The Client/Server Runtime Subsystem, hosted by the file csrss.exe is a Windows component that primarily handles and manages user-mode operations.
The Client/Server Run-Time Subsystem, hosted by the file csrss.exe is a Windows component which runs as a background process on Windows operating systems and handles user-mode operations and cannot be killed in the Task Manager. It is used by Windows to manage consoles, handle log in and shutdown, creation and deletion of threads, along with implementing portions of the NTVDM, the 16-bit virtual MS-DOS environment.
Although csrss.exe is a legitimate system file, viruses are often given the same name as camouflage. The only real copy of csrss.exe however, resides in %systemroot%\System32.
