English | Deutsch


Is csrss.exe safe?

Csrss.exe is a executable file (a program) within Windows. The filename extension .exe denotes an executable file. You should only run executable files from publishers you trust, because executable files can potentially change your computer settings or harm your computer. The free file information forum can help you determine if csrss.exe is a virus, trojan, spyware, or adware that you can remove, or a file belonging to a Windows system or to an application you can trust.


Csrss.exe file information

The process known as Client Server Runtime Process or Csrss Helper File or FTP Serv-U Daemon or SFX Cabinet Self-Extractor or setup or Live Update (version 64 bit) or Transparent Proxy Server or np

belongs to software Microsoft Windows Operating System or update or Serv-U or SFX Cabinet Self-Extractor or Csrss Helper File or Live Update (version 64 bit) or Transparent Proxy Server or Project1

by Microsoft (www.microsoft.com) or Cat Soft (www.cat-soft.com) or SFX Cabinet Self-Extractor or Transparent Proxy Server or TSoft or Symt or Transparent Proxy or Symt64bit.

Description: The original csrss.exe from Microsoft is an important part of Windows, but often causes problems. csrss.exe is located in the folder C:\Windows\System32. Known file sizes on Windows 7/XP are 6,144 bytes (88% of all occurrences), 4,096 bytes and 4 more variants. http://www.file.net/process/csrss.exe.html 
The csrss.exe file is a Windows core system file. The program is not visible. Csrss.exe is a trustworthy file from Microsoft. Therefore the technical security rating is 4% dangerous, however also read the users reviews.

Recommended: Identify csrss.exe related errors

Viruses with the same file name

Is csrss.exe a virus? No, it is not. The true csrss.exe file is a safe Microsoft Windows system process, called "Client Server Runtime Process". However, writers of malware programs, such as viruses, worms, and trojans deliberately give their processes the same file name to escape detection. Viruses with the same file name are such as TROJ_GEN.USEGJ20 or TROJ_GEN.R47C3H7 (detected by TrendMicro), and Trojan-Proxy.Win32.Agent.kj or Trojan-Downloader.MSIL.Agent.pg (detected by Kaspersky).
To ensure that no rogue csrss.exe is running on your PC, click here to run a Free Malware Scan.

How to recognize suspicious variants? If csrss.exe is located in a subfolder of C:\Windows, the security rating is 77% dangerous. The file size is 698,368 bytes (11% of all occurrences), 185,026 bytes and 118 more variants. It is not a Windows core file. The program has no visible window. The file is an unknown file in the Windows folder. There is no file information. The program is loaded during the Windows boot process (see Registry key: C:\Windows\win.ini, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Run, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders). Csrss.exe is able to hide itself, record inputs, manipulate other programs and monitor applications.

If csrss.exe is located in the folder C:\Windows, the security rating is 83% dangerous. The file size is 159,744 bytes (17% of all occurrences), 163,840 bytes and 118 more variants. The program has no file description. It is not a Windows core file. The file is an unknown file in the Windows folder. The program is not visible. The software starts upon Windows startup (see Registry key: C:\Windows\win.ini, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Run, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders). The application uses ports to connect to a LAN or the Internet. Csrss.exe is able to record inputs, connect to the Internet, monitor applications and hide itself.

If csrss.exe is located in a subfolder of C:\Windows\System32, the security rating is 80% dangerous. The file size is 74,240 bytes (22% of all occurrences), 2,121,216 bytes and 67 more variants.

If csrss.exe is located in a subfolder of "C:\Documents and Settings", the security rating is 67% dangerous. The file size is 180,736 bytes (2% of all occurrences), 167,314 bytes and 123 more variants.

If csrss.exe is located in a subfolder of "C:\Program Files", the security rating is 61% dangerous. The file size is 13,179,660 bytes (10% of all occurrences), 191,488 bytes and 68 more variants.

If csrss.exe is located in the Windows Temp folder, the security rating is 70% dangerous. The file size is 187,904 bytes (9% of all occurrences), 175,104 bytes and 38 more variants.

If csrss.exe is located in the folder C:\Windows\System32\drivers, the security rating is 73% dangerous. The file size is 32,256 bytes (26% of all occurrences), 81,920 bytes and 9 more variants.

If csrss.exe is located in a subfolder of C:\, the security rating is 59% dangerous. The file size is 657,211 bytes (62% of all occurrences), 1 bytes, 70,144 bytes or 1,419,264 bytes.

If csrss.exe is located in the folder "C:\Program Files", the security rating is 72% dangerous. The file size is 183,470 bytes (20% of all occurrences), 180,451 bytes, 180,909 bytes, 59,904 bytes or 196,096 bytes.

If csrss.exe is located in a subfolder of "C:\Program Files\Common Files", the security rating is 64% dangerous. The file size is 23,040 bytes (33% of all occurrences), 29,184 bytes or 32,768 bytes.

