csrss.exe - Client / Server Runtime Sub-System
The csrss.exe process is, in most cases, a legitimate and highly critical Windows component that should never be disabled. The name stands for "Client/Server Runtime Sub-System." It's the user-mode component responsible for managing console windows, process threads, and some legacy portions of the old 16-bit DOS runtime (hence its management of the console process). The running process additionally handles Windows and graphics functions for all subsystems.While csrss.exe is a required component of Windows, only one process with this name should be present on a running XP or Vista machine at a given time. Also, the csrss.exe binary file must be located in the c:\windows\system32 directory.
If you find copies of this file in other areas, it may be a left-over file that was dropped onto the system during an upgrade or installation. The alternative, and more problematic explanation, is that it's a virus or spyware binary. This file is known to be "impersonated" by certain viruses; it's reported that naming viruses after this file is popular among malware authors because Windows refuses to close any process running under this name. If true, this is a weakness in the OS itself; Microsoft should change this behavior to only block shutdown of such a binary if it's found to reside in the correct directory.
Users have reported that at least some variants of spyware impersonating as csrss.exe are picked up by utilities such as SpySweeper, Spybot Search and Destroy, and other scanning applications. If you suspect your PC has been infected by a bogus copy of this file, follow the usual procedure and download or purchase an appropriate scanning utility. Run a complete scan on your system in order to locate and remove the offending application.
Remember, the "real" copy of csrss.exe is a critical Windows file and should never be removed, modified, disabled, or renamed. Doing so is certain to cause major problems, and will probably render your machine unbootable.
windowshelp.net