Client/Server Runtime Subsystem: Difference between revisions

Revision as of 23:10, 4 July 2019

Revision as of 18:51, 18 September 2019

Line 1:

'''Client Server Runtime Subsystem''', or <tt>csrss.exe</tt>, is a component of the [[Windows NT]] family of [[operating system]]s that provides the [[User space|user mode]] side of the [[Windows API|Win32 subsystem]] and is included in [[Windows NT 3.1]] and later.<ref name="GDI">< /ref> Because most of the Win32 subsystem operations have been moved to [[kernel mode]] [[Device driver|drivers]] in [[Windows NT 4]] and later, CSRSS is mainly responsible for [[Win32 console]] handling and GUI shutdown. It is critical to system operation; therefore, terminating this [[Process (computing)|process]] will result in system failure. Under normal circumstances, CSRSS cannot be terminated with the ''[[kill (command)|taskkill]]'' command or with [[Windows Task Manager]], although it is possible in [[Windows Vista]] if the Task Manager is run in Administrator mode. On [[Windows 7]] and later, Task Manager will inform the user that terminating the process may result in system failure, and prompt if they want to continue.

== History ==

Line 24:

|archive-url=https://web.archive.org/web/20110717032622/http://www.left-brain.com/tabId/65/itemId/1642/pageId/29/Undocumented-Windows-NT.aspx

|archive-date=2011-07-17

|dead-url-status=yesdead

}}</ref> Window manager and [[Graphics Device Interface|GDI]] services are handled by a kernel mode driver (win32k.sys) instead.<ref>{{cite book|last=Russinovich|first=Mark|title=Windows Internals, 5th Edition|year=2009|publisher=Microsoft Press|pages=54}}</ref>

Line 32:

== Malware hoaxes ==

There are numerous [[Virusvirus hoax|virus hoaxes]]es that claim that csrss.exe is [[malware]] and should be removed to prevent damage to the system; these are false, as removing csrss.exe or killing the csrss.exe [[Process (computing)|process]] will result in a [[Blue Screen of Death]].

In addition, [[technical support scam]]mers pretending to be Microsoft representatives are known to use csrss.exe as "proof" of a virus infection, and convince the user being scammed into purchasing their [[rogue security software]] to remove it.<ref>{{cite web|url=http://news.softpedia.com/news/symantec-disavows-business-partner-caught-running-a-tech-support-scam-499310.shtml|title=Symantec Disavows Business Partner Caught Running a Tech Support Scam|last=Cimpanu|first=Catalin|publisher=[[Softpedia]]|date=Jan 22, 2016|accessdate=July 29, 2016}}</ref>