How to remove an csrss error

The free file information forum can help you determine if csrss.exe is a virus, trojan, spyware, or adware that you can remove, or a file belonging to a Windows system or an application you can trust.

Click to Run a Free Scan for csrss.exe related errors

Csrss.exe file information

The process known as Client Server Runtime Process or Csrss Helper File or FTP Serv-U Daemon or SFX Cabinet Self-Extractor or setup or Live Update (version 64 bit) or Transparent Proxy Server or np

belongs to software Microsoft Windows Operating System or update or Serv-U or SFX Cabinet Self-Extractor or Csrss Helper File or Live Update (version 64 bit) or Transparent Proxy Server or Project1

by Microsoft (www.microsoft.com) or Cat Soft (www.cat-soft.com) or SFX Cabinet Self-Extractor or Transparent Proxy Server or TSoft or Symt or Transparent Proxy or Symt64bit.

Description: csrss.exe is located in the folder C:\Windows\System32. Known file sizes on Windows 7/XP are 6,144 bytes (88% of all occurrences), 4,096 bytes, 7,680 bytes or 6,656 bytes.
File csrss.exe is a Windows core system file. The program is not visible. Csrss.exe is a trustworthy file from Microsoft. Therefore the technical security rating is 4% dangerous, however also read the users reviews.

Recommended: Identify csrss.exe related errors

Viruses with the same file name

Is csrss.exe a virus? No, it is not. The true csrss.exe file is a safe Microsoft Windows system process, called "Client Server Runtime Process". However, writers of malware programs, such as viruses, worms, and trojans deliberately give their processes the same file name to escape detection. Viruses with the same file name are such as FDoS-Spabot or Generic BackDoor!dft (detected by McAfee), and TrojanSpy:Win32/Winspy or Backdoor:Win32/VB.ANS (detected by Microsoft).
To ensure that no rogue csrss.exe is running on your PC, click here to run a Free Malware Scan.

How to recognize suspicious variants? If csrss.exe is located in a subfolder of C:\Windows, the security rating is 77% dangerous. The file size is 698,368 bytes (11% of all occurrences), 185,026 bytes and 118 more variants. It is not a Windows core file. The program has no visible window. The file is an unknown file in the Windows folder. There is no file information. The program is loaded during the Windows boot process (see Registry key: C:\Windows\win.ini, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Run, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders). csrss.exe is able to hide itself, record inputs, manipulate other programs and monitor applications.

If csrss.exe is located in the folder C:\Windows, the security rating is 83% dangerous. The file size is 159,744 bytes (18% of all occurrences), 163,840 bytes and 117 more variants. The program has no file description. It is not a Windows core file. The file is an unknown file in the Windows folder. The program is not visible. Program starts upon Windows startup (see Registry key: C:\Windows\win.ini, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Run, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders). The application uses ports to connect to a LAN or the Internet. csrss.exe is able to record inputs, connect to Internet, monitor applications and hide itself.

If csrss.exe is located in a subfolder of C:\Windows\System32, the security rating is 80% dangerous. The file size is 74,240 bytes (22% of all occurrences), 2,121,216 bytes and 66 more variants.

If csrss.exe is located in a subfolder of "C:\Documents and Settings", the security rating is 67% dangerous. The file size is 180,736 bytes (3% of all occurrences), 167,314 bytes and 114 more variants.

If csrss.exe is located in a subfolder of "C:\Program Files", the security rating is 61% dangerous. The file size is 13,179,660 bytes (10% of all occurrences), 191,488 bytes and 65 more variants.

If csrss.exe is located in the Windows Temp folder, the security rating is 71% dangerous. The file size is 187,904 bytes (10% of all occurrences), 175,104 bytes and 34 more variants.

If csrss.exe is located in the folder C:\Windows\System32\drivers, the security rating is 74% dangerous. The file size is 32,256 bytes (28% of all occurrences), 81,920 bytes and 8 more variants.

If csrss.exe is located in a subfolder of C:\, the security rating is 61% dangerous. The file size is 657,211 bytes (83% of all occurrences) or 1,419,264 bytes.

If csrss.exe is located in the folder "C:\Program Files", the security rating is 72% dangerous. The file size is 183,470 bytes (20% of all occurrences), 180,451 bytes, 180,909 bytes, 59,904 bytes or 196,096 bytes.

If csrss.exe is located in a subfolder of "C:\Program Files\Common Files", the security rating is 64% dangerous. The file size is 23,040 bytes (33% of all occurrences), 29,184 bytes or 32,768 bytes.

If csrss.exe is located in the folder "C:\Documents and Settings", the security rating is 56% dangerous. The file size is 126,976 bytes (50% of all occurrences) or 122,880 bytes.

If csrss.exe is located in C:\, the security rating is 62% dangerous. The file size is 82,432 bytes (50% of all occurrences) or 550,912 bytes.

If csrss.exe is located in a subfolder of C:\Windows\System32\drivers, the security rating is 90% dangerous. The file size is 2,304,512 bytes.

If csrss.exe is located in a subfolder of the "My Files" folder, the security rating is 70% dangerous. The file size is 179,712 bytes.

If csrss.exe is located in a subfolder of Windows Temp folder, the security rating is 42% dangerous. The file size is 247,808 bytes.

