BleepingComputer.com: winlogin.exe and csrss.exe

I noticed these processes running with no description. I cannot stop them.

csrss.exe
winlogin.exe
atieclxx.exe


I know that these can be legitimate processes, but it seems that they can also be trojans too. How do I know if they are legit?

I am running Vista Home SP2.

Please let me know what I can do to figure this question out.

Thanks for any help.

It all depends on those files locations>
I assume, you meant winlogon.exe, not winlogin.exe?

Download Process Explorer: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
Unzip ProcessExplorer.zip, and double click on procexp.exe to run the program.
Click on View > Select Colunms.
In addition to already pre-selected options, make sure, the Command Line is selected, and press OK.
Go File>Save As, and save the report as Procexp.txt.
Attach the file to your next reply.

Yes, I meant winlogon.exe

I'm not sure how to attach a file.

Here's the text...hope that's ok





Process PID CPU Private Bytes Working Set Description Company Name Command Line
System Idle Process 0 95.95 0 K 24 K
System 4 < 0.01 0 K 139,136 K
Interrupts n/a < 0.01 0 K 0 K Hardware Interrupts and DPCs
smss.exe 532 348 K 812 K Windows Session Manager Microsoft Corporation \SystemRoot\System32\smss.exe
avgchsvx.exe 564 < 0.01 31,688 K 276 K AVG Cache Server AVG Technologies CZ, s.r.o. C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /boot
csrss.exe 784 < 0.01 1,920 K 5,488 K Client Server Runtime Process Microsoft Corporation C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
csrss.exe 872 < 0.01 2,908 K 12,736 K Client Server Runtime Process Microsoft Corporation C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
wininit.exe 880 1,444 K 4,292 K Windows Start-Up Application Microsoft Corporation wininit.exe
services.exe 924 < 0.01 3,080 K 7,544 K Services and Controller app Microsoft Corporation C:\Windows\system32\services.exe
svchost.exe 1168 3,544 K 7,080 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k DcomLaunch
ehmsas.exe 2892 1,304 K 4,396 K Media Center Media Status Aggregator Service Microsoft Corporation C:\Windows\ehome\ehmsas.exe -Embedding
WmiPrvSE.exe 4944 3,124 K 5,748 K WMI Provider Host Microsoft Corporation C:\Windows\system32\wbem\wmiprvse.exe
svchost.exe 1232 4,200 K 7,748 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k rpcss
atiesrxx.exe 1376 1,088 K 3,324 K AMD External Events Service Module AMD C:\Windows\system32\atiesrxx.exe
atieclxx.exe 1664 2,988 K 5,436 K AMD External Events Client Module AMD atieclxx
svchost.exe 1400 < 0.01 14,876 K 12,900 K Host Process for Windows Services Microsoft Corporation C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
audiodg.exe 1560 16,316 K 18,992 K Windows Audio Device Graph Isolation Microsoft Corporation C:\Windows\system32\AUDIODG.EXE 0x330
svchost.exe 1428 < 0.01 87,428 K 92,228 K Host Process for Windows Services Microsoft Corporation C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
wlanext.exe 2032 < 0.01 2,136 K 5,392 K Windows Wireless LAN 802.11 Extensibility Framework Microsoft Corporation C:\Windows\system32\WLANExt.exe 4292576
dwm.exe 2980 < 0.01 47,604 K 58,140 K Desktop Window Manager Microsoft Corporation "C:\Windows\system32\Dwm.exe"
WUDFHost.exe 3520 3,368 K 5,628 K Windows Driver Foundation - User-mode Driver Framework Host Process Microsoft Corporation "C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-8f05e2ef-09d1-4f0e-91d8-3723ecf91b88 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-de73e483-6c63-4727-bd8c-4f285563c3a6 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ea4457ed-9aa9-4f9a-8c8e-aa674f2eca9d -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:2ca147da-a218-4aa4-a56e-8a67d311be2b
