Anti-Spy.Info
Anti-Spy.Info > File library > csrss.exe

Information about csrss.exe file


File: csrss.exe
Name: Client Server Runtime Process
Product: Windows
Manufacturer: Microsoft
Risk factor (Virus/Trojan/Spyware): Rating

This is the user-mode portion of the Win32 subsystem (with Win32.sys being the kernel-mode portion). Csrss stands for client/server run-time subsystem and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and/or deleting threads, and some parts of the 16-bit virtual MS-DOS environment.

Note: The csrss.exe file file should appear only the C:\Windows\System32\ folder. If you happen to find this file in a different folder, it is possible that your csrss.exe is in reality a malicious file. Many trojans and viruses try to cloak their real identity by using the names of legitimate files. Any time that you encounter a suspicious process, you should verify the digital signature and the file path, for example using Anti-Spy.Info.

Virus with same name: Nimda.E

User feedback

There were 2318 user requests for that file. 14 users classify it as harmless. 6 users classify it as not so dangerous. 21 users classify it as neutral. 11 users considered the file to be suspicious. 13 users classify it as bad and recommend to delete csrss.exe. 5 users didn't classify it ("don't know").

RatingOpinionFrom
RatingWindows Client/Server Runtime Server Subsystem Alex
Ratingcan also be put in C:\\Windows directory by the W32.Netsky.AB worm, an SMTP mass-mailer  link for more info
Ratingwenn die datei in c:\windows liegt, ist's wahrscheinlich der wurm netsky.AB Dark
RatingWindows component if file in folder Windows\System32 Alex
RatingLegit system file Valas
Ratingkann mit der gratis Trial- oder käuflichen Vollversion gecheckt werden , dann in Quarantäne abgelegt und von dort endgültig gelöscht werden. Der Anti-Spy.Info von Neuber stuft verdächtige Dateien nach einem Rating und Farbcode ein, listet sie auf und bietet Lösungen an. Auch Wiederherstellung sicherheitshalber isolierter und stillgelegter Dateien aus der Quarantäne ist jederzeit möglich.  link for more info PELIAN
RatingMy machine was hacked by someone who put a bogus hidden copy of a spyware program into my System32\dllcache directory. I thus had two processes named csrss.exe running at once--the legitimate one in System32, and the bogus one, that I discovered using Anti-Spy.Info. The bogus one was 5.5 MB whereas the legit one is less than 1 MB. Ben in Pennsylvania, USA
Ratingbe aware that althought the WXP csrss.exe is 4096kB on disk, it can take more than 4 Meg of RAM nursoda
RatingEl archivo emite un ventana de mensaje regularmente (a veces un verdadero fastidio) sobre una aplicación espía. Al intentar desinstalarlo o eliminarlo resetea la máquina. En algunos sitios web lo describen como un gusano, pero la forma de eliminarlo no corresponde con las características como se haya este en mi sistema Romane
RatingI opened my windows task manager and saw that I had TWO ccsrss.exe files. one was in capitals... one wasn't. When windows starts, I get a message saying that systask32 isn't functioning. I get the choice to send an error report or not. I am pretty sure the viral one is the one in capitals, but I'm not sure. Rich04
RatingThis is a Windows system file, but a lot of viruses will also use this name because the WinXP task manager won't let you close it. (Great idea, Microsoft!) The real one is found in C:\Windows\System32.  link for more info Inuyasha
RatingCan cause computer to freeze for a second or two or totally bogg down. Work notebook has this on it using zero % cpu - home notebook does too but after installing Panda Internet Security - home notebook's csrss.exe cpu usage went to 20% causing notebook mouse to "stick" for a second every few seconds. Something is definitely "up" with this exe. Herman
RatingIt can be a virus, but it is also a Windows file. As a windows file, it can consume high % processor: enable hardware graphic aceleration.  link for more info nafiton smith
RatingThis is the Windows client server run-time subsystem that handles Windows and graphics functions for all subsystems. Another important component of the Windows® Operating System. Nathan
RatingCauses popup windows and cannot be deleted "access denied" and also a "critical system process" Daniel Price
