Menu
What is the purpose of the csrss.exe (Client/Server Runtime Server Subsystem) on Windows?
Maybe someone could give a good explanation or pointers to documentation? Unfortunately Google results are pretty noisy when searching a core process of Windows.
The reason I'm asking is that I got a BSOD from my service application which seems to be related to the csrss.exe process, at least this is what the analysis of the memory dump shows:
PROCESS_OBJECT: 85eeeb70
IMAGE_NAME: csrss.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: csrss
FAULTING_MODULE: 00000000
PROCESS_NAME: PreviewService.
BUGCHECK_STR: 0xF4_PreviewService.
DEFAULT_BUCKET_ID: DRIVER_FAULT
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 80998221 to 80876b40
STACK_TEXT:
f5175d00 80998221 000000f4 00000003 85eeeb70 nt!KeBugCheckEx+0x1b
f5175d24 8095b1be 8095b1fa 85eeeb70 85eeecd4 nt!PspCatchCriticalBreak+0x75
f5175d54 8082350b 00000494 ffffffff 051bf114 nt!NtTerminateProcess+0x7a
f5175d54 7c8285ec 00000494 ffffffff 051bf114 nt!KiFastCallEntry+0xf8
051bf114 00000000 00000000 00000000 00000000 ntdll!KiFastSystemCallRet
STACK_COMMAND: kb
FOLLOWUP_NAME: MachineOwner
FAILURE_BUCKET_ID: 0xF4_PreviewService._IMAGE_csrss.exe
BUCKET_ID: 0xF4_PreviewService._IMAGE_csrss.exe
Followup: MachineOwner
EDIT: Thanks already for the good answers, but I actually don't need help concerning my service, I just would like to get some basic understanding of what the purpose of this service is.
242
csrss.exe is one of the most important system processes in Windows. At least two instances of the program are always running on your computer. Since it performs essential tasks such as starting and ending processes, it's considered a critical process that may not be terminated.
However, since it is a common and critical system process, many cyber attackers take advantage of it and release the malicious Trojan program sneaking in the CSRSS.exe name. In this post, we would learn how to spot the fake Client Server Runtime Subsystem process and remove the CSRSS.exe trojan.
There should only be one csrss.exe running at all times. If you see multiple copies of it, then the extra processes running are likely a virus/malware.
CSRSS hosts the server side of the Win32 subsystem. It is considered a system critical process, and if it is ever terminated you'll get a blue screen. More data is necessary, but you need to find out if some process is terminating csrss, or if it is crashing due to a bug.
Windows Internals is a great book for stuff like this. Wikipedia also has an article on CSRSS.
78
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
