How to remove an csrss error
The free file information forum can help you determine if csrss.exe is a virus, trojan, spyware, or adware that you can remove, or a file belonging to a Windows system or an application you can trust.
Click to Run a Free Scan for csrss.exe related errors
Csrss.exe file information
The process known as Client Server Runtime Process or Csrss Helper File or FTP Serv-U Daemon or SFX Cabinet Self-Extractor or setup or Live Update (version 64 bit) or Transparent Proxy Server or np
belongs to software Microsoft Windows Operating System or update or Serv-U or SFX Cabinet Self-Extractor or Csrss Helper File or Live Update (version 64 bit) or Transparent Proxy Server or Project1
by Microsoft (www.microsoft.com) or Cat Soft (www.cat-soft.com) or SFX Cabinet Self-Extractor or Transparent Proxy Server or TSoft or Symt or Transparent Proxy or Symt64bit.
Description: csrss.exe is located in the folder C:\Windows\System32.
Known file sizes on Windows 7/XP are 6,144 bytes (88% of all occurrences), 4,096 bytes, 7,680 bytes or 6,656 bytes.
File csrss.exe is a Windows core system file. The program is not visible. Csrss.exe is a trustworthy file from Microsoft.
Therefore the technical security rating is 4% dangerous, however also read the users reviews.
Recommended: Identify csrss.exe related errors
Viruses with the same file name
Is csrss.exe a virus? No, it is not. The true csrss.exe file is a safe Microsoft Windows system process, called "Client Server Runtime Process".
However, writers of malware programs, such as viruses, worms, and trojans deliberately give their processes the same file name to escape detection. Viruses with the same file name are such as FDoS-Spabot or Generic BackDoor!dft (detected by McAfee), and TrojanSpy:Win32/Winspy or Backdoor:Win32/VB.ANS (detected by Microsoft).
To ensure that no rogue csrss.exe is running on your PC, click here to run a Free Malware Scan.
How to recognize suspicious variants? If csrss.exe is located in a subfolder of C:\Windows, the security rating is 77% dangerous. The file size is 698,368 bytes (11% of all occurrences), 185,026 bytes and 118 more variants. It is not a Windows core file. The program has no visible window. The file is an unknown file in the Windows folder. There is no file information. The program is loaded during the Windows boot process (see Registry key: C:\Windows\win.ini, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Run, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders). csrss.exe is able to hide itself, record inputs, manipulate other programs and monitor applications.
If csrss.exe is located in the folder C:\Windows, the security rating is 83% dangerous. The file size is 159,744 bytes (18% of all occurrences), 163,840 bytes and 117 more variants. The program has no file description. It is not a Windows core file. The file is an unknown file in the Windows folder. The program is not visible. Program starts upon Windows startup (see Registry key: C:\Windows\win.ini, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Run, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders). The application uses ports to connect to a LAN or the Internet. csrss.exe is able to record inputs, connect to Internet, monitor applications and hide itself.
If csrss.exe is located in a subfolder of C:\Windows\System32, the security rating is 80% dangerous. The file size is 74,240 bytes (22% of all occurrences), 2,121,216 bytes and 66 more variants.
If csrss.exe is located in a subfolder of "C:\Documents and Settings", the security rating is 67% dangerous. The file size is 180,736 bytes (3% of all occurrences), 167,314 bytes and 114 more variants.
If csrss.exe is located in a subfolder of "C:\Program Files", the security rating is 61% dangerous. The file size is 13,179,660 bytes (10% of all occurrences), 191,488 bytes and 65 more variants.
If csrss.exe is located in the Windows Temp folder, the security rating is 71% dangerous. The file size is 187,904 bytes (10% of all occurrences), 175,104 bytes and 34 more variants.
If csrss.exe is located in the folder C:\Windows\System32\drivers, the security rating is 74% dangerous. The file size is 32,256 bytes (28% of all occurrences), 81,920 bytes and 8 more variants.
