What is csrss.exe Process in Windows? Is it a Virus? How to Identify Orignal file?
People ask me mostly about different Windows processes and now trying to answer one by one, lets see csrss.exe process.
What is csrss.exe? The csrss.exe is Client Server Runtime Subsystem process file which must run all the time on Windows OS. Csrss.exe file works for Win32 console windows, manage the majority of the graphical instruction sets including GUI shutdown, creating or deleting threads and some parts of the 16-bit virtual MS-DOS.
In laptops, the csrss.exe process file works dependently with power management schemes defined by the systems under Control Panel option.
How many csrss.exe files run in Windows OS?
There is just a single csrss.exe file exists on Windows operating system but users may experience that more than one instance of csrss.exe are running under Task Manager as this is the case in Windows Vista which we observed that at least two instances of csrss.exe run at the same time. The number of csrss.exe file instances may differ according to the operating system version but still the Windows OS has just one csrss.exe file (see below where is csrss.exe located).
Can we remove csrss.exe?
Csrss.exe removal, the csrss.exe process is included by Microsoft and holds critical features and functions for Windows OS. This is not recommended to kill or terminate the genuine csrss.exe process improperly because it will result the Blue Screen of Death.
Is csrss.exe a virus?
The csrss.exe is a very important system file and its not a virus but some times it may get corrupted by virus and some times the virus, trojan and spyware use the same name hat of csrss.exe, just to hide themselves from system users and in return any anti-virus program can be used to scan and eliminate those malicious files.
Where is csrss.exe located?
Orignal csrss.exe location is C:\Windows\System32\ (your drive may be different from C:)
How to identify original csrss.exe system file and handle csrss.exe problems?
Method 1
The original csrss.exe is located at above mentioned path. In case there are more than one instance of csrss.exe running in Task Manger then you check their location by taking their properties
Right click on running csrss.exe process in task manager and select properties or Open file location.
if the file location is different from the above provided address then it means those are not original Windows files and should be killed and removed from its location. You may need administrator privileges to take properties of running process.
Method 2
There is also an alternative way to identify original csrss.exe file, just navigate to Task Manager > Processes and right click on csrss.exe and click End Process
If this csrss.exe is a virus then it will not show any critical message about the deletion and complete the process otherwise you will find the following message that the deletion of this file is critical for system.
Share you experience about csrss.exe windows process, leave some comments below.
See also
For more stuff like this you can: Subscribe to RSS Feed or Get Updates Via Email or Follow us on Twitter
Tags: csrss, csrss Process, csrss.exe, csrss.exe Process, Task Manager, Task Manager Process, Vista, Windows 7, Windows Process, XP
I have two csrss.exe process running in my Windows Vista. I have checked as you said these are not virus.
Yes, if csrss exe is not in system32 folder then its fake and virus.
thanks for providing answers to our questions about csrss.exe file.
Nice tricks to check csrss.exe is virus or not, thanks.
i was just wondering about csrss.exe but now i am completely clear about the process.
dang. i really wish i had known this stuff last weekend. i removed a couple of trojans a couple of weeks ago, then this past weekend, after i had started an online av before i went to bed and expected to find my computer in sleep mode the next morning, i wake up, go to my computer and the cpu is at 100% and it’s all from the csrss process. it had apparently been going like this for several hours, i guess. i just shut the computer down and that was the end of it, but i didn’t know what this post of yours said and didn’t know to check if it was a trojan or not. darn!
i’ve also found out that if this process is hogging memory, check to see if it’s using a lot more memory than normal, too.
I’m almost wishing it would do it again just so i can see if it’s a trojan or just a corrupted user file. ( which i’ve learned can also create the csrss problem)
csrss.exe is not virus
its not virus its windows system file
csrss.exe process is client server runtime process
My friend attached usb and transfer spyware in my system is taht possible? i am not sure. but after that i got running 2 csrss.exe process in my task manager now. I will try your method to remove csrss.exe spyware from my computer
It doesn’t work on my computer. I got my external hard disk’s folder converted to 1 kb shortcut and Location: Diecox. Does any one can help me?
check the following link to fix file association fix
copy and open this link: dougknox.com/xp/file_assoc.htm
download and try the following fixs
Drive Association Fix (Restores default settings for hard drives)
EXE File Association Fix (Restore default association for EXE files)
Folder Association Fix (Restore default associations for File Folders)
i have one csrss process running but it has no description, also nothing happens when i right click and go to properties. It’s also not connected to any services and when i say end process it says access denied, it doesn’t give me a message like above. I have a winlogon.exe process that is the exact same. Any suggestions?
Are you using Windows 7?
i’ve exactly the same doubt as him.
And yes..im running win7
Same here. It gives the warning message if you try to end the process, but under ‘user name’ and ‘description’ is is blank and clicking ‘open folder’ does nothing (works with the other running processes). I also have one winlogon.exe that is doing the same thing (and is the only other process that similarly lacks user name/description info and won’t open a folder).
Did Microsoft do that on purpose so people don’t end critical processes (I could easily see someone making a decision that irritating to ‘protect the consumer’ or some other BS) or could one or both of those be a very suave Trojan that somehow knows how to stop the legit instance of each process and replace it entirely with something nefarious?
do this:
1. click “show processes from all users”
2. click “image name” (this sorts them alphabetically)
now it/they should have descriptions and say the user is SYSTEM, u can also now open the file location
alright so if i try to end it and it says it cant be done then its a virus?!
Make sure you have administrator privileges on Windows, If this process location and name (csrss.exe) is exact same as mentioned above in the post then its not a virus.
So I checked the folders and just like you said, there’s a csrss.exe in “C:\Windows\System32\” but I also have one in “c:\documents and settings\*USER*\local settings\Temp\” and I use my anti-malware to remove it because it says it’s a virus, but it’s just back again everytime I restart the computer. And I’ve tried End Task in the task manager, but they both give me the important system file warning. Uhhh… is there anything you can tell me about this?
csrss.exe
test for to see if its a virus
under windows task manager
under username : (blank–no description/entry)
under description : (blank–no description/entry)
when checked to see it end process works. End process confirmation appears but rejects end process > are you sure you wan to end process ” csrss.exe” > yes> “access denied”
Comments plz
also right click > open file locations returns with no results
Hi
Paging file problems here
2 x csrss (1 x MUI?}
thought compressing would help but if I try, only trusted installer has privilege! ( I am Admin.)
Any advice on how to maximise memory ~ which programmes should I uninstall?
Thanks for giving this information,
I have got 2 crss.exe files too
but if i want to close them it gives the critical message at both, and they are in the same directory.
Thanks =]
AD there are only one csrss.exe and its virus or not
I have the same problem. It gives the warning message if you try to end the process, but under ‘user name’ and ‘description’ is is blank and clicking ‘open folder’ does nothing (works with the other running processes). I also have one winlogon.exe that is doing the same thing (and is the only other process that similarly lacks user name/description info and won’t open a folder).
I have verified that the real csrss is in the System32 folder but the one showing under the task manager I think is a fake one or virus. Help! How do I remove the fake csrss in the task manager?
i just replied to a similar post above with the same problem, follow those steps and u will have access to the “open file location” function