1. Malware hoaxes

2. Technical details

3. History

4. See also

5. References

6. External links

Client Runtime Subsystem, or csrss.exe, is a component of the Windows NT family of operating systems that provides the user mode side of the Win32 subsystem and is included in Windows NT 3.1 and later.^[1] Because most of the Win32 subsystem operations have been moved to kernel mode drivers in Windows NT 4 and later, CSRSS is mainly responsible for Win32 console handling and GUI shutdown. It is critical to system operation; therefore, terminating this process will result in system failure. Under normal circumstances, CSRSS cannot be terminated with the taskkill command or with Windows Task Manager, although it is possible in Vista if the Task Manager is run in Administrator mode. On Windows 7 and later, Task Manager will inform the user that terminating the process may result in system failure, and prompt if they want to continue.

Malware hoaxes

There are numerous virus hoaxes that claim that csrss.exe is malware and should be removed to prevent damage to the system; these are false, as removing csrss.exe or killing the csrss.exe process will result in a Blue Screen of Death.

In addition, technical support scammers pretending to be Microsoft representatives are known to use csrss.exe as "proof" of a virus infection, and convince the user being scammed into purchasing their rogue security software to remove it.^[1]

Technical details

CSRSS runs as a user-mode system service. When a user-mode process calls a function involving console windows, process/thread creation, or side-by-side support, instead of issuing a system call, the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an inter-process call to the CSRSS process which does most of the actual work without compromising the kernel.^[2] Window manager and GDI services are handled by a kernel mode driver (win32k.sys) instead.^[3]

CSRSS is called along with winlogon.exe at Windows start-up. If either of the files is corrupted or otherwise inaccessible, the NT kernel will shut down the start-up process with a Blue Screen of Death. This is caused by a failure to move out of kernel mode and into user mode, the "normal" operation of Windows. The error code for this fault is 0xc000021a.

In Windows 7 and later, instead of drawing console windows itself, CSRSS spawns conhost.exe subprocesses to draw console windows for command line programs with the permissions of that user.

History

The Windows NT 3.x series of releases had placed the Graphics Device Interface component in CSRSS, but this was moved into kernel mode with Windows NT 4.0 to improve graphics performance.^[4] The Windows startup process from Vista onward has changed significantly. Two instances of csrss.exe are running in Windows 7 and Vista.^[5]

See also

• List of Microsoft Windows components

References

External links

• [https://technet.microsoft.com/en-us/library/bb457123.aspx Troubleshooting the Startup Process (Windows XP Professional Resource Kit)]

• Core Collection of the National Historic Ships Register
• Core Competence
• Core competences
• Core contents media
• Core country
• Core creek county park
• Core Creek Park
• Corectopia in eye
• Core culture
• Co-recursive
• Corecursive
• Core damage
• Core damage frequency
• CoreData
• Core, Dathan, and Abiron
• Co-Redemption
• Co-redemptrix
• C.O.R.E. Digital Pictures
• Core (disambiguation)
• CORE (disambiguation)
• Core Drill
• Cor Edskes
• Core (economics)
• Coreena Formation
• COREEN SIMPSON