Csrss.exe – Definition
The csrss.exe (Client Server Runtime Server) process is used for managing graphical instructions set under a Microsoft Windows operating system. The main job of the csrss.exe process is to control threading and Win32 console windows features.
By default, the csrss.exe file is located in %system% folder. The most common size of the csrss.exe file is 6,144 bytes. You may also find the file in 4,096 and 7,680 byte sizes.
Is it safe to disable csrss.exe?
Csrss.exe is a critical Windows process and it is recommended that you do not disable it. Disabling csrss.exe may result in a stop error, also known as Blue Screen of Death.
Also, as csrss.exe is a critical Windows process, you cannot terminate this process via the Windows Task Manager window.
Resolve Csrss.exe 100% CPU issue
At times, you may notice csrss.exe is consuming up to 95%-100% of your CPU resources. This happens when your Windows Microsoft profile is corrupt. To repair the problem you need delete your profile. It is recommended that before you delete your profile, you back up all the files in My Documents.
To delete your accounts, perform the following steps:
Note: To delete a user account, you need to be logged on to the system with administrative rights.
- Click Start, right-click My Computer, and select Properties.
- Next, display the Advanced tab.
- Click the Settings button under User Profiles section.
- Select your profile.
- Click the Delete button and then click OK.
Csrss.exe – security rating
The genuine csrss.exe is a trustworthy file from Microsoft. However, other instances of csrss.exe are also known.
There is a file with the name csrss.exe that is registered as a trojan. This instance of csrss.exe is used by the authors of malware programs to steal personal and confidential information of computer users.
How to verify csrss.exe running is not spyware-related
To ensure that the csrss.exe file running on your system is legitimate, go through the list of currently running processes. There should be only one instance of csrss.exe running on your computer. If you have more than one instance of csrss.exe running, then your PC is infected.
Similarly, if you use a Windows operating system older than Windows 98 and find csrss.exe running then your PC is also infected.
If you suspect you might have an illegitimate csrss.exe process running on your computer, then to remove the malware, scan your PC using robust and advanced antivirus and antispyware tools.
After you have deleted or quarantined the malware, run a registry scan using reliable registry cleaning software, such as RegServe. Malware programs or their associated processes deliberately insert incorrect or harmful entries into the registry that needs to be removed to ensure no long term damage is inflicted on your registry.
For your reference, we have listed the top internet threats that are known to be associated with the csrss.exe file:
Email-Worm.Win32.Brontok.N [Ikarus]
Email-Worm.Win32.Brontok.n [Kaspersky Lab]
I-Worm.Brontok.AY [PC Tools]
PE_PARITE.A [Trend Micro]
Virus.Win32.Parite.b [Kaspersky Lab]
W32.Rontokbro.U@mm [Symantec]
W32.Rontokbro.X@mm [Symantec]
W32.Rontokbro@mm [Symantec]
W32/Pate.b [McAfee]
W32/Rontokbro.gen@MM [McAfee]
Win32.Parite.B [PC Tools]
Worm.Brontok.BA [PC Tools]
Worm.Brontok.BK [PC Tools]
Worm.Brontok.Gen!Pac.3 [PC Tools]
WORM_BRONTOK.BA [Trend Micro]
WORM_BRONTOK.IE [Trend Micro]
WORM_RONTKBR.GEN [Trend Micro]
W32.SillyFDC [Symantec]
Email-Worm.Win32.Brontok.q [Kaspersky Lab]
I-Worm.Brontok.BM [PC Tools]
PE_FLUENZA.ART-O [Trend Micro]
W32/Brontok-AE [Sophos]
W32/Rontokbr-A [Sophos]
W32/Zaflen.a [McAfee]
Worm.VB.FKF [PC Tools]
Worm.Win32.VB.gr [Kaspersky Lab]
Worm.Brontok.Gen.1 [PC Tools]
Backdoor.Trojan [Symantec]
W32/Generic!worm [McAfee]
W32/Brontok-Gen, W32/Brontok-Gen, Mal/Packer, Mal/Behav-024 [Sophos]
Trojan-Downloader.Win32.Agent.bl [Kaspersky Lab]
Trojan Horse [Symantec]
TROJ_MALOE5.A [Trend Micro]
Packed.Generic.233 [Symantec]
Mal/VB-F [Sophos]
Mal/EncPk-KP [Sophos]
Generic.dx!fml [McAfee]
Gen.Packed [Ikarus]
Backdoor.VB.DVIH [PC Tools]
TrojanClicker:Win32/Hatigh.C [Microsoft]
Email-Worm.Brontok!sd5 [PC Tools]
Backdoor.Win32.VB.brg [Kaspersky Lab]
Backdoor:Win32/VB.ANS [Microsoft]
Constructor.Win32.Binder.kh [Ikarus]
Email-Worm.Win32.Brontok.A [Ikarus]
Troj/Bckdr-QPB [Sophos]
W32/Brontok-Gen, W32/Brontok-Gen, Mal/Behav-024 [Sophos]
W32/Brontok-Gen, W32/Brontok-Gen, Mal/Behav-024, Mal/Heuri-D, Mal/Emogen-N [Sophos]
W32/Brontok-Gen, W32/Brontok-Gen, Mal/Emogen-N, Mal/Heuri-D [Sophos]
W32/Lovelet-AD [Sophos]
Worm.Win32.VB.ft [Kaspersky Lab]
Worm:Win32/Brontok.BJ@mm [Microsoft]
Worm:Win32/Zaflen.A@mm [Microsoft]
WORM_VB.CBS [Trend Micro]
Mal/Generic-A [Sophos]
W32/Virut.gen [McAfee]
Worm.Win32.VB.ft [Ikarus]
Worm.VB.GMH [PC Tools]
Worm.Win32.VB.iq [Ikarus]
Worm:Win32/Usbalex.A [Microsoft]
W32/Sality-AM [Sophos]
I-Worm.Brontok.Gen.2 [PC Tools]
WORM_RONTKBR.D [Trend Micro]
WORM_RONTKBR.B [Trend Micro]
Worm:Win32/Brontok.AF@mm [Microsoft]
Worm.Win32.AutoRun.dkk [Kaspersky Lab]
Worm.Win32.AutoRun [Ikarus]
Worm.Autorun.ADN [PC Tools]
W32/Brontok-K [Sophos]
W32/Brontok-BB [Sophos]
W32.Sality.AE [Symantec]
W32.Imaut [Symantec]
Virus:Win32/Sality.AM [Microsoft]
Virus.Win32.Sality.aa [Kaspersky Lab]
Packed/MEW [PC Tools]
I-Worm.Brontok.CU [PC Tools]
Generic.dx [McAfee]
Generic Downloader.s [McAfee]
Email-Worm.Win32.Brontok.a [Kaspersky Lab]
Email-Worm.Win32.Brontok [Ikarus]
Downloader [Symantec]
W32/Sality.gen [McAfee]
Worm:Win32/SillyFDC [Microsoft]
Downloader.Trojan [Symantec]
W32.Spybot.Worm [Symantec]
Hacktool [Symantec]
not-a-virus:Server-FTP.Win32.Serv-U.gen [Kaspersky Lab]
Backdoor:Win32/VB.AT [Microsoft]
Email-Worm.Win32.Runouce.b [Kaspersky Lab]
Generic BackDoor [McAfee]
Mal_Banker [Trend Micro]
PE_Chir.B [Trend Micro]
PE_SALITY.AL [Trend Micro]
PE_SALITY.JER [Trend Micro]
TROJ_SERVU.Q [Trend Micro]
Virus.Win32.Agent.WAJ [Ikarus]
Virus.Win32.Virut.q [Kaspersky Lab]
Win32.Sality.AA [PC Tools]
Win32/Kashu.B [AhnLab]
Win-Trojan/Xema.variant [AhnLab]