External information from Paul Collins:
There are different files with the same name:

"Microsoft SourceSafe" definitely not required. Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
"BagleAV" definitely not required. Added by the NETSKY.AB WORM! Note - this is not the legitimate csrss.exe process which should NOT appear in Msconfig/Startup!
"ClickTheButton" definitely not required. ClickTheButton Downloader-MY adware. Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
"CSRSS" definitely not required. Search page hijacker, redirecting to http://www.search-aide.com/. Note - this is not the valid Client Server Runtime Subsystem (csrss.exe) process, which provides text window support, shutdown, and hard-error handling
"DIECOX" definitely not required. Added by a variant of the ATM.GEN TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
"KernellApps" definitely not required.
"Key Logger" definitely not required. Added by the BUCHON.A WORM! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
"NTDLM" definitely not required. Added by the HALE TROJAN! Note - this is not the legitimate csrss.exe process which should NOT appear in Msconfig/Startup!
"RegWrite" definitely not required. Added by the SOKACAPS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
"Run TaskMrg" definitely not required. Added by the LDPINCH-W TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
"rundll32" definitely not required. Added by the GUTTA TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
"Shockwave" definitely not required. Added by the SNDOG WORM! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
"SYSTEMSars32" definitely not required. Added by the AHLEM.A WORM! Note - this is not the legitimate csrss.exe process which should NOT appear in Msconfig/Startup!
"WinUpdateProtection" can run at start up. ICE Remote Spy monitoring software, "secretly monitors everything your spouse, kids or employees do on the Internet and emails the data to you." Note - this file is installed in a C:\Windowsupdate\Ufp\Irs7 folder

Important: Some malware camouflages itself as csrss.exe, particularly when located in the c:\windows or c:\windows\system32 folder. Therefore, you should check the csrss.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.

Score

User Comments

had a lot of trouble recently with my laptop crashing and the last crash said upon boot it could be malware when i finally got a succsesful boot i checked my proccesses and there is only 1 of it but it has no extra information and i cant accsses its file area via right clicking and pressing go to file location and a few minuets later i get BSOD then rince and repeat i might try a speed check of sys 32 before it crashes next time
bruce

This is a very important process for Windows, which might be important for handling mouse and keyboard(I see that whenever I press a key, the process produces 24 B of I/O. Also, moving mouse as fast as possible gives me 1.8 kB of I/O. So, without this process... You don't have a mouse or keyboard! (It CAN be infected however)
Paul Olaru

Client/Server Runtime Subsystem From Wikipedia, the free encyclopedia Client/Server Runtime Subsystem, or csrss.exe, is a component of the Microsoft Windows NT operating system that provides the user mode side of the Win32 subsystem and is included in Windows 2000, Windows XP, Windows 2003, Windows Vista, Windows Server 2008 and Windows 7. Because most of the Win32 subsystem operations have been moved to kernel mode drivers, in Windows NT 4 and later CSRSS is mainly responsible for Win32 console handling and GUI shutdown. It is critical to system operation; therefore, terminating this process will result in system failure. Under normal circumstances, CSRSS cannot be terminated with the taskkill command or with Windows Task Manager, though it is possible in Vista if the Task Manager is run in Administrator mode. On Windows 7 and Windows 8 Developer Preview, Task Manager will inform the user that terminating the process will result in system failure, and prompt if they want to continue. Some virus hoax emails claim that csrss.exe is a virus that has been confirmed by Microsoft, and that the user should terminate it immediately. This, obviously, would actually lead to system failure and a blue screen of death.
Raquel (further information)

---READ--- If there's only one csrss.exe process, you're not infected or anything. However if there's 2, one of them is a virus. The virus one is +1 mb, and is not in system32

I've dealt with this virus before, it's a virus which is common in USBs and it hides all of the original files, stores them in a folder named "_" and replaces the original files with .exe files. When these .exe files are run, it prevents you from showing hidden and system files. To remove it, restart the PC, and go into safe mode. From there, you can show hidden and system files. Open the "_" folder, move all the files, delete all of the .exe and the autorun (if there is one there.) and you're good to go.
Ace

It is not allowing explorer.exe to run. My computer with 3gb ram and 2ghz speed is taking 5 min to open any folder

client server runtime server subsystem. it is not really needed, but important for security.
Oskar

After reading some comments on this page and a quick search I found CSRSS.EXE-12B63473.pf in C:\WINDOWS\Prefetch. Was able to quarantine it with COMODO AV and delete. Bookmarked this site. It has saved me untold hours of frustration. Thanks
onlyonetreetop

More comments can be found here:
(further information)

Summary: Average user rating of csrss.exe: based on 469 votes with 9 reviews.

144 users think csrss.exe is essential for Windows or an installed application. 27 users think it's probably harmless. 105 users think it's neither essential nor dangerous. 75 users suspect danger. 118 users think csrss.exe is dangerous and recommend removing it. 43 users doesn't grade csrss.exe ("not sure about it").

Csrss scanner

Security Task Manager shows all running Windows tasks including embedded hidden functions (e.g. keyboard or browser monitoring, autostart entry). A unique security risk rating indicates the likelihood of the process being potential spyware, malware, keylogger or a Trojan.

MalwareBytes detects and removes sleeping spyware, adware, trojans, keyloggers, malware and tracking threats from your hard disk. Ideal supplement to Security Task Manager.

SpeedUpMyPC scans, cleans, repairs and optimizes your computer.

Other processes