svchost.exe 1440 < 0.01 65,508 K 75,716 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k netsvcs
taskeng.exe 2896 9,704 K 10,824 K Task Scheduler Engine Microsoft Corporation taskeng.exe {9AD97752-829B-418A-80FB-E45F10ECD962}
taskeng.exe 3024 2,128 K 6,044 K Task Scheduler Engine Microsoft Corporation taskeng.exe {9FB8DCA5-F528-4E33-8B4D-98F94DA97991}
svchost.exe 1580 2,260 K 5,160 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k GPSvcGroup
SLsvc.exe 1600 6,348 K 11,856 K Microsoft Software Licensing Service Microsoft Corporation C:\Windows\system32\SLsvc.exe
svchost.exe 1684 < 0.01 9,104 K 14,504 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k LocalService
svchost.exe 1832 < 0.01 18,640 K 17,820 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k NetworkService
spoolsv.exe 720 < 0.01 6,524 K 10,392 K Spooler SubSystem App Microsoft Corporation C:\Windows\System32\spoolsv.exe
svchost.exe 748 18,480 K 22,696 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
PhotoshopElementsFileAgent.exe 1804 < 0.01 1,516 K 772 K Adobe Photoshop Elements 9.0 (component) Adobe Systems Incorporated "C:\Program Files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe"
AERTSrv.exe 2064 424 K 1,708 K Andrea filters APO access service (32-bit) Andrea Electronics Corporation C:\Windows\system32\AERTSrv.exe
svchost.exe 2080 0.39 7,400 K 12,084 K Host Process for Windows Services Microsoft Corporation C:\Windows\System32\svchost.exe -k Akamai
AppleMobileDeviceService.exe 2092 < 0.01 3,276 K 7,112 K MobileDeviceService Apple Inc. "C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
avgwdsvc.exe 2132 < 0.01 8,372 K 18,576 K AVG Watchdog Service AVG Technologies CZ, s.r.o. "C:\Program Files\AVG\AVG10\avgwdsvc.exe"
avgnsx.exe 3732 14,272 K 288 K AVG Online Shield Service AVG Technologies CZ, s.r.o. "C:\Program Files\AVG\AVG10\avgnsx.exe"
mDNSResponder.exe 2148 1,852 K 5,236 K Bonjour Service Apple Inc. "C:\Program Files\Bonjour\mDNSResponder.exe"
svchost.exe 2188 4,188 K 8,268 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k hpdevmgmt
SyncServices.exe 2332 < 0.01 4,632 K 5,632 K Sync Windows Services Seagate Technology LLC "C:\Program Files\Maxtor\Sync\SyncServices.exe"
svchost.exe 2608 2,300 K 5,616 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
sprtsvc.exe 2628 21,760 K 1,996 K SupportSoft Agent Service SupportSoft, Inc. "C:\Program Files\Dell Support Center\bin\sprtsvc.exe" /service /p dellsupportcenter
svchost.exe 2700 4,672 K 7,428 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k imgsvc
TeamViewer_Service.exe 2764 4,328 K 8,936 K TeamViewer Remote Control Application TeamViewer GmbH "C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe"
WLIDSVC.EXE 3168 6,980 K 11,528 K Microsoft® Windows Live ID Service Microsoft Corp. "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
WLIDSVCM.EXE 3396 1,084 K 3,144 K Microsoft® Windows Live ID Service Monitor Microsoft Corp. WLIDSvcM.exe 3168
SearchIndexer.exe 3292 < 0.01 43,232 K 25,176 K Microsoft Windows Search Indexer Microsoft Corporation C:\Windows\system32\SearchIndexer.exe /Embedding
SearchProtocolHost.exe 5864 < 0.01 5,352 K 10,016 K Microsoft Windows Search Protocol Host Microsoft Corporation "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
SearchFilterHost.exe 1740 3,232 K 5,416 K Microsoft Windows Search Filter Host Microsoft Corporation "C:\Windows\system32\SearchFilterHost.exe" 0 688 692 700 65536 696
SDWinSec.exe 3528 4,948 K 8,328 K Spybot-S&D Security Center integration Safer Networking Ltd. "C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe"
AVGIDSAgent.exe 1984 < 0.01 27,348 K 24,500 K AVG Identity Protection Service AVG Technologies CZ, s.r.o. "C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe"
