process with "Process explorer", it will be terminated, but will start right back up again. Terminated it, and the immediately switch over to you search results and delete the csrss.exe that isn't in your \system32 folder. George
Download speed dropped from 400kb/s to 20 kb/s about a month ago. ran virus checks, no luck. got modem replaced no luck. reformatted HD and re-installed factory software no luck. deleted the goddamn sob scrss file from i386 and my dowloads are back over 400kb/s! Stringer
I can't be sure but I think this thing piggy backed in on something from emule. Anyway, mine is doing the win message warning me about file corruption and virus' and is trying to send me to non-microsoft sites to fix it. Unlike most of you I haven't been able to find a second copy of the csrss.exe, but that is definetly the source, I tried a windows reinstall while saving my files but it must have gotten saved because I still have it. Has anyone contacted or recieved information from Microsoft about this, I'm preparing to cut my losses and do a reformat to kill it. Dino_nut
I know that I just downloaded this software, and the virus just shuts it down, before it can run. Aaron
I had a lot of errors with this program. I say reinstall/reset if your computer is running slow on startup. Kent
well this file is troubling me a lot whenever i open any application this file initiates an error command like mvscpr71.dll not found and my system is unable to open any application sreenivas reddy
I have one csrss.exe, and it gets frequent pop-ups to buy regfixit, repairmyxp... the popups are fakes and annoying, and I haven't figured out how to get rid of the problem yet Noemie
A file that I cannot locate and does constant CPU Cycles .. need some help.. slows down just about everything!! Antoneey
if you want fast and easy removal instructions without downloading anything because it seems most of the people on this site dont have a clue what they are talking about. Bobby UUU
I kept seeing Windows Security Center saying my firewall was shut off, as well as automatic updates. Also windows firewall was set to group policy, so you could not enable it even though group policy was not configured. Additionally there was always a mysterious connection to stealth.insert.si Booted in safe mode, deleted the csrss.exe from \windows and all is good now. RichMobile
Client Server Runtime Process (csrss.exe) - From Microsoft® Corporation (A standard-process from Windows, the link is for Win 2000 but its the same in Win XP)  See also: Link Crowner
I went to my Program Manager and saw i have 2 processes running under the name csrss.exe. Both have the exact name (no capitals) - yet one of them is using 80% cpu usage and the other is using 0%. I tried using spysweeper and adaware, but they couldnt detect it, probably because of the name. My spysweeper keeps detecting it on startup and i dont know what to do. Raj
The one that has the username SYSTEM is legit the other one that has your username like "John" or "Bob" is probally spyware and should be deleted.  See also: Link SuperMan
I am convinced I was infected by csrss.exe by install the win2k sp4 downloaded from microsoft. zoran
always his prioprity is 13, & his parent process is smss.exe bestop
Win NT4/200/XP/2003 only CSRSS is alson know a Win32 Subsystem. Integral part of the OS don't change it. Williggin
csrss.exe is the main execultable for MS Client/Server Runtime Server Subsystem. It is not important for stable and scure running of your PC and should be terminated. John
It's making my Photoshop Cs2 run slow as hell. Photoshop is using 75% memory, csrss.exe is using the rest 25%, so I'm at 100% !!! WTF??? Durty Sanchez
well, i know that it was insalled into my computer with the installation of the program "all in one" which is a keylogger i used to log everything on my PC, its reason for stopping your access to stopping or deleting is because it thinks your an intruder trying to terminate this program from logging everything, from my research this file is harmless.
Mine csrss.exe is in the windows 32 folder where it's suppused to be and it is 6kb big, which it is suppused to be. But after I opened a downloaded program which ended in an error. crsrr.exe desperatly wants to modify my register and acces the internet. I don't trust it, but don't know what to do. Can I copy csrss.exe from another computer to mine? Joost
This file is legit when within the system32 folder. Anywhere else... It is a virus. Andrew
A needed windows file that is a 2 sided blade viruses are often writen to target it and do its evil with use of this file Kris
I got this file through a MSN message saying 'hey is this your profile? [insert link here]'...the file was under C:\windows\system32\qoubicy\csrss.exe! watch out. Jonathan C.
We had it come to our computer through an unknown source, perhaps pop-up downloads. it is the worst thing that has happened to our computer, it slows all processes, and attaches itself to any form of media device that comes in contact with the system. IT poeple haven't been able to remove it so we've just had to put up with it. Dont accept this file and if you have it try to get rid of it ASAP
This process prevents any link with Google in it to freeze (Not Responding) IE 6 or 7. The process goes to 100% when a Google link is tried. Rebooting will "calm it down". I got rid of all csrss.exe's from the hard drive. Still the problem exists. Starts with "Assert in LSP" anyone else seen this or have a solution for all of us? Dennis E
this is part of the windows messaging service that can cause unwanted pop ups and ads to appear on your computer. it communicates with a remote server without your knowledge and is usually overlooked by many av's and spyware programs because it is a legitimate system process. spysweeper specifically shuts down the windows messaging service and kills this process on my computer with no ill effects whatsever. a few times i've gotten warnings from spysweeper that csrss was tampering with it and caused spysweeper to kill the csrss thread. the tampering csrss.exe was in the system32 folder mark
this file is not dangerous and essensial for windows to run correctly adul
It's a system file... but it's infected and it keeps trying to uninstall my wireless network... which it once did, and I had to re-install, also seems to bring up that system doctor virus which tries to make me give them money Dan
just search it under search, look under your HD, its the only one that isnt under system32 and its in all caps. easy to fix, danm. thanks a ton man. Matt H
My a-squared anti-virus program detected it as a backdoor/trojan even though it was located in the windows/system32 folder. Then it tried to remove it but it came back after I restarted my computer. It started showing up in the process manager after I accidentally opened a suspicious file from Limewire.
If a process is named in upper case letters then it a good chance it a trojan,worm ect,run all of your cleaning software in safe mode with system restore disabled,and all caches emptied ie,internet explorer  See also: Link OvEr-cLoCkEr~UK
i keep having popups that when i bring to process using task manager it brings to csrss.exe shamugratnam
it never appeared in the taskmanager until i opened an email with an external link to a postcard from a friend. It then started to place a trojan, but my anti-virus (avast home edition) blocked it. Unfortunatly i allowed it in the caution windows from the anti-virus. It then started to open pop ups and didn't allow me to shutdown. The anti-virus was always closed by the trojan. I used the Spyware Doctor to try and remove the trojan. The file itself has no problem, it is a system process usually enabled manually... if it is opened and you didn't activate it... there may be something wrong... Ricardo
csrss.exe is legitimate when there is only one actif and in smallcase (do not remove), some adwares exploit it to show messages on the screen. u can disable the csrss.exe's function of showing messages by going to the control panel- performance and maintainance- administrative tools, then doubleclick services then disable messenger  See also: Link heXXen
This is a basic windows file however as noted above, duplicates can be made. This can be caused by opening the file twice, in which case - creates a ghost file unused in the task bar. Another uncommon cause is infact spyware. No care is needed in deleting it as windows will not allow for the genuine program to be deleted.  See also: Link ©2006 Microsoft Corporation.
If the U.S. Government lets it run in their computers then how harmful can it be. In AIT we have this file runing all the time so it can't be all bad, but it you need more speed feel free to close it. However do not delete it from the windows folder. PV2 Brewer
copy itself mshhour slman ibn sleem
Csrss (Client Server Runtime SubSystem) is safe if in your system32 folder. If its being run for other places then maybe you have a fake duplicate. Jeck Lamnent
Some times its make the pc processor to run at 100% and block the computer to working. toti hari
It is yet another Microsoft gifts. It is not a virus.
csrss.exe displays an error box when my dll won't load, it says that under process explorer that csrss creates a thread that displays the rror. I was tracking down the dll error and stumbled across it, I have never heard of it before.
windowsdatei shadow
I have two copies of the file, one in the system32 directory and one in anonther direcotry (system32/drivers) the one not in system32 directory it is not a windows file but a trojan 42
as above it´s a trojan with same name as an essential file. However i don´t know in which world some lives in when they say just delete tha process in taskmanager. GOOD LUCK... this is a critical system can´t delete it. Now my pc bluescreens after 10sec after i logged in. only work in safe mode. And then i try to instal antivirus program but i can´t since i run in safe mode.. ARgghgg. if you have similar problem like i do and have a solution i sure is interested... Staffan
Could be Worm Related  See also: Link Tom
i keep having popups that when i bring to process using task manager it brings to csrss.exe  See also: Link kkk
I had two, both in lowercase, but a second one was in C:\WINDOWS\ServicePackFiles\i386 and was apparently a virus, it ate up my processor power to the point that I couldn't do anything. Apparently not all the malicious versions of it are in caps? Alenth Eneil
mine was running from a file \\??\\C:\windows\lastgood\system32 i dont know where it is, its not in my systen 32 file and no virus scanner can find it uh guy
Every computer haves a virus or spyware/adware,, you can't do much about it,, pple make it and ppl hate it,, how much you spend on anti-virusses and ....,,, it doesn't matter there will always be some virus that will irritate,, I have norton antivirus 2007,, avg free,, avast! antivirus,, and still I've got these virus, spyware
My avast! antivirus handled this thing well. But still when the system starts up an application called update.exe tries to start with error : system.dll was not found on this system reinstall the application avast deleted system.dll leaving a crippled program which creates a STOOPEED warning screen every time i turn on my PC. Im going to mac anyday now Phil
Well, i only have 1 process of csrss.exe and it is on system32 and other copy of it on system32/dllcache, but i have none on CAPS but i still get this annoying messages from a "Messenger Service" saying my registry is corrupt and give me tons of different pages i haven´t even visited, still, i have BitDefender 9 Professional Plus and it is not detecting it... I cant get rid of it... im still trying... mike382
Once again, like all system files, even the legitimate system file of Windows called csrss.exe can be used by spyware and keyloggers to attack your computer. Therefore this process has to be monitored closely! The legitimate csrss.exe is important for Windows but can be dangerous and abused by malicious kernel drivers (hard to detect) and should not have Internet access! CyberForceField Creator
The real one is a system file, not a user file right?
Just a Windows process, there isn't a matter ! ultio
Running a search for csrss in files and folders on this computer located 1028 entries, maybe 2 of which could be legit Windows (4 KB files in System 32 and DLLs). There's also about 1000 files that are listed as configuration settings and.dat files going back to 2005 and ending the day before I installed AVG Free. I've also got a start-up file called csrss.lnk (which I've disabled) and some recent Internet short-cuts to csrss.ini which i didn't create! What a mess! RoseQ
First of all a windows file, but if it's direct in the windows xp root, it's a mass spam mailer, which sends mails trough yahoo! Thickness
Infection found on my machine by Acronis True Image team as Windows was spontaneously shutting down during backups. They had me remove this as it appeared in c:\windows\prefetch\CSRSS.EXE.12B63473.pf. There were 2 other files labelled csrss.exe, both in system 32, one a .dll, but I was told to leave these alone (I am no computer whiz). The suspect file deleted easily, and on reboot (which was recommended) I searched again and it was gone from the system. I was told it was a non-dangerous virus by the Acronis techs. Sherlock Holmes
I had no Idea this was creating an havoc on my computer every time I log on to the internet. Another screw up of my latest reinstall of XP. DAMN!!!  See also: Link hasbriale
When terminated by another process (not task manager) the system will be rebooted kelvinboy
Do yourself a favor and get a mac.
Recently found i was sending a tremendous amout of packets and had no programs running, found crss in the internet explorer folder put it in the trash can and internet went back to normal willie ha
My csrss.exe file was located where it was supposed to be, C:\WINDOWS\system32, so no virus, trojan, logger, etc. However, I was experiencing 100% CPU load when working in MS Excel. After reading this info page and a KB article from MS, I decided to erase the profile files stored locally as well those stored on the domain server and voila, no more 100% CPU load, problem solved. Hope this helps  See also: Link Ovidiu CRISU
csrss.exe is main exe. file and can't be terminated. some trojans can copy themselves right into the csrss file making them impossible to delete. I used norton antivirus to find this out, it can't remove a file that is a critical process.manual deletion will cause crashes. Xano
CIA Rate copies the server with this name Scribnar
Someone please tell me how big winlogon.exe should be... i have found two on my system: c:\windows\winlogon.exe is 152kb, c:\windows\system32\winlogon.exe has a different icon embedded and is 491kb Ian
I now have spam coming out of my computer (sending all sorts of things such as viagra advertisements) thanks to this trojan. Whenver I delete it, it gets created again by 'winlogon.exe' so now I have to investigate how to clean my winlogon.exe Ian
It is a critical system file. Sandeep Luthra
It is a critical system file. Does this process neeed to access the internet? I've been blocking it. Sandeep Luthra
its a runtime thingie if you have dupilcates of it
I had to copys of csrss, one real one on system32, the second stashed somewere else as a viruse. I noticed it because the bogus one also seems to constantly run at between 90 and 100% of the CPU ALL THE TIME!! Paul C
suspect danger l.thorpe
I have two of these, but they are both in safe folders (C:\I386, the drivers, and C:\WINDOWS\SYSTEM32, the win32 folder) so I know I am OK. Anonymous
Never Had before and should up about a week ago. Slows down my system when using internet explore....also forces my iexplore.exe to run at all times, even though I have no window open with the program. Slows down, with annoy small freezes. Gilfumaster
This is normal for Vista  See also: Link Ucrazy51
This program was using 50% of CPU time untill I stoped nvsvc32.exe (the other ~50%) RNA
Perhaps somebody should sue the company that the pop-up is telling us to visit to cure the probelm. I have emailed them but never get an answer.CSRRS.EXE in upper case does not exist on my machine. Only in lower case in System 32 and you cant delete it, and if you chnage the name another program appears in its place. Its a self scripting thing.
