What is csrss.exe?

The genuine csrss.exe file is a software component of Microsoft Windows Operating System by Microsoft Corporation.
When "csrss.exe" is in "C:\Windows\System32", it is the Client/Server Runtime Subsystem, central to each user session in Microsoft Windows or Windows Server. It should not be removed. It oversees the Windows Environment Subsystem. Windows architecture contains both user-mode and kernel-mode processes and additional Dynamic Link Library (.DLL) routines those processes use. "Csrss.exe" is the second user-mode process to start up in Windows as a whole, when "smss.exe" (the first) invokes a non-interactive (Session 0) instance of it. An interactive instance of "csrss.exe" is also started for each Windows user session. It has Local System account privileges, which led to a change in it for Windows 7 and Windows Server 2008 R2. Before that, in XP, it handled messages from command-line "console applications" without GUI's, which some malware exploited. "Csrss.exe" still handles calls from user-mode processes requiring process or thread creation or side-by-side support. Console application messages now go through "conhost.exe".

CSRSs stands for Client/Server Runtime Subsystem

The .exe extension on a filename indicates an executable file. Executable files may, in some cases, harm your computer. Therefore, please read below to decide for yourself whether the csrss.exe on your computer is a Trojan that you should remove, or whether it is a file belonging to the Windows operating system or to a trusted application.

Click to Run a Free Scan for csrss.exe related errors

Csrss.exe file information

Windows Task Manager with csrss — Csrss.exe process in Windows Task Manager

The process known as Client Server Runtime Process or Microsoft Malware Protection Command Line Utility or hla or MyB Microsoft or Virage or Verbal or sdfzsdf.ele or sgahffjfghj.exe

belongs to software Microsoft Windows Operating System or hla or Project1 or Virage or Verbal or Osiris HermesCopperfieldSperry Cerberus Ericsson WeeksBurtonPaulo or Prowject1 or GBP

by Microsoft (www.microsoft.com) or Microsoft Corporation. All rights reserved or 10051 or 5225102f0434382d242811523e2627225c0650271700133f52163721402002312055 or 10133 or BellSouth (www.att.com) or KowalewskiAgamemnonStSt. Sprague Arden KyotoPackard Actaeon or 10152.

Description: The original csrss.exe from Microsoft is an important part of Windows, but often causes problems. The csrss.exe file is located in the C:\Windows\System32 folder. Known file sizes on Windows 10/11/7 are 6,144 bytes (95% of all occurrences), 7,680 bytes and 10 more variants.
The file is a Windows system file. The program has no visible window. It is a trustworthy file from Microsoft. Therefore the technical security rating is 4% dangerous, however you should also read the user reviews.

Recommended: Identify csrss.exe related errors

Viruses with the same file name

Is csrss.exe a virus? No, it is not. The true csrss.exe file is a safe Microsoft Windows system process, called "Client Server Runtime Process". However, writers of malware programs, such as viruses, worms, and Trojans deliberately give their processes the same file name to escape detection. Viruses with the same file name are for instance TROJ_SPNR.07J511 (detected by TrendMicro), and WS.Reputation.1 (detected by Symantec).
To ensure that no rogue csrss.exe is running on your PC, click here to run a Free Virus Scan.

How to recognize suspicious variants?

If csrss.exe is located in a subfolder of C:\Windows, the security rating is 76% dangerous. The file size is 3,788,288 bytes (1% of all occurrences), 3,992,064 bytes and 392 more variants. The csrss.exe file is not a Windows core file. The program has no visible window. There is no information about the author of the file. The software uses ports to connect to or from a LAN or the Internet. Csrss.exe is able to monitor applications and manipulate other programs.
If csrss.exe is located in the C:\Windows folder, the security rating is 68% dangerous. The file size is 1,559,319 bytes (28% of all occurrences), 2,531,840 bytes and 21 more variants. The csrss.exe file is not a Windows core file. Csrss.exe is located in the Windows folder, but it is not a Windows core file. The program is not visible. The application listens for or sends data on open ports to a LAN or the Internet. Csrss.exe is able to monitor applications.
If csrss.exe is located in a subfolder of the user's profile folder, the security rating is 72% dangerous. The file size is 196,608 bytes (4% of all occurrences), 118,784 bytes and 55 more variants.
If csrss.exe is located in a subfolder of "C:\Program Files", the security rating is 75% dangerous. The file size is 1,380,864 bytes (7% of all occurrences), 1,267,712 bytes and 33 more variants.
If csrss.exe is located in the Windows folder for temporary files, the security rating is 60% dangerous. The file size is 258,560 bytes (10% of all occurrences), 465,261 bytes and 8 more variants.
If csrss.exe is located in a subfolder of Windows folder for temporary files, the security rating is 82% dangerous. The file size is 13,179,660 bytes.
If csrss.exe is located in a subfolder of C:\, the security rating is 65% dangerous. The file size is 184,320 bytes (28% of all occurrences), 319,496 bytes and 4 more variants.
If csrss.exe is located in a subfolder of C:\Windows\System32, the security rating is 84% dangerous. The file size is 8,192 bytes (25% of all occurrences), 122,880 bytes, 353,280 bytes or 704,000 bytes.
If csrss.exe is located in the C:\Windows\System32\drivers folder, the security rating is 42% dangerous. The file size is 20,480 bytes (50% of all occurrences) or 152,125 bytes.
If csrss.exe is located in a subfolder of "C:\Program Files\Common Files", the security rating is 36% dangerous. The file size is 320,265 bytes.