wmpnetwk.exe 5368 3.10 37,208 K 45,284 K Windows Media Player Network Sharing Service Microsoft Corporation "C:\Program Files\Windows Media Player\wmpnetwk.exe"
iPodService.exe 6072 < 0.01 3,188 K 5,812 K iPodService Module (32-bit) Apple Inc. "C:\Program Files\iPod\bin\iPodService.exe"
svchost.exe 3068 1,800 K 8,812 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
lsass.exe 976 3,528 K 2,492 K Local Security Authority Process Microsoft Corporation C:\Windows\system32\lsass.exe
lsm.exe 984 2,792 K 5,668 K Local Session Manager Service Microsoft Corporation C:\Windows\system32\lsm.exe
winlogon.exe 948 2,304 K 5,924 K Windows Logon Application Microsoft Corporation winlogon.exe
explorer.exe 2996 < 0.01 42,292 K 60,236 K Windows Explorer Microsoft Corporation C:\Windows\Explorer.EXE
RtHDVCpl.exe 1024 9,080 K 8,304 K HD Audio Control Panel Realtek Semiconductor "C:\Windows\RtHDVCpl.exe"
sprtcmd.exe 3012 38,600 K 2,896 K Dell Support Center Updates SupportSoft, Inc. "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
avgtray.exe 3124 < 0.01 5,272 K 5,652 K AVG Tray Monitor AVG Technologies CZ, s.r.o. "C:\Program Files\AVG\AVG10\avgtray.exe"
AVGIDSMonitor.exe 4312 1,788 K 5,316 K "C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe"
ehtray.exe 2856 1,856 K 1,388 K Media Center Tray Applet Microsoft Corporation "C:\Windows\ehome\ehtray.exe"
GoogleUpdate.exe 3700 4,428 K 2,472 K Google Installer Google Inc. "C:\Users\John\AppData\Local\Google\Update\GoogleUpdate.exe" /c
GoogleCrashHandler.exe 3780 4,120 K 1,156 K Google Installer Google Inc. "C:\Users\John\AppData\Local\Google\Update\1.3.21.57\GoogleCrashHandler.exe" /crashhandler
SUPERANTISPYWARE.EXE 3848 < 0.01 136,840 K 1,088 K SUPERAntiSpyware Application SUPERAntiSpyware.com "C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE"
wmpnscfg.exe 3312 1,908 K 5,324 K Windows Media Player Network Sharing Service Configuration Application Microsoft Corporation "C:\Program Files\Windows Media Player\wmpnscfg.exe"
Dropbox.exe 3908 47,208 K 47,908 K Dropbox Dropbox, Inc. "C:\Users\John\AppData\Roaming\Dropbox\bin\Dropbox.exe"
chrome.exe 4708 0.39 65,696 K 95,412 K Google Chrome Google Inc. "C:\Users\John\AppData\Local\Google\Chrome\Application\chrome.exe"
chrome.exe 4016 16,700 K 26,080 K Google Chrome Google Inc. "C:\Users\John\AppData\Local\Google\Chrome\Application\chrome.exe" --type=extension --disable-client-side-phishing-detection --lang=en-US --force-fieldtest=CacheSize/CacheSizeGroup_0/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_60/Prefetch/ContentPrefetchDisabled/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_enabled/SpdyCwnd/cwndDynamic/SpdyImpact/npn_with_spdy/WebSocketExperiment/default/ --channel=4708.00B24C70.1421041238 /prefetch:3 --ignored=" --type=renderer "
chrome.exe 4652 9,220 K 17,576 K Google Chrome Google Inc. "C:\Users\John\AppData\Local\Google\Chrome\Application\chrome.exe" --type=extension --disable-client-side-phishing-detection --lang=en-US --force-fieldtest=CacheSize/CacheSizeGroup_0/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_60/Prefetch/ContentPrefetchDisabled/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_enabled/SpdyCwnd/cwndDynamic/SpdyImpact/npn_with_spdy/WebSocketExperiment/default/ --channel=4708.00B221C8.1794635406 /prefetch:3 --ignored=" --type=renderer "
chrome.exe 3064 < 0.01 14,432 K 22,532 K Google Chrome Google Inc. "C:\Users\John\AppData\Local\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\10.0.0.1390_0\plugins/avgnpss.dll" --lang=en-US --channel=4708.060791D0.1013526426 /prefetch:4
chrome.exe 1368 0.39 87,560 K 99,936 K Google Chrome Google Inc. "C:\Users\John\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --disable-client-side-phishing-detection --lang=en-US --force-fieldtest=CacheSize/CacheSizeGroup_0/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_60/Prefetch/ContentPrefetchDisabled/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_enabled/SpdyCwnd/cwndDynamic/SpdyImpact/npn_with_spdy/WebSocketExperiment/default/ --channel=4708.05F0DD88.682242406 /prefetch:3