It's a Client/Server Runtime Server Subsystem, this is a legitimate process required for the OS itself. Any attempt to end this process will cause to system failure. It can be a virus also!!! It's legitimate place is under the directory System32 , a virus cannot get the same name under the same directory, it will try all ways to be looking as it. U need also to kno the real names of OS processes to not be tricked! A cute example will fit, there is a big difference between csrss.exe and csrs.exe. Clear dude? Diesel!
One way to determine if csrss.exe is a legitimate file besides looking at the date modified is to right click on csrss.exe inside Task Manager and attempt to end process. Because csrss is a critical file, Microsoft should inform you with a message that csrss.exe is a critical system process and end it is not possible. Unidenman
csrss.exe the most powerfull and intelegient virus i have seen until now.,, i prob got infected trou a msn password finder,, this exe file is a locked by the windows system and cant be ended in task maneger, and it is using 100% cpu and is closing every prog i try to start,,virus prog norton-avg-norman and som spy ware progs cant find it so it is a good one.. i needed to reformat my pc to loos this thing damn this is a good one.. you guys is saying it is just a sys file,, haha damn you are wrong its a virus/trojan made to be protected by the win sys itself. a back door the virus prog cant see GreatSnipe
Continuation of Post: what i was saying is like the guy above, my computer pauses for about 5 seconds about every 30-60 seconds. I have 512 RAM now, and computer is only using around 200 RAM to run. So when my computer [pauses] like that, it is sending Logged keystrokes to some little jerk some where huh. Gosh, i just reformated my drive and partitioned with partition magic into 8 drives. I am sorry for tryin to be funny- i am about to through my computer through the damn window!!! WORM CREATOR
Client Server Runtime Process pooperscooper
This file can be a System File, which would be located in C:\Windows\System32. If it is in there, or if you have two instances, see which one is which, check where the other one is. If it's somewhere else than in the System32, DELETE IT. It will be a virus. Why
listen to post by heXXen!! I have had this problem awhile and that link explained and cured it instantly. no dowloading or anything. easy 123. thanks! listeningriffin
-- when it's in Windows/system32 ... its ok athervise destroy it Lappen
I noticed this file after I fully throttled my HARDWARE ACCELARATION in the display because I could not play Age of Empires III with my GeForce 7800 Maniac784265
It removed control panel, my adminastrator access, win explorer,all administrator tools and privelages. It keeps changeing homepage to google. Can't access symantic or window updates. Keeps running a spyware popup. Keeps returning after reboot. Keeps loading trojans after cleaning and reboot.It wins this round, time to wipe and reinstall. It maybe just a required system file but there is much more attached to it. Read and tried all the above suggestion and comments. Thanks for the help but it is a bugger. skh
i got this error saying that it cant find this file C:\WINDOWS\system32\ltruoggkeo\csrss.exe and their is like something wrong and its been renamed or something???? every time i restart james
Client/Server-RUntime sto
You are so dumb adul, It is true that CRSS.EXE is a file being used by windows to run properly but, viruses or worms can disguise themselves as the CRSS executable. My computer got a bluescreen because of this file. Kick My A__ Bill
this file is driving me crazy! based on info i've found it is a critical file however I only have one of these processes running and it gives me a pop-up every 7 seconds. Can you understand how this would lower my quality of internet? i want to throw my computer in the garbage! I don't know what to do, my computer won't let me end this process and internet says i need it but if this is what internet is going to be like, fuck it coz i have enough stress without closing 72 pop-ups all because i left my computer running for an hour when i went out! will
When the virus of the same name infects yor computer it will eventually cause process failures all over the place. From my experience after infection it caused IE explorer to foul up, and then a multitude of system process to fail. So much so that a rebuild was in order. I made an image of my PC before rebuild for analysis. It appears this came in with a Microsoft Money Hack my wife found in limeWire. If your Virus detection software is up to date, it will easily detroy this little pest. In all honesty it's an amatuer virus at best. Just goes to show everyone gets caught now and then. SuperUltraMega
Windows SYS 32 file Jim
Every attempt has been made to provide you with the correct information for csrss.exe or AHLEM.A WORM. Many spyware / malware programs use filenames of usual, non-malware programs. If we have included information about csrss.exe that is inaccurate, we would greatly appreciate your help by updating the Process Information database and we will do our best to correct it. tarique khan
SAFE if in c:\windows\system32, VIRAL if anywhere else - usually a keylogger in this case csrss.exe known as Ahlem.A Worm csrss  See also: Link Harish
This infected my friends laptop, and I finally figured out that it was disguising itself as a folder here: c:\program files\common files\system. There were two such system folders in this directory. One was real and one was the trojan. Unfortunately, I don't have admin priveledges and couldn't delete it. Also, there were two other parts in windows\Prefetch with appended filenames ending in .pf which need to be deleted, and one windows\servicepackfiles\i386, but I couldn't delete that one either. Joshua
it has been ok 4 me i have it in C:\WINNT\ServicePackFiles\i386 and C:\WINNT\system32 the only weird thing is i keep geting this 1 popup that says that i need 2 restart my computerit comes up every 5 min or so and gives me 4 minutes b4 it restarts my computer unless I press cancel. I am still looking 4 another virus. They are both 6 kb. the 1 in system 32 is capslocked and the 1 in i386 is not can anyone give me any extra info? human being
legit file da-1-to-fix-them-all
well i have two of it running and it only found one file... they are exactly the same and both are running with no capital letters so im just gonna say its a duplicate xD gtamad
csrss.exe is legitimate, but I found a handle called kdmgk.exe embedded in mine. it's redirecting dns :( dvnt bstrd
csrss.exe is a main system file for windows. It can only be in C:\WINDOWS\System32 to be safe; otherwise it is apart of a piece of malware. -- Note for all trainees, you will find this in a lot of logs. TechPro5238
if found in C:\windows\config\ then it is harmful. will start ending proceses and stoping them from running at start up. can also open random ports on firewall Hayden
I have 2 versions of this running, one in C:\WINDOWS\system32 (file size 8.192kb) and one in C:\WINDOWS (file size 32.768 kb). I can't kill either in Task Manager, and I'm not getting any pop ups or anything. Just noticed 2 runing, and differnt sizes, then searched google and got this thread. Not sure what to think, or if I should try and delete the one in C:\WINDOWS. Nervous what would happen if I do and it needs it to run. MinorThreat
Causes popup windows and cannot be deleted a "critical system process" qmastr
i had two of them in task menager,and on my firewall one of them was trying to conect to internet all the time,with security task manager i mange to put it in quarantine and now nothing is trying to conect to the internet dasen
