Securing Windows 7 also involves monitoring processes. One of the processes I want to take a closer look at today is csrss.exe – what is it? Why is it sometimes using so much CPU? And what can I do to fix it?
Csrss is an abbreviation for Client/Server Run-Time Subsystem. It is required to run Windows. If you kill the process csrss.exe your system won’t work and you will get a BSOD.
Important: csrss.exe is an important part of your system, killing this process or deleting the file is NOT recommended at any time.
Do you think your csrss.exe is infected? Read this!
What is the job of csrss.exe?
It is creating and deleting threads, running console windows and is a very important Windows component. If you kill the csrss.exe process, you will get a blue screen.
What is the CSRSS.exe location (Important!)
The file csrss.exe is located at C:\Windows\System32
If you have multiple instances of csrss.exe, try to figure out their location by using the task manager. If one of the crss.exe files is not using the
CSRSS.exe corrupt?
If you have a corrupt csrss.exe, one solution is to delete your user profile. This might be a solution for you if you don’t use your computer a lot. You’d first have to create a backup of your user profile, located at C:\Users\[yourusername]
The other solution is to do a file check on your system files, which will also repair a corrupt csrss.exe if I am not mistaken. Learn how here: How to repair CSRSS.exe
CSRSS.exe BSOD (Blue Screen of Death)
It can happen that you get a BSOD Blue Screen of Death when your csrss.exe is corrupt. Then your system will crash and you get the BSOD. Nothing to worry about here. Fixing corrupt files is easier than you might think and does not require a $20 tool that won’t do crap.
1. Step Open an elevated command prompt
2. Step Enter sfc.exe /scannow
3. StepWait, then reboot
4. Step Your csrss.exe file should now be repaired
For more information read this: How to repair CSRSS.exe
CSRSS.exe Trojan (Is It Infected?)
Tip: Make sure csrss.exe is in C:\Windows\System32 or it is infected
If you are infected by a trojan that is running a second csrss.exe you can try to find this one by going into the task manager and checking the location. A csrss.exe that is stored in System32\dllcache rather than System32 is probably a virus/trojan. Let’s do some tests to verify that.
1. Step First of all, open the task manager with administrator rights (click on the link if you don’t know how).
2. Step Then, right-click on csrss.exe and then on Open file location
3. Step Check all csrss.exe process until you find one that is NOT in the default directory C:\Windows\System32. Then do a virus scan on that csrss.exe with Malwarebytes, Norton or any other anti-virus tools. (I recommend Malwarebytes and Mcafee)
Optionally, you this process manager to take a closer look at the csrss.exe