If csrss.exe is located in a subfolder of C:\, the security rating is 61% dangerous. The file size is 657,211 bytes (83% of all occurrences) or 1,419,264 bytes.
If csrss.exe is located in the folder "C:\Program Files", the security rating is 72% dangerous. The file size is 183,470 bytes (20% of all occurrences), 180,451 bytes, 180,909 bytes, 59,904 bytes or 196,096 bytes.
If csrss.exe is located in a subfolder of "C:\Program Files\Common Files", the security rating is 64% dangerous. The file size is 23,040 bytes (33% of all occurrences), 29,184 bytes or 32,768 bytes.
If csrss.exe is located in the folder "C:\Documents and Settings", the security rating is 56% dangerous. The file size is 126,976 bytes (50% of all occurrences) or 122,880 bytes.
If csrss.exe is located in C:\, the security rating is 62% dangerous. The file size is 82,432 bytes (50% of all occurrences) or 550,912 bytes.
If csrss.exe is located in a subfolder of C:\Windows\System32\drivers, the security rating is 90% dangerous. The file size is 2,304,512 bytes.
If csrss.exe is located in a subfolder of the "My Files" folder, the security rating is 70% dangerous. The file size is 179,712 bytes.
If csrss.exe is located in a subfolder of Windows Temp folder, the security rating is 42% dangerous. The file size is 247,808 bytes.
External information from Paul Collins:
There are different files with the same name:
- "Microsoft SourceSafe" definitely not required. Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
- "BagleAV" definitely not required. Added by the NETSKY.AB WORM! Note - this is not the legitimate csrss.exe process which should NOT appear in Msconfig/Startup!
- "ClickTheButton" definitely not required. ClickTheButton Downloader-MY adware. Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
- "CSRSS" definitely not required. Search page hijacker, redirecting to http://www.search-aide.com/. Note - this is not the valid Client Server Runtime Subsystem (csrss.exe) process, which provides text window support, shutdown, and hard-error handling
- "DIECOX" definitely not required. Added by a variant of the ATM.GEN TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
- "KernellApps" definitely not required.
- "Key Logger" definitely not required. Added by the BUCHON.A WORM! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
- "NTDLM" definitely not required. Added by the HALE TROJAN! Note - this is not the legitimate csrss.exe process which should NOT appear in Msconfig/Startup!
- "RegWrite" definitely not required. Added by the SOKACAPS TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
- "Run TaskMrg" definitely not required. Added by the LDPINCH-W TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
- "rundll32" definitely not required. Added by the GUTTA TROJAN! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
- "Shockwave" definitely not required. Added by the SNDOG WORM! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
- "SYSTEMSars32" definitely not required. Added by the AHLEM.A WORM! Note - this is not the legitimate csrss.exe process which should NOT appear in Msconfig/Startup!
- "WinUpdateProtection" can run at start up. ICE Remote Spy monitoring software, "secretly monitors everything your spouse, kids or employees do on the Internet and emails the data to you." Note - this file is installed in a C:\Windowsupdate\Ufp\Irs7 folder
Important: Some malware camouflages itself as csrss.exe, particularly when located in the c:\windows or c:\windows\system32 folder. Therefore, you should check the csrss.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.
Score
User Comments
Paul Olaru
Raquel (further information)
Ace
Oskar
onlyonetreetop
Csrss scanner
Security Task Manager shows all running Windows tasks including embedded hidden functions (e.g. keyboard or browser monitoring, autostart entry). A unique security risk rating indicates the likelihood of the process being potential spyware, malware, keylogger or a Trojan. MalwareBytes detects and removes sleeping spyware, adware, trojans, keyloggers, malware and tracking threats from your hard disk. Ideal supplement to Security Task Manager. SpeedUpMyPC scans, cleans, repairs and optimizes your computer. |
Other processes
grooveshellextensions.dll acroiehelper.dll hkcmd.exe csrss.exe winlogon.exe wmiprvse.exe ctagent.dll explorer.exe windowslivelogin.dll hpzipm12.exe mspmspsv.exe [all]
bruce