What is csrss.exe Process in Windows? Is it a Virus? How to Identify Orignal file?

People ask me mostly about different Windows processes and now trying to answer one by one, let’s see the csrss process, What is csrss.exe? What is the process file location? How to identify the original and viruses and how to remove csrss without a tool.

The csrss.exe is a Client Server Runtime Subsystem process file, which must run all the time on Windows OS. Csrss.exe file works for Win32 console windows, manage the majority of the graphical instruction sets including GUI shutdown, creating or deleting threads and some parts of the 16-bit virtual MS-DOS. In laptops, the csrss.exe process file works dependently with power management schemes defined by the systems under Control Panel option.

How many csrss.exe files run in Windows OS?

There is just a single csrss.exe file exists on Windows operating system, but users may experience that more than one instance of csrss.exe are running under Task Manager as this is the case in Windows Vista which we observed that at least two instances of csrss.exe run at the same time. The number of csrss.exe file instances may differ according to the operating system version, but still, the Windows OS has just one csrss.exe file (see below where is csrss.exe located).

Advertisement

Can we remove csrss.exe?

Csrss.exe removal, the csrss.exe is a default process and holds critical features and functions for Windows. This is not recommended to kill or terminate the actual csrss.exe process improperly. Doing that may result in the Windows Blue Screen of Death.

Is csrss.exe a virus?

The csrss.exe is a critical system file, and it’s not a virus. But, sometimes it may get corrupted by a virus. Sometimes the virus, trojan and spyware use the same name csrss.exe, just to hide from system users. In return, any anti-virus program can be used to scan and eliminate those malicious files.

Where is csrss.exe located?

Orignal csrss.exe location is C:\Windows\System32\ (your drive may be different from C:). You can open this folder by typing %systemroot%\system32\ command in Run windows

How to identify original csrss.exe system file and handle csrss.exe problems?

Method-1

The path or location or original csrss.exe is mentioned above. In case there is more than one instance of csrss.exe running in Task Manager then you check their location by taking their properties

Right click on running csrss.exe process in task manager and select properties or Open file location.

If the file location is different from the above-provided address, then it means those are not original Windows files and should be killed and removed from its place. You may need administrator privileges to take properties of the running process.

Method-2

There is also an alternative way to identify original csrss.exe file, just navigate to Task Manager > Processes and right click on csrss.exe and click End Process

If this csrss.exe is a virus, then it will not show any critical message about the deletion. Otherwise, you will find the following message that the removal of this file is crucial to the system.

Share your experience about csrss.exe windows process, leave some comments below.

You might want to explore some other Windows operating system processes like svchost.exe, explorer.exe, ipodservice.exe, dwm.exe.

44 comments… add one
Matt March 23, 2010, 2:01 pm

I have two csrss.exe process running in my Windows Vista. I have checked as you said these are not virus.

AD March 23, 2010, 2:03 pm

Yes, if csrss exe is not in system32 folder then its fake and virus.

Nono March 24, 2010, 1:53 am

thanks for providing answers to our questions about csrss.exe file.

Tricky March 24, 2010, 3:01 pm

Nice tricks to check csrss.exe is virus or not, thanks.

Ulfson March 28, 2010, 11:21 am

i was just wondering about csrss.exe but now i am completely clear about the process.

i b wright April 1, 2010, 10:33 am

dang. i really wish i had known this stuff last weekend. i removed a couple of trojans a couple of weeks ago, then this past weekend, after i had started an online av before i went to bed and expected to find my computer in sleep mode the next morning, i wake up, go to my computer and the cpu is at 100% and it’s all from the csrss process. it had apparently been going like this for several hours, i guess. i just shut the computer down and that was the end of it, but i didn’t know what this post of yours said and didn’t know to check if it was a trojan or not. darn!
i’ve also found out that if this process is hogging memory, check to see if it’s using a lot more memory than normal, too.
I’m almost wishing it would do it again just so i can see if it’s a trojan or just a corrupted user file. ( which i’ve learned can also create the csrss problem)

Kell April 18, 2010, 1:37 am

csrss.exe is not virus

virus April 21, 2010, 5:58 pm

its not virus its windows system file

Lapp April 24, 2010, 12:02 pm

csrss.exe process is client server runtime process

Smith May 13, 2010, 7:06 am

My friend attached usb and transfer spyware in my system is taht possible? i am not sure. but after that i got running 2 csrss.exe process in my task manager now. I will try your method to remove csrss.exe spyware from my computer

Andoyo August 24, 2010, 3:01 am

It doesn’t work on my computer. I got my external hard disk’s folder converted to 1 kb shortcut and Location: Diecox. Does any one can help me?

trickYguY August 24, 2010, 4:57 am

check the following link to fix file association fix
copy and open this link: dougknox.com/xp/file_assoc.htm

download and try the following fixs
Drive Association Fix (Restores default settings for hard drives)
EXE File Association Fix (Restore default association for EXE files)
Folder Association Fix (Restore default associations for File Folders)

Matthew October 3, 2010, 8:11 am

i have one csrss process running but it has no description, also nothing happens when i right click and go to properties. It’s also not connected to any services and when i say end process it says access denied, it doesn’t give me a message like above. I have a winlogon.exe process that is the exact same. Any suggestions?

trickYguY October 3, 2010, 7:15 pm

Are you using Windows 7?

