Arcade File Downloads Support Forum
Email
Confirm email
Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

csrss.exe


Click here to Run a Free Scan for csrss.exe Related Errors

What is it?
csrss.exe - Client/Server Runtime Server Subsystem

What does it do?
This is the user-mode portion of the Win32 subsystem (with Win32.sys being the kernel-mode portion). Csrss stands for client/server run-time subsystem and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and/or deleting threads, and some parts of the 16-bit virtual MS-DOS environment.

You will not be able to end this through task manager!

More info



Virus Precaution:

The csrss.exe which is from Microsoft is located in the c:windowsSystem32 folder. We've been able to find one virus that runs as csrss.exe to fool you.

Nimda.E - Symantec Corporation
Fix csrss.exe Errors: Free Scan

Recommendation: Run a Free Performance Scan to automatically optimize memory, CPU and Internet Settings


csrss.exe is a Windows System File and should be in a system directory. If it is then this application is safe.

Startup DB Entries:
( 1 ) "Added by the WEBUS.F TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
( 2 ) "Added by the WEBUS TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
( 3 ) "Added by the WEBUS TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
( 4 ) "Added by the ASCETIC.B TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\addins\explorer"
( 5 ) "Added by the DLOADER-QI TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
( 6 ) "WinSpy surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""ComRoot"" subfolder"
( 7 ) "Added by the AUTORUN-DV WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
( 8 ) "Added by the NETSKY.AB WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
( 9 ) "Added by the WEBUS TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
( 10 ) "Added by the WEBUS TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
( 11 ) "ClickTheButton adware. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
( 12 ) "Unidentified malware! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Level4"" subfolder"
( 13 ) "Added by the BANCBAN-ET TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Central de Segurança"" subfolder"
( 14 ) "Search page hijacker redirecting to h**p://www.search-aide.com/. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
( 15 ) "Added by the CHOD WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a random subfolder"


Disclaimer

Every attempt has been made to ensure the information about csrss.exe is accurate but alot of malware applications try to pose as valid applications. If it is something other than what was posted above please leave some feedback in the forum.
Printer Friendly

User Comments
DidaI got drmsartload - I tried to remove it but at boot i keeps coming back. I found out that csrss.exe starting it - and that this csrss.exe is in windows directory not in windows/system32 directory
RichI kept seeing Windows Security Center saying windows firewall was turned off, as well as automatic updates. Also windows firewall was set to group policy, so you could not enable it even though group policy was not configured. Additionally there was always a mysterious connection to stealth.insert.si Booted in safe mode, deleted the csrss.exe from \windows and all is good now.
RichI kept seeing Windows Security Center saying windows firewall was turned off, as well as automatic updates. Also windows firewall was set to group policy, so you could not enable it even though group policy was not configured. Additionally there was always a mysterious connection to stealth.insert.si Booted in safe mode, deleted the csrss.exe from \windows and all is good now.
Andrew My firewall says csrss.exe is trying to use my internet connection, is the windows os doing this or it is a virus?
TristanThe csrss file is the root of all my problems, but it will now allow me to delete it, nor can I terminate the process. I disable it on startup but it adds itself again. It won't allow me to open any other programs/windows to try and remove it.
ItuenProcess shows two csrss.exe going on, 784k and 1,016k. Everybody is talking about only one. Something is wrong with my twins?
grav3sok i finally got rid of the virus file(was located in C:|windowsMedia folder) now the only proble is that there isnt a real csrss in the system32 folder.is this file absolutely necesary ? please someone respond!
WillTo get rid of a virus as such your just going to have to restart your operating system.
SteveJust cleaned up a problem with a fraudulent CSRSS.EXE. It was trying to run from C:WINDOWSCONFIGCSRSS.EXE which is NOT the valid location. Fortunately, on my system, that is not a valid location at all. But the proper location of the legit executable is in the SYSTEM32 directory, not directly in the Windows directory (or anywhere else).
ethanI have this problem and i cant see to fix it the only way i can figure out how to get rid of it in a way tat i can understand is to just reinstall vista xp etc....
DanielI had this Virus, I fixed it by going to system restore, and when back to an earlier time before i caught the virus, it fixed the problem.
TravisI have the same problem with one of my PCs. I did a search on the computer for the csrss.exe and it came up under C:WINDOWSsystem32 as well as C:WINDOWSservicepackfilesi386. Could the latter be the culprit?
calumhow do i know if its the virus csrss.exe or the windows process?
SoCalledFreeFree scan will cost you 29.95. This shows that the web site is not trustworthy.
jodieIt is linked with smss.exe. Only one of each should run. I ran a search and found it in two other locations. And I too also saw that my firewall was being turned off. how do i boot in safe mode...
Kristhis program keeps coming up in my processes without a user name. It is connected with someone hacking into my computer. It is accessing asghost.exe (identity security program) Stop both processess immediately if you see csrss.exe with no description or user name in your process list
jordani am having all of the problems above any fixes yet?

Submit your comment Comments ARE moderated! Please only submit once!

Windows Files
lsass.exe | alg.exe | csrss.exe | Svchost.exe | Spoolsv.exe | wowexec.exe | dwwin.exe | ctfmon.exe | wuauclt.exe | wmiprvse.exe | Winlogon.exe | Smss.exe | msmsgs.exe | cidaemon.exe | rundll32.exe | mdm.exe | ntvdm.exe | ntdll.dll | explorer.exe | msdxm.ocx | wisptis.exe | iexplore.exe | wdfmgr.exe | PDVDServ.exe | gcasdtserv.exe | wscntfy.exe | DLLhost.exe | shdoclc.dll | Winmgmt.exe | cisvc.exe |
Table 'iamnotageek.files' doesn't exist