External information from Paul Collins:
There are different files with the same name:

"Microsoft SourceSafe" definitely not required. Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
"BagleAV" definitely not required. Added by the NETSKY.AB WORM! Note - this is not the legitimate csrss.exe process which should NOT appear in Msconfig/Startup!
"ClickTheButton" definitely not required. ClickTheButton Downloader-MY adware. Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
"CSRSS" definitely not required. Search page hijacker, redirecting to http://www.search-aide.com/. Note - this is not the valid Client Server Runtime Subsystem (csrss.exe) process, which provides text window support, shutdown, and hard-error handling
"DIECOX" definitely not required. Added by a variant of the ATM.GEN TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
"KernellApps" definitely not required.
"Key Logger" definitely not required. Added by the BUCHON.A WORM! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
"NTDLM" definitely not required. Added by the HALE TROJAN! Note - this is not the legitimate csrss.exe process which should NOT appear in Msconfig/Startup!
"RegWrite" definitely not required. Added by the SOKACAPS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
"Run TaskMrg" definitely not required. Added by the LDPINCH-W TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
"rundll32" definitely not required. Added by the GUTTA TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
"Shockwave" definitely not required. Added by the SNDOG WORM! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
"SYSTEMSars32" definitely not required. Added by the AHLEM.A WORM! Note - this is not the legitimate csrss.exe process which should NOT appear in Msconfig/Startup!
"WinUpdateProtection" can run at start up. ICE Remote Spy monitoring software, "secretly monitors everything your spouse, kids or employees do on the Internet and emails the data to you." Note - this file is installed in a C:\Windowsupdate\Ufp\Irs7 folder

Important: Some malware disguises itself as csrss.exe, particularly when not located in the C:\Windows\System32 folder. Therefore, you should check the csrss.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.

Score

User Comments

Windows will bugcheck (the internal name for BSoD) without this process. However, some malware hooks into this process. AVG has a bug where it will delete system files if it contains a virus.
Charles

The only thing I know about it is: CSRSS.exe is located at C:\Windows\System32 Usually on higher versions of Windows (example: Windows 10 1909) has 2 csrss.exe's: One for the system, one for controlling its work when the user is in. In my computer, it weights 18KB. Description: Client Server Runtime SubSystem The process is NOT dangerous, keep in mind that some of malware may disguise them as csrss.exe. What does it do: Hosts 16-bit MS-DOS subsystem, creates threads, and runs another critical system process: CONHOST.EXE (C:\Windows\System32\conhost.exe or C:\Windows\SysWOW64\conhost.exe.) You can't kill this process, and most versions of Windows couldn't "survive" without it: even if you somehow got rid of it, you get an instant blue screen of death. (Stop code: CRITICAL_PROCESS_DIED) How to check if this process is malware: First way. Find it in: C:\Users\%your username here%\AppData\Local\Temp C:\Windows\Temp C:\ C:\Users\%your username here% Windows Task Scheduler (this folder doesn't always exist, but may exist) C:\Users\%your username here%\LocalLow\Temp You can also find it in task manager running. Right click it and click on Open file location. If it's located in C:\Windows\System32, you better keep it running. If it is not, it's definitely malware and I recommend using Malwarebytes. You can also check that in properties. Process digital signatures must be from Microsoft. In Details tab (i think) must be Microsoft Operating System. If it's all empty or something else, it's definitely malware. If you use Windows 10, check the file version. Usually the first digits start from 10. Sometimes it's still the same version. I can say, CSRSS.EXE is not malware but some malware may disguise itself as CSRSS.EXE. If you're not sure if it's real CSRSS.EXE, you can try out these ways on how to find if CSRSS.EXE is malware above.
Windows Helper

csrss.exe Is A Legitimate Windows Process If You End The Process You Get A BSOD With A Process Or Theard Curcial To System Operation Has Unexpectedly Terminated OR Been Exited. Some Rouge Programs Like Wolfram AV Drop A Fake Variant With It Being 57% Dangerous
Luis Guzman

I think it is safe, see Virustotal report:
(further information)

Terminate Csrss Or Client Server Runtime, And You Get 0XF4 BSOD (Blue Screen of Death) On Windows Vista Or 7.
Aaron

if you terminate csrss.exe BSoD will show
Jaxon Ferrero

csrss.exe is a critical system procees required by many default Windows applications and Windows. if you end it you will get a BSOD.
NotBart

its a CRITICAL windows process and the computer cannot run without it
csrss.exe

More comments can be found here:
(further information)

Summary: Average user rating of csrss.exe: based on 518 votes with 9 user comments. 171 users think csrss.exe is essential for Windows or an installed application. 31 users think it's probably harmless. 112 users think it's neither essential nor dangerous. 79 users suspect danger. 125 users think csrss.exe is dangerous and recommend removing it. 46 users don't grade csrss.exe ("not sure about it").

Best practices for resolving csrss issues

A clean and tidy computer is the key requirement for avoiding problems with csrss. This means running a scan for malware, cleaning your hard drive using 1cleanmgr and 2sfc /scannow, 3uninstalling programs that you no longer need, checking for Autostart programs (using 4msconfig) and enabling Windows' 5Automatic Update. Always remember to perform periodic backups, or at least to set restore points.

Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the 6resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or executing the 7DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.

To get your computer running as fast as it did on day one, you can 8reset your PC. Your personal files will remain intact, but any programs you installed will need to be reinstalled.

To help you analyze the csrss.exe process on your computer, the following programs have proven to be helpful: ASecurity Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. A good Bantivirus software detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

Other processes

ascplugin_protection.dll steam.exe lsass.exe csrss.exe skypehost.exe hostappserviceupdater.exe armsvc.exe googleupdate.exe igfxtray.exe rpbrowserrecordplugin.dll wltrysvc.exe [all]

	Do you have additional information?
What do you know about csrss.exe:
How would you rate it:
Link for more info:
Your Name: