Note: This article was originally published in 2012. Some steps, commands, or software versions may have changed. Check the current Processes documentation for the latest information.

This article explains csrss.exe? (client/server runtime subsystem) and why it matters for your environment.

What is csrss.exe?

Many people while running through the (http://en.wikipedia.org/wiki/Task_manager “Task manager”) come across csrss.exe. With the amount of spyware, trojans and other malicious code running around the Internet it is always good to do a check every now and then that your computer is okay. Csrss.exe actually stands for (http://en.wikipedia.org/wiki/Client/Server_Runtime_Subsystem “Client/Server Runtime Subsystem”) and it is a component of the (http://www.microsoft.com/WINDOWS “Windows”) NT Operating System (pretty much anything after 2003 has that). So what csrss.exe does for you is handle the (http://en.wikipedia.org/wiki/Graphical_user_interface “Graphical user interface”). Practically every Windows user nowadays has that process running. Because of that termination of the process would result in a system failure.

Is it safe?

Generally yes. There are known viruses that take advantage of the name to disguise themselves (csrss.exe). Known cases are the Nimda.E virus and the Nesky.ab & VBMania. If you look at the properties of the process in the task manager you can see where the file is located. The one provided by (http://www.microsoft.com “Microsoft”) generally is located at: C:WindowsSystem32csrss.exe so if yours is there then you are probably fine. Having more than one instances is also possible (although in most cases generally only one would be active). Say for example you have multiple users logged on into your machine. Each will be running a copy of csrss.exe. In a (http://en.wikipedia.org/wiki/Terminal_server “Terminal server”) environment this would be the case. If you are a home user if you use the switch user functionality in Windows then this could also be your scenario. I would recommend regularly running an anti virus as they usually look out for threats like this one. Microsoft has a free anti virus I would recommend if you don’t have a preference and like free: (http://windows.microsoft.com/en-US/windows/products/security-essentials) (is supported on Windows 7,Windows Vista, and Windows (http://www.microsoft.com/windows/windows-xp/default.aspx “Windows XP”)).

Can I remove it?

Definitively NO. As mentioned above this is a critical Microsoft (http://en.wikipedia.org/wiki/Process_%28computing%29 “Process (computing)”). This is not your average unnecessary service installed by your computer manufacturer that is just eating resources. You need this if you want your computer to function.

(http://img.zemanta.com/zemified_h.png?x-id=35f7c57f-a3aa-4fab-ba82-947739491f7f)](http://www.zemanta.com/?px “Enhanced by Zemanta”)