Installed some freeware (sry can remember what atm) and started getting pop ups. Saw 2 of this proc running. Did a system restore to a time b4 the install and got rid of the bogus one. Jim
I had this file, and norton detected it. its not supposed to run on vista, its just for the xp users. beware vista users! this process should be ended if u hv it running on ur pc... unown xu
this is system file that has automatically entry in startup ,its full form is client/server run-time subsystem YOu will find this exe in every PC bipan chauhan
The file was detected in my CPU as infected by Ad-Aware, I deleted it and it also deleted the one thats essential for my computer so i get a start up error. Dont delete the file, find some way to get the virus off the file or else it will run really slow DragonSix
csrss.exe is a main system file for windows  See also: Link Bob
it put a trojan on my computer that cannot be quarantined Aaron
this file can be both dangerous, and un-dangerous. so guys if u have the file, but not located in %windir%\system32 then its probably a virus, don't panic - scan ur computer with your spywaresoftware and ur virus software, i recommend full scan. Tobias
csrss.exe starts consuming 25% CPU for 60-90 seconds when I start up most Adobe CS3 apps, or QuarkXpress 8. The problem seems to clear for a while after rebooting, but is back again after a few days of system operation. BassPig
part of the windows pocholo
there SHOULD be one of these processess running and it musnt be named in capitals otherwise you have a VIRUS!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!PS: other viruses may manitpulate this legit service but don't kill it if it's running normally AXEL WIRESMITH -knows what he's on about
One day I just booted up my computer and avast popped up with 5 or 6 different trojans, this was one of them. I would suggest that you check your TEMP folder for trojans and the such every so often, since that was where all of my trojans were. WEFWEFWEFWEFWEF
If the file is located in windows system file, then it is legitimate. If it is in the Config file, then it is a virus. After disinfecting the virus with the proper software, you are left with a reference in registry pointing to the virused file (which has now been removed by anti virus), but windows still looks for this. All you have to do is go to registry and look for "Config\csrss.exe" and delete that line. Windows will now reboot normally - no more "Cannot find file" Mario
This is the user-mode portion of the Win32 subsystem (with Win32.sys being the kernel-mode portion). Csrss stands for client/server run-time subsystem and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and/or deleting threads, and some parts of the 16-bit virtual MS-DOS environment. Matt
activates a keylogger which was found in the documents and settings folder in the .tmp New Tech67
My pc demands the csrss.exe file at startup, from directory windows/config .When i copied the system32 folder one in it,it displayed an error that it cannot run in 32-bit environment. Devil Boy
Two legit versions of this file can be running simultaneously if you run Vista. The second should be located in Windows\winsxs\~. You may find you even have a third copy in a similar location (winsxs\~)! Do not be alarmed if you do, it's normal silas
It's part of Windows. Also, as said everywhere else, there is also a fake that can be a very nasty bugger of a virus. The safe one should be around 900k. The fake should be below that. Z3R0FiR3
This is a mending process and comes into action to repair no-responding program to keep them running and also to mend broken shortcuts for the programs that are currently running in the Task Manager  See also: Link Matthew The Sperm
Csrss.exe is the Windows Client/Server Runtime Server Subsystem if in the %system root%\system32\ folder. Other instances found outside this folder are considered as viruses/ malwares. !
It's a important system file.
i got 2 csrss.exe 1 is systems csrss.exe 1 not chocolate boy
csrss.exe is not a virus! It can infacted with a virus! Name
It is legit for the Microsoft Client Server Runtime Server Subsystem, but could also be a virus  See also: Link Victor
This system executable is 5mb on my machine. However, I found several "bogus" versions of this exe with names like "csrss.exe.203890" , and file extensions like .HTTP. I found this quite bizzare... so I blew 'em away. Now I'm going to see if my PC crashes or not. age13
This is the user-mode portion of the Win32 subsystem linuxuserfixingwindows
Client/Server Runtime Subsystem, or csrss.exe, is a component of the Microsoft Windows NT operating system. It provides the user mode side of the Win32 subsystem and is included in Windows 2000, XP, 2003, Vista, Server 2008 and Seven. Because most of the Win32 subsystem operations have been moved to kernel mode drivers, in Windows NT 4 and later CSRSS is mainly responsible for Win32 console windows, GUI shutdown, and threading. It is critical to system operation, therefore terminating this process will result in a Blue Screen of Death  See also: Link HiriZe
Check your System Eventlogs. This is very possibly related to your graphics/display drivers. Thanks to Emrico1 & an EventID 108 from ati2mtag  See also: Link IcI
I know that I have two of these files when I bring up the task manager. My internet is way slower than it was two days ago. I have 10Mbs and its running now at 2-4Mbs John
stupids this file is not a virus this file is very safe no more disconnect
This file was found under \documentsand settings\all users\application data\ tried to remove, denied. renamed and will try to run. Sucks memory over time. Denis
The copy of csrss.exe I had resided in the \Document and Setting\All Users\Aplication Data. If you performa a search with hidden files, there should only be 2 hits ( I verified this on a number of other systems not affected buy the problem). I had to boot safe mode and rename the file. Booted normally and then deleted the renamed file and the other instances except for the 2 that should be there. Now my system performs like normal, good internet and keyboard resonse, no loss of memory. Denis
windows file! jos is evil
it is a system file... it is NOT a virus... stupid peoples hgfdfdgdf
Just a file. It's not dangerous. It is also used when you open explorer. Windows Maker
found it in my win32 files and said it was a program file therfore its the true fule. But there are keyloggers named after this file check your win32 files to make sure the correct csrss.exe is there. white hat
csrss.exe is the main executable for the Microsoft Client/Server Runtime Server Subsystem. This process manages most graphical commands in Windows. This program is important for the stable and secure running of your computer and should not be terminated. Chelsea
This file is making my CPU near 100 while in task manager everything is 0. Cody White
Microsoft calls it a system file. But a virus could go in and corrupt it and make it dangerous. So if you keep getting popups about this, most likeley yo have a virus Andy
it is an essentical windows process but may viruses may use its name to fool you if you find more then one use antivirus  See also: Link taseen ali
The file is fine. May block you from deleting other files though. Use an utility called unlocker.exe to solve the problem Uniq
The virus version of csrss is a pain, try to start it in safe mode and download lavasoft adware, norton can´t find it martin