rundll32.exe 4520 5,628 K 5,900 K Windows host process (Rundll32) Microsoft Corporation C:\Windows\system32\rundll32.exe "C:\Users\John\AppData\Local\Google\Chrome\APPLIC~1\120742~1.122\gcswf32.dll",BrokerMain browser=chrome
chrome.exe 3912 < 0.01 19,504 K 23,364 K Google Chrome Google Inc. "C:\Users\John\AppData\Local\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Users\John\AppData\Local\Google\Chrome\Application\12.0.742.122\gcswf32.dll" --lang=en-US --channel=4708.07A95D60.1288261719 /prefetch:4 --flash-broker=4520
chrome.exe 5520 < 0.01 3,992 K 9,320 K Google Chrome Google Inc. "C:\Users\John\AppData\Local\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Users\John\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll" --lang=en-US --channel=4708.07A96090.546148231 /prefetch:4
googletalkplugin.exe 5748 < 0.01 13,352 K 16,948 K Google Talk Plugin Google "C:\Users\John\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe"
chrome.exe 5928 37,180 K 49,228 K Google Chrome Google Inc. "C:\Users\John\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --disable-client-side-phishing-detection --lang=en-US --force-fieldtest=CacheSize/CacheSizeGroup_0/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_60/Prefetch/ContentPrefetchDisabled/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_enabled/SpdyCwnd/cwndDynamic/SpdyImpact/npn_with_spdy/WebSocketExperiment/default/ --channel=4708.05F0E3A8.1367910703 /prefetch:3
chrome.exe 620 80,540 K 91,440 K Google Chrome Google Inc. "C:\Users\John\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --disable-client-side-phishing-detection --lang=en-US --force-fieldtest=CacheSize/CacheSizeGroup_0/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_60/Prefetch/ContentPrefetchDisabled/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_enabled/SpdyCwnd/cwndDynamic/SpdyImpact/npn_with_spdy/WebSocketExperiment/default/ --channel=4708.05F0E220.240438865 /prefetch:3
chrome.exe 5696 < 0.01 53,408 K 65,636 K Google Chrome Google Inc. "C:\Users\John\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --disable-client-side-phishing-detection --lang=en-US --force-fieldtest=CacheSize/CacheSizeGroup_0/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_60/Prefetch/ContentPrefetchDisabled/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_enabled/SpdyCwnd/cwndDynamic/SpdyImpact/npn_with_spdy/WebSocketExperiment/default/ --channel=4708.05F0E098.1699119839 /prefetch:3
WINWORD.EXE 5376 33,208 K 47,104 K Microsoft Office Word Microsoft Corporation "C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE"
procexp.exe 5496 0.39 18,464 K 27,600 K Sysinternals Process Explorer Sysinternals - www.sysinternals.com "C:\Users\John\Desktop\procexp.exe"
GoogleCrashHandler.exe 3216 4,092 K 864 K Google Installer Google Inc. "C:\Program Files\Google\Update\1.3.21.57\GoogleCrashHandler.exe" /crashhandler
avgrsx.exe 4972 < 0.01 1,336 K 720 K AVG Resident Shield Service AVG Technologies CZ, s.r.o.
avgcsrvx.exe 2392 18,876 K 2,984 K AVG Scanning Core Module - Server Part AVG Technologies CZ, s.r.o. C:\Program Files\AVG\AVG10\avgcsrvx.exe /pipeName=90149417-b155-4c0f-a199-07754570160e /coreSdkOptions=30 /logConfFile="C:\ProgramData\AVG10\temp\7e839c52-23f3-4663-823e-4460dcf4dc3b-136c-oopp.tmp" /loggerName=AVG.RS.Core /binaryPath="C:\Program Files\AVG\AVG10\" /registryPath="SYSTEM\CurrentControlSet\Services\Avg\Avg10" /tempPath="C:\ProgramData\AVG10\temp\"

All three entries are safe.

Broni, on 14 July 2011 - 07:33 PM, said:

Ok, thanks!

You're very welcome