Client/Server Runtime Subsystem

The Client/Server Runtime Subsystem, or csrss.exe, is a component of the Windows NT family of operating systems that provides the user mode side of the Win32 subsystem. In modern versions of Windows, it is primarily involved with process and thread management, console window handling, side-by-side assembly loading and the shutdown process. Historically, it had also been responsible for window management and graphics rendering, however, these operations have been moved to kernel mode starting with Windows NT 4.0 to improve performance.[1]

CSRSS instances are marked as critical processes, meaning that terminating one will crash the system. Built-in process management tools in most Windows versions will also refuse to kill instances of CSRSS. Under normal operation, there is a CSRSS instance for each session (two in Windows Vista and newer, one in earlier versions,[2] both assuming there are no active RDP connections which spawn extra sessions).

Technical details

CSRSS runs as a user-mode system service. When a user-mode process calls a function involving console windows, process/thread creation, or side-by-side support, instead of issuing a system call, the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an inter-process call to the CSRSS process which does most of the actual work without compromising the kernel.[3] Window manager and GDI services are handled by a kernel mode driver (win32k.sys) instead.[4]

CSRSS is called along with winlogon.exe from smss.exe at Windows start-up. If either of the files is corrupted or otherwise inaccessible, SMSS will tell the kernel to shut down the start-up process with a Blue screen of death.[5] The error code for this fault is 0xc000021a (STATUS_SYSTEM_PROCESS_TERMINATED).

In Windows 7 and later, instead of drawing console windows itself, CSRSS spawns conhost.exe subprocesses to draw console windows for command line programs with the permissions of that user.

Malware hoaxes

There are numerous virus hoaxes that claim that csrss.exe is malware and should be removed to prevent damage to the system; these are false, as removing csrss.exe or killing the csrss.exe process will result in a system crash in Windows applications.

In addition, technical support scammers pretending to be Microsoft representatives are known to use csrss.exe as "proof" of a virus infection, and convince the user being scammed into purchasing their rogue security software to remove it.[6]

See also

References

  1. ^ "The Windows NT 4.0 Kernel mode change". MS Windows NT Kernel-mode User and GDI White Paper. Microsoft. Retrieved 2009-01-19.
  2. ^ "Inside the Windows Vista Kernel – Startup Processes". Inside the Windows Vista Kernel – Startup Processes. Microsoft. Retrieved 2010-10-01.
  3. ^ "Detailed implementation of a system service in Windows NT". Undocumented Windows NT. Archived from the original on 2011-07-17. Retrieved 2010-06-10.
  4. ^ Russinovich, Mark (2009). Windows Internals, 5th Edition. Microsoft Press. p. 54.
  5. ^ "How to troubleshoot a "STOP 0xC000021A" error in Windows XP or Windows Server 2003". support.microsoft.com. Retrieved 2020-03-15.
  6. ^ Cimpanu, Catalin (Jan 22, 2016). "Symantec Disavows Business Partner Caught Running a Tech Support Scam". Softpedia. Retrieved July 29, 2016.