RSS

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	.svchost	CSRSS.EXE	"Added by the WEBUS.F TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	.TEXTCONV	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	.WMAudio	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	27	csrss32.exe	"Added by the SLSORVE-D TROJAN!"
X	2k6 updatz	crss3.exe	"Added by the RBOT-CPD WORM!"
X	aDir	adirss.exe	"Added by the SPAMSRV-E TROJAN!"
X	AdRotator.Application	[path to csrss.exe]	"Added by the SMALL-AQ TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	ALM	csrss32.exe	"Added by the ANACON-D VIRUS!"
X	Application	csrss.exe	"Added by the BEAGLE.EG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	argq32	csrss_32.exe	"Added by the RBOT-CPM WORM!"
X	ASP.NET State Service	csrss.exe	"Added by the DLOADER-QI TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	AtiSound	csrss.exe	"WinSpy surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""ComRoot"" subfolder"
X	AVManager	csrss.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
X	BagleAV	csrss.exe	"Added by the NETSKY.AB WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	BuildLabs	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	CaptionMgr32	crssr.exe	"Added by the ZAR.A WORM!"
X	ccpApps	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	ccrss	msdtc.exe	"Added by the STAP-C WORM!"
X	cdoosoft	herss.exe	"Added by the SILLYFDC.BCT WORM!"
X	ClickTheButton	csrss.exe	"ClickTheButton adware. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	Client Server Runtime Process	csrsss.exe	"Added by the SDBOT-LD WORM!"
X	CLSRSS	LSACS.EXE	"Added by the SILLYFDC-X WORM!"
X	cmrss	cmrss.exe	"Added by the DELF.DU TROJAN!"
X	cmrss	crmss.exe	"Added by the DLOADER-EK TROJAN!"
X	cmrss	[path to trojan]	"Added by the DLOADER-QQ TROJAN!"
X	Console de Gerenciamento Microsoft	csrss.exe	"Unidentified malware! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Level4"" subfolder"
X	Console de Gerenciamento Microsoft	csrss.exe	"Added by the BANCBAN-ET TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Central de Segurança"" subfolder"
X	Controlled Resource System Service	crss.exe	"Added by the AGOBOT.GH WORM!"
X	coolwebprogram	clrssn.exe	"CoolWebSearch Smartsearch parasite variant"
X	CRC Value Verifier	crsss32.exe	"Added by a variant of the RBOT WORM!"
X	CRC Value Verifier	Crsss64.exe	"Added by the RBOT-NY WORM!"
X	CRC Value Verifier	crsss.exe	"Added by the SPYBOT.UK WORM!"
X	CRSS	CRSS.exe	"Added by the AGOBOT-RM WORM!"
X	CRSS	lssas.exe	Added by an unidentified WORM or TROJAN!
X	crsss	crsss.exe	"Added by the AUTORUN.FM WORM!"
X	CRSSXP SysInfo	crssxp.exe	"Added by a variant of the SDBOT TROJAN!"
X	CSRSS	CSRSS.EXE	"Search page hijacker
X	Csrss	csrss.exe	"Added by the CHOD WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a random subfolder"
X	csrss	csrss.exe	"Added by the KEYLOG-AQ KEYLOGGER! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	csrss	csrss.exe	"Added by the CHODE-J WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a random subfolder"
X	csrss	msmsgs.exe	"Added by the CHODE-J BACKDOOR! Note - this malware uses MSN Messenger (which is located in %Program Files%\Messenger) in the background to propogate itself"
X	csrss	nwiz.exe	"Added by the CHODE-J WORM!"
U	csrss	csrss.exe	"BeyondKeylog surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Supremtec"
X	Csrss	CSRSS.EXE	"Added by the PUNYA-B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in C:\Documents and Settings\Administrator\Local Settings\Application Data\WINDOWS"
X	csrss	ssms.exe	Added by an unidentified malware
X	Csrss Host	csrhost.exe	"Added by the IRCBOT.BIZ WORM!"
X	CSRSS Loader	csrsss.exe	"Added by the AGOBOT.TX WORM!"
X	csrss.exe	csrss.exe	"Added by the DALBUG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	csrssLevel4	csrss.exe	"Unidentified malware! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Level4"" subfolder"
X	CSRSSU	CSRSSU.exe	"CoolWebSearch parasite variant - hijacking to Slawsearch.com. Also detected as the CWS-E TROJAN!"
X	CSRSSW	CSRSSW.EXE	"Added by the CWS-F TROJAN!"
X	cssrss.exe	cssrss.exe	"Malware installed by different rogue security software including SpyKillerPro"
X	ctfnom.exe	OSRSS.exe	"Added by the DLOADER-UQ TROJAN!"
X	DIECOX	csrss.exe	"Added by a variant of the ATM.GEN TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	DSService	dmrss.exe	"Added by the AGOBOT-XX WORM!"