i was having this error on my pc but when i run microsoft security essential then my pc was perfect and now i am jujs having smll letter csrss.exe and when i tried to delete even it sys system file so now i am save dont run registry cleaner for it. asif qadri
Csrss.exe stands for Client/Server Runtime Subsystem. Malware often disguises itself as csrss. Csrss.exe should be located in the C:\Windows\System32 folder. If it’s located somewhere else, it could be a virus, trojan, worm, or spyware.  See also: Link Leon
This file is needed for Windows to run correctly, if you delete it you computer will be unstable and most likely not start up at all. I suggest if you think this file is infected, download HijackThis and run it as administrator, then scan the system and fix any errors that has any relation to csrss.exe scan your computer if HijackThis classifies it as an BHO. None
Necessary for operating system to run in Windows 7 JRo Syrup
in taskmanager "winlogon.exe" & csrss.exe only ones that do NOT show user; the rest show me as user! I then click "show all users" (Vista) & it shows 2 csrss.exe running, both "system" toni
Found in (user)\AppData\Roaming\csrss. I'm running Windows 7 and I only found out about it because of opening msconfig. It was under the startup tab as Hotel and "Booking System" Chris
csrss.exe file is a PART of the system! It can only be dangerous if a virus/worm/trojan or any other malware is attached to it. If you disabled the running file, then some data will be lost....Do at your own risks.  See also: Link InGenuity
this file use more than 50% recouses of my processor.. Balian
It dont do anything on my computer LOL
Its a legit windows process from my understanding, but until quite recently (since the last windows update) i'd never seen it in my process tray before. Its a monster memory hog, but windows doesen't like to let you stop it. Its also something a lot of trojans love to 'clone'. God bless windows /sarcasm. Tali
if its in system32 and it is named EXACTLY csrss.exe no camps or anything then its fine else you should kill it and delete it killer64
This is a legitimate windows file if it is located @ system32  See also: Link Renel Isio
Could be a virus and Could be Important system program. Just check the file location of this "csrss.exe". If not in C:\WINDOWS\System32\csrss.exe. You must immediately Delete the file and End Process this Fake csrss... Anthony
csrss.exe is virus when you open task manager and found 2 same name. One is for microsoft and another one is virus. It located at C:\Users\(USERNAME)\AppData\Local\Temp\ . It will create another .exe file, some of them hidden, you must choose show hidden file and untick unhide file system . You also must kill it process with software security task manager and use unlocker if cannot delete it. It also create file erase_me . Example: erase_me923925 . Mohamad Afiza
Legit System file Darc
crsrss.exe is a micosoft client runtime server processor (c:/sytem32/csrss.exe) BUT, however the worm in questions is found on your system as CSRSS.EXE ( the worm) which can be picked up with a virus scanner if you can 2 csrss.exe processors running at the same time in your task manager you will see one is microsoft verfied and the worm isnt. Use freeware reg run reanimator to find it. ghosty
The file is legit, however, many viruses use this name. If it's not in the %system root%\system32 file, it's a virus/trojan/worm Boom!
Sometimes this process maks your computer slower because of registry errors  See also: Link Dor
This is a must be running thin' THAN
it lagged the computers and can block the internet. It only seems anoying Matthew
i now have about 800 versions of this file, it keeps on getting more and half of them is in the C:\WINDOWS\system32 directory and the other half is in C:\WINDOWS\ServicePackFiles\i386 directory. it is not using any of my CPU though. not important i think.
Windows file Kasper
if its in windows system 32 install its original n should never be deleted..else in lappy u will change ur power management console saurab
a process which is critical and when you terminate it a bsod will appear guang qian
System will not boot without it for Vista joanne
TROJANER!!! Sofort löschen! mox
csrss is a system file, Csrss and CSRSS are virusses.if csrss is in SYSTEM32 its OK. is it in SYSTEM32/config(for windows XP) you need to delete it. dennie
Can be VERY dangerous. Can be a keylogger, virus, malware, etc. Check windows task manager. If 2 are running, the REAL one should be in the SYSTEM username. The keylogger will be under one of the usernames on the start menu. Can only be ended with something like security task manager. Worked for me. Windows can't end because it has the name of a critical process. Person
Its a Client Server Runtime Process and its a very small file. (8KB) Most likely if you find one on your computer any bigger than that, its bad. Its in C:\Windows\System32. The original file name is CSRSS.exe with all caps like that, so if yours is all caps it could be safe still. Tom
I have two running on my computer, both the same name, both in system 32 and both 6kb in size. Which one I delete I simply do not no, and my anti virses are picking up nothing.
I also found it in c:windows/servicepackfiles/i386 and c:windows/$NtservicepackUninstall gail
There are two files in this name one is a system file(C:\Windows\System32 folder) other one can be virus. how ever if your computer infect you must fomat your computer for your own good.  See also: Link Sri Lankan user
an integral part of all Windows operating systems. somtimes used by 3 party sides for virus or trojan  See also: Link shalom
Can be malware or legit. The legit one is in system32, the malware one is somewhere else.
I'm not doing anything at my computer but the CPU usage is 100%. When I opened the task manager, this file consumes the largest amount of CPU usage. This makes my computer hanging and some programs won't run. Karl
its a system file but can be used as trojan  See also: Link wixer
Client Server Runtime Subsystem AKA Csrss.exe has many ways that it can affect your operating sys; from blocking you from deleting other files to even changing files by importing information. Jonnathan
important windows process , some Trojans and spyware are using same title so the user wont delete them  See also: Link ron
Depends on where it is - in Windows directory, it is a virus.  See also: Link calandale
I run win 7. I have two csrss.exe processes, one is located in System32 folder the other one i can't find. Memory 864 K and 1320 K with attemption of increasing. Any usefull opinion???
Csrss.exe is a essential file for your pc. DO NOT End this process or you will find some stuff on your pc being malfunctioned. Since many viruses can copy this name, run a antivirus scan monthly to check for this virus. Also, check for the mem usage. if its over 3000k, its a virus. If it's less than 2000k, your pc is going Wacko!!:) Robot 777
its not virus.. c:/windows/system32 (or windows/) its not virus but c:/windows/system its virus!!!
Just a system file that is located in System32, if it's not there and somewhere else, most probably a virus.
This Virus found its way onto my computer despite having an updated McAfee and said that i couldnt do anything access denied on all my programs or i couldnt open them cuz they were infected, it was acting as an antivirus and kept taking me to a website for a british made anti virus, so after several restarts, i found how to stop it. go to Start Run MSCONFIG Startup then disable it and restart, it prevents it from even starting, currently im scanning to see if my damn McAfee will pick it up and kill it. but this way i can at least use my comp as i would with out any nuicenses. Jon H.
