Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Start Up Vs Processes


  • Please log in to reply
7 replies to this topic

#1 eccentric

eccentric

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:04:08 PM

Posted 16 August 2007 - 09:11 AM

Hello,

I am a bit confused between start up items in msconfig and processes in task manager. The confusion arose when I found that lass.exe in start up would be a virus lass.exe in processes is valid entry. How can we differentiate from processes whether that entry is valid or not as the same file would be a virus in start up items.

Please clarify.

BC AdBot (Login to Remove)

 


m

#2 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,571 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:07:08 AM

Posted 16 August 2007 - 09:22 AM

Hello eccentric and :thumbsup: to Bleeping Computer.

Can you please tell me where you found the information that said that lass.exe is a valid process? My quick web search turned up multiple articles saying it was bad, but not one stating it was a valid process.

You might want to do a search on your hard drive for this file and if it is there upload it at Jotti for analysis. This should tell you if it is a baddie or not.
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#3 eccentric

eccentric
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:04:08 PM

Posted 16 August 2007 - 09:33 AM

Hello,

I found that sometime when searching information for that file. I tried to delete that process from task manager but got it back everytime. Same as csrss.exe, I am not able to end these processes. However, I do not find them in start up item under msconfig. Would anyone tell me the difference between start items and processes please.

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,562 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:08 PM

Posted 16 August 2007 - 09:47 AM

Windows Processes Explained
Understanding Windows Process Authentication
Windows Processes Explained

What is MSConfig?
System Configuration Utility overview
MSConfig Tutorial
MSConfig Tutorial

MSConfig is a troubleshooting utility used to diagnose and fix system configuration issues. Although it works as a basic startup manager, msconfig should not be used routinely to disable auto-start programs. Further, msconfig does not list all applications loaded in all possible startup locations (some entry points are hidden and unknown to the user) and does not allow the complete removal of disabled entries from its list. You should not use msconfig to disable startup applications related to a running service. Doing so alters the registry and there are services that are essential for hardware and booting. When you uncheck a service in msconfig, you completely disable it. If you uncheck the wrong one, you may not be able to restart your computer. You should only disable services using Control Panel > Administrative Tools > Services.

A better alternative is to use a startup manager like Startup Control Panel, Autoruns or Starter by CodeStuff.
If you untick an entry it will no longer run at startup. This will allow you to experiment and see how your system performs with any of them disabled. Note: some startup programs are necessary so be careful what you disable.

If you are unsure what any of the program entries are or if they are safe to disable, then do a search on Google or at one of the following databases:
Startup Programs Database
StartupList Index

Determining whether a file is malware or a legitimate process depends on the location (path) it is running from. You can download and use Process Explorer or Glarysoft Process Manager to investigate all running processes and gather additional information to identify and resolve problems. These tools will show the process CPU usage, a description and its path location.

The Process Explorer window shows two panes by default: the upper pane is always a process list and the bottom either shows the list of DLLs loaded into the process selected in the upper pane, or the list of operating system resource handles (files, Registry keys, synchronization objects) the process has open. In the menu at the top select View > Lower Pane View to change between DLLs and Handles.

Anytime you come across a suspicious file which you cannot find any information, the file has a legitimate name but is not located where it is supposed to be or you want a second opinion, then submit it to jotti's virusscan or virustotal.com. In the "File to upload & scan" box, browse to the location of the suspicious file and submit (upload) it for scanning/analysis.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 eccentric

eccentric
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:04:08 PM

Posted 16 August 2007 - 10:16 AM

Hello,

Thanks for the explanation. I have some doubts. "csrss.exe and spoolsv.exe" are the SYSTEM processes, when searched I found these are invalid, But I am unable to end the processes. Are these virii or valid processes in task manager?

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,562 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:08 PM

Posted 16 August 2007 - 11:02 AM

csrss.exe is the user-mode portion of the Win32 subsystem (Win32.sys is the kernel-mode portion) and the main executable for the Microsoft Client/Server Runtime Server Subsystem. It is responsible for manageing most graphical commands in Windows, console windows, creating and/or deleting threads, and some parts of the 16-bit virtual MS-DOS environment. This process is important for stable and secure operation of your system and should not be terminated.

spoolsv.exe is a Microsoft Windows system executable which manages spooled printing tasks (print/fax jobs). This is not a critical process but it should not be terminated unless suspected of causing problems.

Both are normally found in task manager.

Determining whether either is malware or a legitimate Windows process depends on the location (path) it is running from. The legit processes are located in the C:\Windows\System32 folder.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 eccentric

eccentric
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:04:08 PM

Posted 16 August 2007 - 11:10 AM

Hello,

Thanks a lot!

So I have understood that processes or programs that show up in start up tab under msconfig are illegitimate if they show under other folder than c:/windows/system32.

One more question...

Would you give me instructions how to disable these "if" found threats safely, in correct order.

#8 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,571 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:07:08 AM

Posted 16 August 2007 - 11:28 AM

So I have understood that processes or programs that show up in start up tab under msconfig are illegitimate if they show under other folder than c:/windows/system32.

This is not correct. There are lots of legitimate programs that should be in Start Up but not in c:/windows/system32, a good example would be your antivirus program.
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users