RatingOfficially a system file - If you have 2 of this file... one is very likely a virus.. be careful if deleting manually as the real one is an important file needed on your pc... It is suggested you use an up-to-date antivirus software to find and remove the infected file A Techy
RatingThis file is actually a Client/Server Runtime Server Subsystem ... This is the user-mode portion of the Win32 subsystem (with Win32.sys being the kernel-mode portion). Csrss stands for client/server run-time subsystem and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and and/or deleting threads, and some parts of the 16-bit virtual MS-DOS environment. The csrss.exe which is from Microsoft is located in the c:\windows\System32 folder. It has been noted that one virus had been found that runs as csrss to hide from you. Tony (Pc Technician)
RatingDie csrss.exe gehört eindeutig zu Windows. Sie ist ein so genanntes Sub System. Aber Achtung: Der Wurm "[email protected]" kopiert sich als csrss.exe in Form einer Variablen in die entsprechende Datei! Wenn Sie den Verdacht haben Opfer dieses Virus zu sein, dann empfehle ich Ihnen diesen Link:  link for more info DataFighter
RatingEven the legit MS-Version of this process can lockup your machine.  link for more info Martin
RatingWinspy uses this process to keylog, never really got it out.  link for more info RH
RatingMot only system file. It is widely used by keyloggers and worms.  link for more info zero
RatingAdAware from Lavasoft cured this problem for me. I think It is a spyware program using csrss.exe to access the internet. And since spyware writters suck they screw it up so it bogs down your system CyberZilla
RatingThe csrss.exe process can be hijacked by several viruses, that pose as a messenger service. Don't believe any unsuspected pop up messages! Max
RatingPicked up by SpySweeper, this nasty was really screwing up my DSL link. Caused issues with my Alcatel modem (config file truncating on load). Pages loaded painfully slowly if at all. Removed and all is now fine. Another Windows feature, thank God I also use a Mac. Nick
RatingNach csrss.exe suchen, man findet zwei Dateien. Die in Windows\System32 ist die richtige (6KB bei Win2000), die andere der Wurm (816KB bei Win2000). Von CD starten und letzeren löschen - bumm. Joe
Ratingits a windows file Hooligan
RatingIf it shows with a big green U and small red D, then it's a trojan.
RatingI have a laptop with a NVIDIA GeForce FX Go5650 (video card and/or driver name). Once I disabled it's additions to my system menus my CPU usage when back to normal instead of being slow at each right click or application menu click. csrss.exe was the CPU hog according to task manager, it sits at 5.45 MB on my Windows 2003 Server , and I believe the file is ligitimate on my system. Victor
RatingI am convinced I was infected by csrss.exe by install the win2k sp4 downloaded from microsoft... prodigalrat
RatingMany Hacking Applications are being downloaded especially vie p2p software and it is being uncomplressed to System32/dllcache/win32. You must delete te entire win32 inside the dllcache to get rid of it. Safe mode booting is required. Christian Gabriel C.
Ratingist ein normaler winXP prozess, alles easy schindt
RatingIf this file is in more than one instance: virus.... If this file runs out of any folder except system32: virus.... If you have this file, check for the WTools (aka WinTools) files on your computer. I had both, don't know if they're related though. Matt
Ratingjust ran a search for crss.exe...no results found! what the heck does it mean, because the process is there in taskmanager Trystan
RatingWebroot's SpySweeper occasionally wants to access this file. Don't know why........ Dr. J
RatingShound be about 6K file size Kevin
Ratingit makes me nervous, because its poping up and trying to connect every time to a differetnt serves such as www.porn.com. .... why?
Rating" CSRSS is the Client Server Runtime SubSystem. CSRSS is started by SMSS. When the user application makes a Win32 API call, it is usually CSRSS which communicates with the operating system's Kernel to execute the API call. 3.368-4.144 kB on my system (21 tasks running, 7 user, 1 local service (svchost.exe), 1 networkservice (svchost.exe) and 12 active system tasks: 3 x svchost.exe, outpost.exe (firewall), AVWUPSRV.EXE (antivirus), avgserv.exe (antivirus), lsass.exe, services.exe, winlogon.exe, csrss.exe, smss.exe and System). Martin