X	Explorer.exe	csrss.exe	"Added by the JUEGO-B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %AppData%\Microsoft"
X	FiendlyType	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	FirewallActivies	csrss.exe	"Added by the BANKER-AQ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""3041"" subfolder"
X	irssyncd	irssyncd.exe	"SafeSurfing adware variant"
X	Jnskdfmf9eldfd	csrssc.exe	"Added by the AGENT.EBC TROJAN!"
X	KernellApps	csrss.exe	"Added by the BANCBAN-AC TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""System"" subfolder"
X	Key Logger	csrss.exe	"Added by the BUCHON.A WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in the root folder (ie
X	Krnlcheck	csrss.exe	"Added by the BOTNACHALA TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Logon	CSRSS.EXE	"Added by the BRONTOK-BH WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	LogonAdministrator	CSRSS.EXE	"Added by the KORRON.B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	Logonrepclient1	CSRSS.EXE	"Added by the BRONTOK-BT WORM and variants! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	Logonsara	csrss.exe	"Added by the BRONTOK-BS WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	LogService	lsrss.exe	"Added by the PAPROXY-D TROJAN!"
X	Microsoft Client/Server Runtime Server Subsystem	csrssa.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft CSRSS Service	nsmscrs.exe	"Added by the RBOT-BPT WORM!"
X	Microsoft CSRSS32 Protocol	csrss32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft CSRSS386 Protocol	csrss386.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft DLL Verifier	csrssv.exe	"Added by the RBOT-ATK WORM!"
X	MicroSoft Remote Secure Service	MSRSS.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft System Restore Configuration	CBRSS.EXE	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update Machine	lmrss.exe	"Added by the RBOT-DY WORM!"
X	Microsoft Update Machine	crss32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Service	csrss32.exe	"Added by the AGOBOT-HC WORM!"
X	Microsoft Windows CSRSS	csrss.exe	"Added by the KALEL-A WORM! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Microsoft Windows Update Client	csrss.exe	"Added by the KEBEDE-G WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Systems32"
X	Microsoft Word Profissional	csrss.exe	"Added by the BANCBAN-DB TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""s1613"" subfolder"
X	Microsoft Word Profissional	csrss.exe	"Added by the BANKER-DJ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""protect"" subfolder"
X	Microsoft Word Profissional	csrss.exe	"Added by the BANKER-DP TROJAN! ! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""JavaVM"" subfolder"
X	MicrosoftROMDriverService	cdrss.exe	"Added by the IRCBOT.BLF BACKDOOR!"
X	MicrosoftSourceSafe	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	Microst dds service	wsrss.exe	Added by an unidentified WORM or TROJAN!
X	MS taskbar	crssr.exe	"Added by the RBOT-AGO WORM!"
X	MSControl28	crsss.exe	"Added by the SPYBOT.AJX WORM!"
X	MSN	wdlrss.exe	"Added by a variant of the SDBOT TROJAN!"
X	MSN ang	cssrss.exe	"Added by the FORBOT-CE WORM!"
X	Msn Messanger	crsss.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	NAV Auto Updates	csrssp.exe	"Added by a variant of the SDBOT WORM!"
X	Norton Auto Protect	crss32.exe	"Added by the SDBOT.ATF WORM!"
X	Norton Protect Activies	csrss.exe	"Added by the BANKER-CZ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""D5133"" subfolder"
X	NTDLM	csrss.exe	"Added by the HALE TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Qossrv"" subfolder"
X	PersSecurity	personalsecurity.exe	"Personal Security rogue security software - not recommended
X	PersSecurity	psecurity.exe	"Personal Security rogue security software - not recommended
X	Prog	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	RegDone Ex	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	RegWrite	csrss.exe	"Added by the SOKACAPS TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Media"
X	RPCserv32g	CSRSS.EXE	"Added by the BOBAX.AD WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	RSS	"rundll32 RSSToolbar.dll	DllRunMain"
U	RssReader	RssReader.exe	"RssReader - a free RSS reader able to display any RSS and Atom news feed (XML)"
X	rundll32	csrss.exe	"Added by the GUTTA TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Runner	csrss.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Runtime Process	Csrss.exe	"Added by the CIADOOR-J BACKDOOR! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Runtime Server Subsystem	csrss.exe	"Added by the IRCBOT-XV WORM!"
X	scrss	scrss.exe	"Added by the HACDEF-R TROJAN!"
X	sdrss	sdrss.exe	"Added by the SDBOT-SQ WORM!"
X	SernellApp.pcx	csrss.exe	"Added by the BANCBAN-BJ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""D5133"" subfolder"
X	Services	csrss.exe	"Added by a variant of the RANKY.U TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Services	csrss32.exe	"Added by the ANACON-D VIRUS!"
X	ServRun	srss32.exe	"Added by the AGOBOT.ABS WORM!"
X	Shockwave	csrss.exe	"Added by the SNDOG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	smrss	smrss.exe	"Added by the BANPAES-B TROJAN!"
