Fix Csrss.exe High CPU Usage Issues

What is csrss.exe?

Csrrss.exe or Client Server Runtime Process is an essential component of the Microsoft Windows NT operating system. The main responsibilty this process has is to manage graphical instruction sets under the Microsoft Windows operating system.

The default location of the csrss.exe file in Windows 7/Vista/XP is c:\windows\system32.

Csrss.exe Issue

On a Windows XP computer when you right-click an item in Windows Explorer the computer stops responding and the culprit is Csrss.exe that is found to be using 100% CPU resources.

Note: To check the CPU consumption of any process, press Ctrl+Alt+Del and then click Processes in the Windows Task Manager.

What causes the csrss.exe error?

This csrss.exe issue usually occurs due to a corrupt user profile.

Possible Solution

To resolve the issue, you will need to remove your user profile. Before you do that, backup your essential data, as you will not be able to recover your data after the profile is deleted.

To delete your profile, you will need to perform the steps listed below:

Note: You will need to be logged in as an Administrator to delete a profile.

  1. Click Start, then right-click on My Computer, and then click Properties.
  2. Next, click the Advanced tab in the System Properties dialog box.
  3. Now, click on Settings under User Profiles to view all the user profiles on your computer.
  4. Select the profile that is corrupt and click on Delete.

Csrss.exe – Can you trust this file?

The authentic csrss.exe file is an essential and safe process. However, there is another instance of the csrss.exe file that is a registered trojan.

If you are concerned about the authenticity of the csrss.exe process running on your computer then run a malware scan. If the malware scan reports show the csrss.exe file to be illegitimate and malicious, then you should immediately remove it.

Csrss.exe error

When you restart your computer after performing a malware scan, you may receive the following error:

“Windows cannot find csrss.exe. Make sure you typed the name correctly, and then try again. To search for a file, click Start button, and then click Search.”

What causes the “Windows cannot find csrss.exe” error?

The error occurs when your antimalware tool removes the csrss.exe virus but fails to remove its associated registry entries.

Possible Solution

To resolve the error you need to delete the entries related to the rouge csrss.exe process.

You can delete the registry entries either manually by running the regedit command or by using a registry cleaning tool to do this job for you.

What are the malware that are known to use the csrss.exe file?

A list of Internet security threats known to use the csrss.exe file are listed below:

Backdoor.Trojan [Symantec]
Backdoor.VB.DVIH [PC Tools]
Backdoor.Win32.VB.brg [Kaspersky Lab]
Backdoor:Win32/VB.ANS [Microsoft]
Backdoor:Win32/VB.AT [Microsoft]
Constructor.Win32.Binder.kh [Ikarus]
Downloader [Symantec]
Downloader.Trojan [Symantec]
Email-Worm.Brontok!sd5 [PC Tools]
Email-Worm.Win32.Brontok [Ikarus]
Email-Worm.Win32.Brontok.A [Ikarus]
Email-Worm.Win32.Brontok.a [Kaspersky Lab]
Email-Worm.Win32.Brontok.N [Ikarus]
Email-Worm.Win32.Brontok.n [Kaspersky Lab]
Email-Worm.Win32.Brontok.q [Kaspersky Lab]
Email-Worm.Win32.Runouce.b [Kaspersky Lab]
Gen.Packed [Ikarus]
Generic BackDoor [McAfee]
Generic Downloader.s [McAfee]
Generic.dx [McAfee]
Generic.dx!fml [McAfee]
Hacktool [Symantec]
I-Worm.Brontok.AY [PC Tools]
I-Worm.Brontok.BM [PC Tools]
I-Worm.Brontok.CU [PC Tools]
I-Worm.Brontok.Gen.2 [PC Tools]
Mal/EncPk-KP [Sophos]
Mal/Generic-A [Sophos]
Mal/VB-F [Sophos]
Mal_Banker [Trend Micro]
not-a-virus:Server-FTP.Win32.Serv-U.gen [Kaspersky Lab]
Packed.Generic.233 [Symantec]
Packed/MEW [PC Tools]
PE_Chir.B [Trend Micro]
PE_FLUENZA.ART-O [Trend Micro]
PE_PARITE.A [Trend Micro]
PE_SALITY.AL [Trend Micro]
PE_SALITY.JER [Trend Micro]
Troj/Bckdr-QPB [Sophos]
TROJ_MALOE5.A [Trend Micro]
TROJ_SERVU.Q [Trend Micro]
Trojan Horse [Symantec]
TrojanClicker:Win32/Hatigh.C [Microsoft]
Trojan-Downloader.Win32.Agent.bl [Kaspersky Lab]
Virus.Win32.Agent.WAJ [Ikarus]
Virus.Win32.Parite.b [Kaspersky Lab]
Virus.Win32.Sality.aa [Kaspersky Lab]
Virus.Win32.Virut.q [Kaspersky Lab]
Virus:Win32/Sality.AM [Microsoft]
W32.Imaut [Symantec]
[email protected] [Symantec]
[email protected] [Symantec]
[email protected] [Symantec]
W32.Sality.AE [Symantec]
W32.SillyFDC [Symantec]
W32.Spybot.Worm [Symantec]
W32/Brontok-AE [Sophos]
W32/Brontok-BB [Sophos]
W32/Brontok-Gen, W32/Brontok-Gen, Mal/Behav-024 [Sophos]
W32/Brontok-Gen, W32/Brontok-Gen, Mal/Behav-024, Mal/Heuri-D, Mal/Emogen-N [Sophos]
W32/Brontok-Gen, W32/Brontok-Gen, Mal/Emogen-N, Mal/Heuri-D [Sophos]
W32/Brontok-Gen, W32/Brontok-Gen, Mal/Packer, Mal/Behav-024 [Sophos]
W32/Brontok-K [Sophos]
W32/Generic!worm [McAfee]
W32/Lovelet-AD [Sophos]
W32/Pate.b [McAfee]
W32/Rontokbr-A [Sophos]
W32/[email protected] [McAfee]
W32/Sality.gen [McAfee]
W32/Sality-AM [Sophos]
W32/Virut.gen [McAfee]
W32/Zaflen.a [McAfee]
Win32.Parite.B [PC Tools]
Win32.Sality.AA [PC Tools]
Win32/Kashu.B [AhnLab]
Win-Trojan/Xema.variant [AhnLab]
Worm.Autorun.ADN [PC Tools]
Worm.Brontok.BA [PC Tools]
Worm.Brontok.BK [PC Tools]
Worm.Brontok.Gen!Pac.3 [PC Tools]
Worm.Brontok.Gen.1 [PC Tools]
Worm.VB.FKF [PC Tools]
Worm.VB.GMH [PC Tools]
Worm.Win32.AutoRun [Ikarus]
Worm.Win32.AutoRun.dkk [Kaspersky Lab]
Worm.Win32.VB.ft [Ikarus]
Worm.Win32.VB.ft [Kaspersky Lab]
Worm.Win32.VB.gr [Kaspersky Lab]
Worm.Win32.VB.iq [Ikarus]
Worm:Win32/[email protected] [Microsoft]
Worm:Win32/[email protected] [Microsoft]
Worm:Win32/SillyFDC [Microsoft]
Worm:Win32/Usbalex.A [Microsoft]
Worm:Win32/[email protected] [Microsoft]
WORM_BRONTOK.BA [Trend Micro]
WORM_BRONTOK.IE [Trend Micro]
WORM_RONTKBR.B [Trend Micro]
WORM_RONTKBR.D [Trend Micro]
WORM_RONTKBR.GEN [Trend Micro]
WORM_VB.CBS [Trend Micro]