RatingThis is a Windows system file. (I love microsoft...) This file very often trying to broadcast to 224.0.0.22............ PQ
RatingIn my computer, it is located in this folder : c:\windows\softwaredistribution\download Luchito_Gallito
RatingI discovered csrss.exe & csrss.bin in root directory, after reading this thread I promptly deleted it. Thanks PaddyOz
RatingI found this file running in my processes in caps CSRSS.EXE. It was located next to the acctual file csrss.exe in \windows\system32 This file was part of some spyware that was redirecting my chosen homepage in IE. It also had a buddy file called CTFMONSS.EXE Both of these files needed to be stopped by using the End Process Tree command. This command is located by right clicking on the name of the process that you want to stop in the task manager process tab window. I then deleted the files from the \windows\system32 directory and ran Hijackit to remove the other reg entries made. Brent
Ratingthe link I posted in my comment was mistaken. This is a correct link to someone who reported a similar problem with this file.  link for more info jeff
RatingI have 2. One is the system file, the other is in the c:\windows directory. It's the cause of a keylogger that's apparently been running on my system for months. The properties say it's created by StarMicrpSdn and it's original name is Winsyst.exe. So far no virusscan or antispyware program has detected it on my system. jeff
RatingThis file started poping p suddenly asking for access to internet thru my firewall and I thought it is a spyware
Ratingi know it is a system file but i don't have any problems without it, although i only renamed it, lemme restart ;p
RatingSygate Personal Firewall meldet das die Datei csrss.exe (Client Server Runtime Process) versucht auf das Netz zuzugreifen. Es befindet sich jedoch nur die orginale 6 kb große Datei (XP SP2) auf dem Rechner. Frank Kemper
RatingWindows system file
Ratingcs = counterstrike - delete it from ur PC NOW! CSsuxx
RatingSounds like a windows subsystem that helps keep your screen cleen between window changes Jeff Painter
RatingI only know about this file from what I saw here. I note it just tried to "broadcast" something as I went online. This is the first time it ever tried to do so and my Sygate firewall caught it. I didn't allow access and nothing evil happened. Sygate reports it's in the System32 dir. Wonder if it's some sort of call home (MicroSoft?) thing? Jopower
RatingOnly what I saw here. I note it just tried to "broadcast" something as I went online. This is the first time it ever tried to do so and my Sygate firewall caught it. I didn't allow access and nothing evil happened. Sygate reports it's in the System32 dir. Wonder if it's some sort of call home (MicroSoft?) thing? Jopower
RatingIt's a Windows file Horst
RatingIts fake if anywhere else but in windows/system32/csrss.exe dbpvr
RatingWindows calls it a system file that you cannot delete. It's a very nice curtian for trojans to hide behind. It cannot be terminated, it is a client server service, so it will be exchanging data over the internet every so often, and apparently, it is modifyable. Proceed with caution Zach
RatingThis file hosted a password stealer, I got rid of it with hostdll.exe. Mike
RatingIt's a graphics handler for windows Jon
RatingIt is a Windows file, but some smartass made a trojan with the exact same filename. It embeds itself into the OS and any CDs you burn. The file initially looks like an image or screen saver (.SCR) file. Once run. the script becomes active and loaded into OS. Really hard to remove properly. I still haven't managed to get rid ot if. Puts a bunch of pesky pop-ups on your screen.  link for more info Am
RatingIs a Windows file.. often manipulated or copied by spyware, virus, worm, trojan
If you know more about csrss.exe, so post it here.
Your opinion:
Your info
about that file:
Website with further details:
Your Name:
 
 
Source

Search Results for csrss.exe in


Other files

alg.exe csrss.exe dllhost.exe explorer.exe kernel32.dll lsass.exe mstask.exe smss.exe spoolsv.exe svchost.exe system wmiexe.exe wscntfy.exe wuauclt.exe [all]
© Anti-Spy.Info