X	smss.exe	csrss.exe	"Added by the DALBUG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	SP2 Firewall/Internet Updater	crssrs.exe	"Added by the RBOT.BJO WORM!"
U	SRS Audio Sandbox	SRSSSC.exe	"SRS Audio Sandbox ""provide amazing audio immersion and maximum thump for a personalized audio experience!"""
X	start uploading	crsss.exe	"Added by the RBOT-SZ WORM!"
X	State Service	csrss.exe	"Added by the DADOBRA-CP TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Sygate Personal Port	crss.exe	"Added by the RBOT-PX WORM!"
X	sysinter	ADIRSS.EXE	"Added by the AGENT.JVJ TROJAN!"
X	System	csrss.exe	"Added by the LDPINCH.E TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System Config Manager	crss.exe	"Added by the AGOBOT.GH WORM!"
X	System CSRSS Patch	scrtkfg.exe	"Added by the RBOT-ADA WORM!"
X	System Log Event	csrss32.exe	"Added by the AGOBOT-JI WORM!"
X	System Process	csrss.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System Update Service	csrss32.exe	"Added by the AGOBOT-HI WORM!"
X	System32	csrss.exe	"Added by the SILLYFDC WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	SystemDriver	csrss.exe	"Added by the ASCETIC.B TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\addins\explorer"
X	SYSTEMSars32	csrss.exe	"Added by the AHLEM.A WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	TaskMrg	csrss.exe	"Added by the LDPINCH-W TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Update	csrss.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Update	csrss.exe	"Added by the MEHEERWAR TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""winupdate"" subfolder"
X	UpDaTer	csrss.exe	"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ï¿½ subfolder"
X	Updater Service Process	csrss32.exe	"Added by the AGOBOT-GP BACKDOOR!"
X	USD Driver	ccrss.exe	"Added by the SDBOT.BFH WORM!"
X	Vital Master-boot DLL	crsss.exe	"Added by the RBOT.ASE WORM!"
U	WallpaperSS	WallpaperSS.exe	"Wallpaper Slideshow LT from gPhotoShow.com - ""a great utility for displaying your favorite photos as your desktop wallpaper"""
X	Win exe file managr	crss.exe	"Added by the RBOT.CCI WORM!"
X	Win32 Network Driver	crss.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Win32 Security Service	crsss.exe	"Added by the DELBOT-O WORM!"
X	WinCSRSS	MSGRT32.EXE	"Added by the REWINDO-A TROJAN!"
X	Windows 2004	csrss.exe	"Added by the BANKER-DY TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Windows 2004\Tools"
X	Windows Client Service 32	csrss.exe	"Added by the RBOT-ALB WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a drivers\winsdriver subfolder"
X	Windows Explorer SP2	csrss.exe	"Added by the BANKER-DM TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""JavaBeans"" subfolder"
X	Windows media service	crsss.exe	"Added by the RBOT.ACY WORM!"
X	Windows media services	cvrsss.exe	"Added by the RBOT-MW WORM!"
X	Windows Registry Security	crss.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Service Update	crsss.exe	"Added by the SDBOT.CWX WORM!"
X	Windows System Manager	crssm.exe	"Added by the RBOT-AFH WORM!"
X	Windows Taskmanager Data	csrrss.exe	"Added by the RBOT-BBH WORM!"
X	Windows Update	csrss.exe	"Added by the BANKER-HM TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WindowsExplorer	csrss.exe	"Messenger Blocker rogue security software - not recommended. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\System"
X	Windowsupdate Service	csrss.exe	"Added by the BABA-B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in the root folder (ie
X	WindowsUpdatecrss	crss.exe	"Added by a variant of the AGENT-HZ TROJAN!"
X	WinFix service	rsswjzgp.exe	"Added by the RBOT-FAE WORM!"
X	winprotection	ccsrss.exe	"Added by the SILLYFDC.BBT WORM!"
X	Winsock2 driver	svchorsst.exe	"Added by the SPYBOT-EE WORM!"
X	WINTASK DLL32	smsrss.exe	"Added by the MYTOB.BS WORM!"
X	WinUpdateAdministrator	CSRSS.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in C:\Application Data\WINDOWS"
U	WinUpdateProtection	csrss.exe	"EmployeeWatch is a commercial surveillance software program designed to monitor user activity on a computer. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a subfolder of C:\windowsupdate\ufp"
X	WinXP	csrss.exe	"Added by the BANCOS-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\WinXP\Tools"
X	WinXP-98	CSRSS.exe	"Added by the BANKER-DS TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\WinXP-98\Tools"
X	WMDM PMSP Service	cssrss.exe	"Added by the KNOCKIT-A TROJAN!"
X	WSAConfiguration	drrss.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
U	ZoneUpdate	csrss.exe	"WinSpy surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""ComRoot"" subfolder"
X	[random name]	??rss.exe	"PurityScan adware"
X	[random name]	c?rss.exe	"PurityScan adware"
X	_SystemDriver	csrss.exe	"Added by the ASCETIC.B TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\addins\explorer"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.