Pau October 25, 2010, 6:19 pm

i’ve exactly the same doubt as him.
And yes..im running win7

Jen May 28, 2011, 9:01 am

Same here. It gives the warning message if you try to end the process, but under ‘user name’ and ‘description’ is is blank and clicking ‘open folder’ does nothing (works with the other running processes). I also have one winlogon.exe that is doing the same thing (and is the only other process that similarly lacks user name/description info and won’t open a folder).

Did Microsoft do that on purpose so people don’t end critical processes (I could easily see someone making a decision that irritating to ‘protect the consumer’ or some other BS) or could one or both of those be a very suave Trojan that somehow knows how to stop the legit instance of each process and replace it entirely with something nefarious?

Christian January 21, 2012, 4:36 am

do this:
1. click “show processes from all users”
2. click “image name” (this sorts them alphabetically)

now it/they should have descriptions and say the user is SYSTEM, u can also now open the file location

nera May 18, 2012, 1:55 pm

Thanks for this tip, now I can see the properties. For some reason, I’ve got two copies running. Right-clicking either of them gives the location of System32 and dated 14.7. 2009, however, of course then can be only one copy there. I assume it shows up double because of multiple users and is not harmful? Puzzling.

ells January 30, 2011, 2:50 pm

alright so if i try to end it and it says it cant be done then its a virus?!

Ahmed January 31, 2011, 12:41 am

Make sure you have administrator privileges on Windows, If this process location and name (csrss.exe) is exact same as mentioned above in the post then its not a virus.

KC June 12, 2011, 12:59 am

So I checked the folders and just like you said, there’s a csrss.exe in “C:\Windows\System32\” but I also have one in “c:\documents and settings\*USER*\local settings\Temp\” and I use my anti-malware to remove it because it says it’s a virus, but it’s just back again everytime I restart the computer. And I’ve tried End Task in the task manager, but they both give me the important system file warning. Uhhh… is there anything you can tell me about this?

MemeAhmad August 19, 2011, 12:56 am

csrss.exe
test for to see if its a virus
under windows task manager
under username : (blank–no description/entry)
under description : (blank–no description/entry)

when checked to see it end process works. End process confirmation appears but rejects end process > are you sure you wan to end process ” csrss.exe” > yes> “access denied”

Comments plz

MemeAhmad August 19, 2011, 12:57 am

also right click > open file locations returns with no results

faeraemae September 20, 2011, 10:59 pm

Hi
Paging file problems here
2 x csrss (1 x MUI?}
thought compressing would help but if I try, only trusted installer has privilege! ( I am Admin.)

Any advice on how to maximise memory ~ which programmes should I uninstall?

Gideon October 7, 2011, 6:38 pm

Thanks for giving this information,
I have got 2 crss.exe files too
but if i want to close them it gives the critical message at both, and they are in the same directory.
Thanks =]

Sajjad November 1, 2011, 9:30 am

AD there are only one csrss.exe and its virus or not

tayman December 24, 2011, 8:58 pm

I have the same problem. It gives the warning message if you try to end the process, but under ‘user name’ and ‘description’ is is blank and clicking ‘open folder’ does nothing (works with the other running processes). I also have one winlogon.exe that is doing the same thing (and is the only other process that similarly lacks user name/description info and won’t open a folder).

I have verified that the real csrss is in the System32 folder but the one showing under the task manager I think is a fake one or virus. Help! How do I remove the fake csrss in the task manager?