If csrss.exe is located in the folder "C:\Documents and Settings", the security rating is 56% dangerous. The file size is 126,976 bytes (50% of all occurrences) or 122,880 bytes.

If csrss.exe is located in C:\, the security rating is 62% dangerous. The file size is 82,432 bytes (50% of all occurrences) or 550,912 bytes.

If csrss.exe is located in a subfolder of C:\Windows\System32\drivers, the security rating is 90% dangerous. The file size is 2,304,512 bytes.

If csrss.exe is located in a subfolder of the "My Files" folder, the security rating is 70% dangerous. The file size is 179,712 bytes.

If csrss.exe is located in a subfolder of Windows Temp folder, the security rating is 42% dangerous. The file size is 247,808 bytes.

External information from Paul Collins:
There are different files with the same name:

  • "Microsoft SourceSafe" definitely not required. Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
  • "BagleAV" definitely not required. Added by the NETSKY.AB WORM! Note - this is not the legitimate csrss.exe process which should NOT appear in Msconfig/Startup!
  • "ClickTheButton" definitely not required. ClickTheButton Downloader-MY adware. Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
  • "CSRSS" definitely not required. Search page hijacker, redirecting to http://www.search-aide.com/. Note - this is not the valid Client Server Runtime Subsystem (csrss.exe) process, which provides text window support, shutdown, and hard-error handling
  • "DIECOX" definitely not required. Added by a variant of the ATM.GEN TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
  • "KernellApps" definitely not required.
  • "Key Logger" definitely not required. Added by the BUCHON.A WORM! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
  • "NTDLM" definitely not required. Added by the HALE TROJAN! Note - this is not the legitimate csrss.exe process which should NOT appear in Msconfig/Startup!
  • "RegWrite" definitely not required. Added by the SOKACAPS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
  • "Run TaskMrg" definitely not required. Added by the LDPINCH-W TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
  • "rundll32" definitely not required. Added by the GUTTA TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
  • "Shockwave" definitely not required. Added by the SNDOG WORM! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
  • "SYSTEMSars32" definitely not required. Added by the AHLEM.A WORM! Note - this is not the legitimate csrss.exe process which should NOT appear in Msconfig/Startup!
  • "WinUpdateProtection" can run at start up. ICE Remote Spy monitoring software, "secretly monitors everything your spouse, kids or employees do on the Internet and emails the data to you." Note - this file is installed in a C:\Windowsupdate\Ufp\Irs7 folder

Important: Some malware disguises itself as csrss.exe, particularly when not located in the C:\Windows\System32 folder. Therefore, you should check the csrss.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.



Score

User Comments

system file...
  Jack  
Many viruses disguise as this proccess. The fastest way you can be certain if it is a virus or not is by looking where it is located. Dont touch it tough, unless you know it is a virus...
  Sentl  
This is a Windows Client/Server file that is vital for the OS. Beware of scams though, there should only be ONE process of CRSS.exe running. If there are multiple instances of crss.exe, then one of them is a virus. Use a reputable AV to clean your computer and only delete files at the last resort.
  silence.winlocker  
File size changed 7,680 bytes
  oz  
Windows System Datei
  Bernhard  
multiple cmd.exe windows popups up at a particular time once a week and the CSRSS.exe in monitor graph shows 98% process time. It goes down if you start killing the popups. It does harm the applications running, however, there are so many cmd windows popuped and you need to close them. There is sql client request that keeps on running everytime, but once a week some thing happens and multiple cmd windows pop up. There is no other csrss.exe in c:\windows\system32 and as there is no i386 folder because it is on windows server 2008. I hope there is no virus on the system if that is cause from above various discussions.
   
Task Mang list only one csrss.exe, but it is 6,680 K in size while site list size of 4K to 6K.
  Steve  
This is a legit windows file for the runtime environment touch it and the computer will die
  Lenicus  
More comments can be found here:
    (further information)

Rating chart

Summary: Average user rating of csrss.exe: based on 489 votes with 9 reviews.
153 users think csrss.exe is essential for Windows or an installed application. 30 users think it's probably harmless. 111 users think it's neither essential nor dangerous. 75 users suspect danger. 120 users think csrss.exe is dangerous and recommend removing it. 44 users don't grade csrss.exe ("not sure about it").


Do you have additional information?
What do you know about csrss.exe: 
How do you rate it: 
Link for more info's: 
Your Name: 


Csrss scanner


Security Task Manager shows all running Windows tasks including embedded hidden functions (e.g. keyboard or browser monitoring, autostart entry). A unique security risk rating indicates the likelihood of the process being potential spyware, malware, keylogger or a Trojan.

Malwarebytes Anti-Malware detects and removes sleeping spyware, adware, trojans, keyloggers, malware and tracking threats from your hard disk. Ideal supplement to Security Task Manager.

SpeedUpMyPC scans, cleans, repairs and optimizes your computer.


Other processes


csrss.exe [all]