It's important Jose Ole
It is a Client Server Runtime Subsystem program. It helps in the critical processes with your Windows Profile and your OS. For more recent Windows OSes, the file is located in c:\windows\system32. If it is anywhere else, then it is probably a virus. Take note that scanning the file in c:\windows\system32 is also a good idea as it can become infected. Deleting it, however should NEVER be an option. If the process for this file is taking a lot of space, then it may be time to recreate the profile as this means csrss.exe has become corrupt beyond repair. Fixing this requires a new profile. David
It's indeed windows component if situated in your system32 folder. If you want to see what services are running on your computer: try "what's running", very good program to see if you have malware, virus, worms, etc on your computer. Flup
It's not a virus, people are just horrible with computers.  See also: Link Ronaldo
EXPLANATION: csrss.exe is a graphic handling Windows process. However, Trojans and spyware sometimes use this title so that the user dons't delete it. This should only be deleted if you find it anywere except in the Windows\System32 folder. TechHelp
Located in C:\Documents and Settings\UserName\Local Settings\Temp Jean
I had a keylogger on my PC recently, however, I experienced no pop-ups. Multiple password based accounts were hacked. I performed a System Restore and changed all of my passwords (system restore went back approx. 4 days). I no longer have any problems regarding Keyloggers, and I only have one csrss.exe. Though it is a longshot, it's a solution you should not overlook. Zach G
CRSS.EXE process that is not located in the C:\WINDOWS\system32 folder is definite a sign of virus activity. Run the Security Task Manager if you are unsure.  See also: Link Janus
From what it seems if it's the legit process then it basically is what makes windows run, as it deals with the creation of Threading, which is useful for processors especially of the dual or quad core variety. I would make sure your stuff is right tho. LithiumFox
Dangerous Trojan Trojan
This is a legitimate file of Windows OS. The dangerous file is cssrs.exe. This cssrs.exe is always related to tazebama.exe virus. These files are very malicious and they convert folders into executable files. Dirk Flail
Lives in System32 Craig Nielson
It can completely lock up your computer. The only way i could get rid of it completely was to do a clean install of windows along with all drivers and windows updates. Bev
downloaded a zip file that said it was from UPS - closes all files - run scans - says I have 38 infected files and wants me to let it fix - I rebooted - McAfee says no digital signature - the virus is trying to open another csrss.exe - I never opened it but I tried to cancel and close the box but if I do that it takes over computer - so far as long as I just leave the box on screen it doesn't take over computer but MacAfee's scan doesn't find a problem? Michael
found in C:\documents and setings\user\local settings\temp\csrss.exe, followed by conhost.exe in C:\documents and setings\user\application data\microsoft , malicious software 777
is a critical system file Jon
Csrss.exe (You can find it in process tab of Task Manager) One cant stop this, even if you try it says "Windows process cant be stopped". the only way is go to Run type "Regedit" Navigat to H_KEY_CLASS_LOCALMACHINE\software\csrss and delete the file, locate the file in HDD through search and delete it. Best way is through updated antivirus s/w Apple
Its in my task manager, i cant delete it with i cant shut it off , i cant open it,
My computer crashed and McAfee found csrss.exe in my Temp file trying to access internet. Cannot delete it ... it won't allow delete or rename. A pop up occurs each time I try to delete... says in use by some person. Got it to delete one time and it showed up in Recycle bin, but then on a later restart, cssrs.exe showed again in my Temp file and was detected again by McAfee. I ask McAfee to block it. but it keeps coming up. Wordwaryor
This virus is very annoying, it causes blue screen after blue screen. I cannot run windows seven regularily anymore, only in safe mode and I still end of with blue screens every once and a while. In my task manager, under performance there is a buttom down low. I found two csrss.exe files that both run, when I suspend either one of them or end process my laptop freezes and I need to restart. I can only locate one file in system32. I even ran a full scan using Avast! Pro and came up with nothing. My machine is useless with this virus. Linden
It can be good and bad the one in system is usally good, but you can get one in roaming appdata which is trogen dropper gen3 lewis
have both csrss and smss, can't delete. Also have a file named MFCPLCNT in my start up. Also my "security center" is gone. Not in services anymore. al
i had this issue and the file was not located in the windows32 folder so i assumed its a virus. i installed and ran malwarebytes antimalware and it detected it and when i did the removal, the issue got fixed. it dont have a problem with it now. thanks to malwarebytes. its a really handy program. Miyatgwapa
It is located at my temp folder, when it is removed, my windows creating problems. Nokriinfo
Legit windows process Wiz Khalifa
This is a system file which you should not delete by any means. However it has been known, as with many file types, for viruses to disguise themselves as this. If you have two running in your task manager or if files baring this name appear where they shouldn't be then you should investigate that file as it may be harmful. But do not listen to the alarmist comments asserting that this is definetely a virus. LJ
first slowing and then bloking network (windows client/server) systems Aleksandar
Is a critical process, but it may be infected
Client/Server Runtime Subsystem, or csrss.exe, is a component of the Microsoft Windows NT operating system. It provides the user mode side of the Win32 subsystem and is included in Windows 2000, XP, 2003, Vista, Server 2008 and 7. Because most of the Win32 subsystem operations have been moved to kernel mode drivers, in Windows NT 4 and later CSRSS is mainly responsible for Win32 console handling and GUI shutdown. It is critical to system operation; therefore, terminating this process will result in system failure. Under normal circumstances, CSRSS cannot be terminated with the taskkill command  See also: Link cLueLeSs
Can Kill A computer if partnered with the "girls4you" virus MRIZOS
rendered my computer pretty much useless.
A Windows Process. When views in Task Manager, it is under "SYSTEM" A copy of the process in the user name was responsible for the "here you have virus" Harrison
This file is part of the main Client/Server IP process as is located in the system32 folder for windows XP. The virus will mask itself as a file in the documents folder of the primary user. Once you remove this file you will need to disable it in your msconfig to prevent it from loading. Scott
csrss.exe is taking 62-65% process in system manish kumar upadhyay
If located in c:\windows\system32 its a harmless system file. csrss.exe can cause high CPU loads while debugging (i. e. with Microsoft Visual Studio). This happens when you stop on a breakpoint. This behaviour is normal and totally innocuous. Felix (Software Developer)
I have two of these csrss.exe running in proccess! I dont know which to delete they are both the same!! but when put show user processes it only shows one Michael
In Vista, the real csrss.exe will not have an extra description on it, and won't be allowed to be closed. However, the virus csrss.exe WILL have the same thing as a description, and can be closed. You have to delete it permanently from your Windows file directory, then overwrite the place where it was stored. Michaela
crss.exe; has 3 variations im aware of, 1- legit win system file, 2- trojan/virus that uses the process and 3- the rewritten process. The 3rd is the damage, as it uses the sys32 to change the win/os registry, if installed with a comm/IM program it can attatch to the DDRAM process, then proceeds to attach to default video, sound and email/comm/upload defaults. crss.exe is neutral and has legit applications/use. **workaround* 1- Reboot with safe mode+no networking. 2- Disable + Verify the SQL[Generic Process] 3- Uninstall all Generic Messenger App, before reinstall 4- Unlink all social networks accounts before relinking 5- Ensure your generic messenger program uses a text to mobile phone single use pin code 6- Disconnect from all networks in safe mode, backup your data 7- Format your sys drive ** This exe cannot be removed from your system, and has legit use by Govt for ID verification, passport, banks, and BMD Cert** saffron
This is a legitimate windows file if it is located in C:\WINDOWS\system32 DBentley
csrss is not critical process; only critical processes for windows are user32.dll, kernel, rundll32.exe and files that display "file mismatch version", "some files in your system have been replaced" (...latters to require nav2012) bogdan
---Deutsch--- Ist im Normalfall ein normaler widows-Prozess. Wenn Sie zwei von diesen Prozessen haben, ist es sehr empfehlenswert den Computer mit einem Virenscanner zu Überprüfen. ---English--- This is normaly a normal Program, running on all Windows Computers. Should there be two of these Programs, one of them is most likely to be a Virus. ---- Wenn das Programm nicht in System32 drinnen ist, LÖSCHEN!!!! ---- If the Program is not in System32, Delete it!!! INFO
this is window file however if its not in system32 then its a worm/trojan/virus... if its virus then watch out Csrss is virus, CSRSS is virus, csrss can be regular or a virus send by others 38962
I custom scanned this file with Kaspersky and it did not show any sign of a virus or spyware. kuks
its used to protect system unwanted pop up blocks nikhil
csrss.exe is a program of windows which is needed every time you use your computer. Meaning, ending the process through task manager is impossible. Ending it would only result in your pc being frozen, or it will automatically restart. I've tried to cure it with several programs such as registry booster, speedupmypc, etc., and all did the same thing. It will stop the malware/virus part of it, but if you delete a certain file affected by it, or you dragged it into another folder, it will start running again, making your computer incredibly slow. Therefore the best solution i had was to reformat. 12th
Usually safe. Do not try to remove it manually. If your updated antivirus detects the process as infected, try to disinfect it. A completely disinfected system runs csrss.exe, just because it is an unstoppable and must process in windows OS.  See also: Link Mr.NT
Look out. If this file is not locates in system folder otherwise you cant open the location of the folder, thne be aware. Scan your pc completly with a antivirus like eset smart security or avira, then scan it with "unhackme" It should detect it as a malware. Hornnex
Csrss.exe is not dangerous but Crssr.exe and Csrrs.exe is 666
This is the Client Server Runtime SubSystem. If you use Process Explorer to terminate this critical system process, the kernel will halt the system and you will be greeted by a blue screen. The blue screen will be "CRITICAL_OBJECT_TERMINATION". This means any unsaved work is gone. I terminated csrss.exe as an experiment with the above results. The system simply cannot function without it. TechWizard86
Not a virus if its located in windows directory Yask Srivastava
From the looks of my Google searches, the actual file is a Windows process, but my problem came from a leftover (incorrect) registry entry pointing to it, left over after multiple virus-removal scans. Upon boot, I kept getting an error stating the file wasn't there (so, the AV scans likely found and removed the trojan version of this file, leaving it's accompanying registry entry). I removed the inappropriate registry entry that pointed to the erased folder, and things progressed well from then on--no more startup errors! Mike Denney ('The PC Doctor') in KY
This file must run for Windows to work, but it can be infected. any misspelling or change in name (CSRSS.EXE, crsss.exe, cssrs.exe, etc.) is malware.
For Info: Had a scam call from "Windows Support" in India insisting that my csrss.exe was rogue because it was using too much memory (7,984KB on Windows 7 64-bit). In reality it was a random cold-call (the caller had no genuine information about my PC), and there is nothing untoward about that level of memory usage. Simon
If it is on Microsoft and generally a small file (under 2mb) it should be safe. If it is on an apple or is a larger file (4mb+) delete immediately yo mama
You should ONLY have one csrss.exe that the system using Csrss stands for Client/Server Run-Time Subsystem name: csrss.exe user: SYSTEM CPU: (most likely 0) ram: 4500kb -to- 4900kb Placed: C:\Windows\System32 B3zzkha (Robin)
Do a windows search for "csrss" and right-click on it, and select your antivirus program from the menu to force a scan on the single file. Then you'll know if you are infected (or not). Do not delete if it's "clean"!!!! Dr. Rings
a windows component but will be infected and become a virus RommoR
This stuff is real. It's needed for running Windows. Arun
You will see 2 instances of csrss.exe running in processes if you have checked the box marked "Show processes from all users" , but have it located only in the System32 folder. Datatraxx
A vital way to check if it is a virus or not. Launch task manager, then view processes for all users. There you need to search for it, then click on End Process. If the message that pops up says Ending this process will shut down the Operating System entirely, it is a real one. If it comes up with the warning box in the link, then it is a fake one. Do this will all of your csrss.exe processes. P.S. If you need to shut down your computer in style (and give yourself BSoD), end this process.  See also: Link Louis Hall
The csrss.exe file is not really what i'd call "dangerous", however if the process is ended, it will cause a crash. Houdina
if you have 2 of them, one is fake, delete one that is not "system" lol
csrss.exe (Server Client Runtime SubSystem) is an important file in the windows operating system. If multiple instances of this are running on your computer then check if they are in C:/Windows/System32 if not, it is a virus. Anon
It slows down my pc, but Panda Antivirus and others dont see a virus in the csrss.exe.. Wesley
I think is not a virus, it's just a system file, because i see it in any windows or any PC with windows.... Not Virus
After reading some comments on this page and a quick search I found CSRSS.EXE-12B63473.pf in C:\WINDOWS\Prefetch. Was able to quarantine it with COMODO AV and delete. Bookmarked this site. It has saved me untold hours of frustration. Thanks onlyonetreetop