Christian January 21, 2012, 4:40 am

i just replied to a similar post above with the same problem, follow those steps and u will have access to the “open file location” function

sam_vrao February 6, 2012, 10:54 pm

Can you guys help me? Im on Windows 7, there is a process “rk5jccss.exe” running from the startup… may i know wat is that exe is associated with?

jerryjo February 24, 2012, 5:36 pm

I use windows Vista . I went to task manager , at first i saw only one csrss.exe and when i right clicked i was told to “perform administrative tasks” . I did this and 2 csrss.exe came out :
1. They both use my pc’s USERNAME.
2. one of the csrss.exe uses about 5mb , while the other uses 958kb .
3. I did a search on my startmenu and only one csrss.exe came out and that was in system32.
Am i infected or what ?

lucas March 2, 2012, 7:30 pm

what if you see the csrss.exe running in the windows task manager, but the only info it provides is the name, system memory, and i can’t get into the properties of it?

tamy March 3, 2012, 12:26 am

i tried to see the location of csrss but when i click properties nothing happens.
i looked in win 32 folder and there are 2 files

csrss.exe.mui and csrss without extension
csrss.exe.mui is not in the task manager

Andrew March 12, 2012, 5:42 pm

The csrss.exe seems to come up in the top few processes in the Task Manager whenever my mouse is being moved and using 03 of the CPU.

piboss May 10, 2012, 9:19 am

Thank you for your complete explanation of this process! The only thing I noticed different on my computer is that in TaskMgr it (csrss.exe) is the only process that doesn’t show its path and as well won’t (upon a right-click) allow me to open its file location or view its properties. It did however pass your test of giving the warning upon attempting to terminate it. I couldn’t tell by your screen-shot if it is normal for it to not show any details in taskMgr.

I’m on Win-7 Home Premium and an HP Laptop

Thanks again for your detailed information!

Glenn

user July 22, 2012, 6:13 am

quotation: “If this csrss.exe is a virus then it will not show any critical message about the deletion and complete the process otherwise you will find the following message that the deletion of this file is critical for system.”

I think also a virus is a typical windows-process and therefore there is also the same message box when killing the virus because you everytime get this message box if you kill any process, no matter if SYSTEM, NETWORK SERVICE or USER. Therefore this quotation isn’t correct.
I didn’t read the whole answers listed above, so sorry if anyone did already say it once.

desk pilot August 29, 2012, 3:19 am

I talked to a McAfee tech today that told me that this was definitely a virus even after the alert said don’t delete. tried to sell me some very expensive support to remove it. Microsoft says I have no issues. My laptop has same files in System folder , need to check to see if one is not supposed to be there.

Cowboy2012 September 20, 2012, 11:24 pm

I have tried to delete the csrss.exe (trojan) from my computer. Idenifying the trojan within the task manager and selecting end process I get an error message “Access is denied”. How do I get rid of this trojan, does anyone know?

milad November 2, 2012, 5:23 pm

is very good of you .thank u so much

mara September 12, 2013, 9:18 pm

I had dell support to check the “CSRSS.exe”
I have the virus “CSRSS.exe” in my laptop, My laptop started failing the speakers Sound, specially when I hook on the headphones also started going on sleep mode after only 1 minute of not touching my laptop, so I did changes in the Power options, but still the same problem, so I called Dell support and they did the troubleshooting connecting directly to my laptop, they couldn’t fix it, so they showed me in Task Manager how I have 2 instances of the process “ CSRSS.exe” running, they told me one of them was a “trojan” they explain that this application was a Hacker, that whoever was doing it was spying , that they could see all my information, including Passwords , banking accounts etc. Dell wanted me to pay for 199 dollars for one year subscription, money that I can’t afford.

So looking at your info I did look for the location of the file and both files are in System 32 in windows, so I couldn’t tell they were Trojans, so back to the beginning, how could I be sure what the people of Dell told is true or not?

Ahmed September 14, 2013, 3:26 am

I am using windows 8 and i also have 2 instance of csrss.exe. You don’t need to worry about that if these instances belongs to C:\Windows\System32\csrss.exe

Take properties of this file and click on details tab to check more info about file.

1 min sleep problem, this may be windows power management setting issue.

Try to reset your power plan settings goto Control Panel\Hardware and Sound\Power Options\Edit Plan Settings and then click on Restore default settings for this plan.

mara September 12, 2013, 9:22 pm

By the way I have Windows 8 with 64bits and I have 2 Instances of CSRSS.exe running, Dell believes is a Trojan, in file location shows that is a windows application, in system32, so I’m confused and don’t know what to do, any ideas?

steve February 19, 2014, 3:42 pm

I have 5 csrss.exe files on my win 8.1 laptop! Surely there isn’t supposed to be that many of them, if so then, which ones do I get rid of or should I leave them to breed in peace?

Help!

bobby February 27, 2015, 5:34 am

when i try to see properties of the csrss.exe in task manager.. nothing happens.. i end process and it says i cannot do that.. will not let me view properties or containing folder?

Ahmed March 3, 2015, 12:07 am

You can’t end the csrss.exe process but you can view the properties and location of file original csrss.exe file process. Which Windows version you are using, Is it Windows 8 or 7?

Leave a Comment

Join Our Subscribers

Receive the latest how-to guides, news, and updates from our team.

You have Successfully Subscribed!