client server runtime server subsystem. it is not really needed, but important for security. Oskar
It is not allowing explorer.exe to run. My computer with 3gb ram and 2ghz speed is taking 5 min to open any folder
I've dealt with this virus before, it's a virus which is common in USBs and it hides all of the original files, stores them in a folder named "_" and replaces the original files with .exe files. When these .exe files are run, it prevents you from showing hidden and system files. To remove it, restart the PC, and go into safe mode. From there, you can show hidden and system files. Open the "_" folder, move all the files, delete all of the .exe and the autorun (if there is one there.) and you're good to go. Ace
---READ--- If there's only one csrss.exe process, you're not infected or anything. However if there's 2, one of them is a virus. The virus one is +1 mb, and is not in system32
Client/Server Runtime Subsystem From Wikipedia, the free encyclopedia Client/Server Runtime Subsystem, or csrss.exe, is a component of the Microsoft Windows NT operating system that provides the user mode side of the Win32 subsystem and is included in Windows 2000, Windows XP, Windows 2003, Windows Vista, Windows Server 2008 and Windows 7. Because most of the Win32 subsystem operations have been moved to kernel mode drivers, in Windows NT 4 and later CSRSS is mainly responsible for Win32 console handling and GUI shutdown. It is critical to system operation; therefore, terminating this process will result in system failure. Under normal circumstances, CSRSS cannot be terminated with the taskkill command or with Windows Task Manager, though it is possible in Vista if the Task Manager is run in Administrator mode. On Windows 7 and Windows 8 Developer Preview, Task Manager will inform the user that terminating the process will result in system failure, and prompt if they want to continue. Some virus hoax emails claim that csrss.exe is a virus that has been confirmed by Microsoft, and that the user should terminate it immediately. This, obviously, would actually lead to system failure and a blue screen of death.  See also: Link Raquel
This is a very important process for Windows, which might be important for handling mouse and keyboard(I see that whenever I press a key, the process produces 24 B of I/O. Also, moving mouse as fast as possible gives me 1.8 kB of I/O. So, without this process... You don't have a mouse or keyboard! (It CAN be infected however) Paul Olaru
had a lot of trouble recently with my laptop crashing and the last crash said upon boot it could be malware when i finally got a succsesful boot i checked my proccesses and there is only 1 of it but it has no extra information and i cant accsses its file area via right clicking and pressing go to file location and a few minuets later i get BSOD then rince and repeat i might try a speed check of sys 32 before it crashes next time bruce
system file fall
Possibly dangerous... if found in Task Manager (processes) then it is the bogus version. Otherwise it is safe and required for system.
if csrss.exe is in C: \ WINDOWS and system32 folder c: \ windows \ csrss.exe is a virus.is very difficult to remove them. nic45
This is a legit windows file for the runtime environment touch it and the computer will die Lenicus
Task Mang list only one csrss.exe, but it is 6,680 K in size while site list size of 4K to 6K. Steve
multiple cmd.exe windows popups up at a particular time once a week and the CSRSS.exe in monitor graph shows 98% process time. It goes down if you start killing the popups. It does harm the applications running, however, there are so many cmd windows popuped and you need to close them. There is sql client request that keeps on running everytime, but once a week some thing happens and multiple cmd windows pop up. There is no other csrss.exe in c:\windows\system32 and as there is no i386 folder because it is on windows server 2008. I hope there is no virus on the system if that is cause from above various discussions.
Windows System Datei Bernhard
File size changed 7,680 bytes oz
This is a Windows Client/Server file that is vital for the OS. Beware of scams though, there should only be ONE process of CRSS.exe running. If there are multiple instances of crss.exe, then one of them is a virus. Use a reputable AV to clean your computer and only delete files at the last resort. silence.winlocker
Many viruses disguise as this proccess. The fastest way you can be certain if it is a virus or not is by looking where it is located. Dont touch it tough, unless you know it is a virus... Sentl
system file... Jack
Vital system file. must have at all times.  See also: Link
This is completely safe! If you open Task Manager and kill it shows BSOD (Blue screen of death). This file will not harm your computer, because it is a windows or system file.
in my task manager there is a csrss.exe running but there's no description for it and when I saw NCB's message I went to c://windows/system i didn't find anything in that folder. higifnr
i also have 1 on task manager
Guys! Theres a virus that makes a copy of the the name, normaly the process shoud not be shut down. -CS Computer-S
This is a safe program; just be careful on what you download from the Internet. Get a free antivirus if you haven't gotten one yet. anonymous_helper
 See also: Link pinijsteyro
Spookey. In one explorer window it is 17kb but when i open another and want to upload it to online virus check that window repport the file csrss.exe 0kb kai
Probably not dangerous unless infected by virus. Christian
This one, along with aticlxx.exe warrants suspicion. Is anyone else having trouble with their internet connection over wifi? I believe them both to be the culprits--neither can be deleted! Amanda
It's a system file, but he may be a virus in some cases. --
This file is safe, but there are malware that hijacks the file. Stiverino
its a system file!!!! 100% safe awesomeface
If you are using Windows 7 Service Pack 1 or above and this file is running on Windows\System32 with Microsoft signature, this file is Windows component file. Try www.virustotal.com or Microsoft Security Essential(made by Microsoft) to check if your file is malware or virus.  See also: Link John
The "csrss.exe" image is a legitimate file used in MS Windows that utilizes the Win32 subsystem - literally all programs. However, due to it's importantness, lots of malware masquerade as the file in an attempt to trick you. Delete it if it is not at the directory C:\windows\system32 Enigma
It's a Windows file. This is talking about the OFFICIAL WINDOWS CSRSS.EXE that came with your PC. Not one you downloaded through being an idiot and not knowing how to use a computer. The OFFICIAL one is safe. One you got from trying to get free games or whatever you done, is probably a virus. Since this is about the REAL one, it's safe. Fuf
Just so you know, when you open the Task Manager in windows 7, go to Processes, and csrss.exe should be there. If you end this task, you will get a Blue Screen of Death (BSOD). A simple restart will fix this, and when you log back in, the csrss.exe file will be back. Also, if you get a "System32 is not responding" message, csrss.exe is probably deleted, removed or corrupted.  See also: Link Brody
It's a main windows file, it is however, one of the main files that will be infected first from a trojan virus. Mike
csrss.exe is a system file if it is located in the system32 folder else it is some kind of malware. Bob
mine says it is located in C:\Users\User\Appdata\Roaming\csrss.exe Albert
It's safe but it's very annoying. When I open Word and click on AutoCorrect items, the csrss.exe file HAS to let me down. Adam
It's a secured file who start Windows and if u delete/close it you can have a BSOD  See also: Link Jonathan
System file Eli

If you know more about csrss.exe, share your knowledge and help other users.

Security Rating:
Your opinion about this file:
Web page with more details:
Your first name:

More process information

Is csrss.exe spyware or a virus, trojans, adware or worm? Is there a known csrss.exe error?

Other Processes

[csrss.exe in German] [all processes]