Requesting assistance with cleaning up active system processes in XP

jimw,

I think it was misread and should have been LSASS.EXE.

Given what Denny and I have discovered, I'd suggest downloading, updating, and running Ad-Aware and SpyBot, as described in the second link listed below.

If you encounter problems, please post them in the Virus Information and Removal board.

(edit) Also note that the two copies of svchost.exe listed are entirely different sizes. It's highly probable that your machine is infected with spyware/malware, or possibly viruses. In addition to scanning your machine for spyware/malware, you should also make certain your antivirus protection is up to date, and scan your machine for viruses.

Jim

Message Edited by jimw on 05-07-2004 10:48 AM

arnon,

Take a look at the information here. Your entry for smss.exe has the comma in an odd place. If it is actually using 29MB that seems excessive. See the information here.

arnon,

This site allows you to look up processes by name, and provides a brief description of them. Here's what it has to say about  crss.exe.

It's usually the first site listed by Google if you search for a process name.

Take special note of the second one you listed, Isass.exe.  It's listed as a Trojan!

Jim

Denny,

Given that the list appeared to be pasted from the output of a program, and was (happily!) in a serif font, I'm not at all sure of that!

Jim

To arnon - Unless you are having a significent memory problems, in which case upgrading the amonut of memory is the only real long term solution, I would suggest that you leave the running processes alone. The chances of breaking something is inversly propotional to the number of process stopped.  Another comment, the sites that say they know what different process do, don't always.  What they are doing is making educational guesses, nothing more.    

Thanks to both of you for the response.

Jimw,

I mistakenly wrote down an "I" instead of "L" - it is indeed the system process, "lsass.exe - Local Security Authority Service." Although csrss.exe shows up as a system process, I'm not exactly sure what Client/Server Runtime Server Subsystem ("Description: Windows client server run-time subsystem handles Windows and graphics functions for all subsystems.") actually does and whether I need it running...

Denny,

I've been looking at the blackviper site for tips... Not sure what happened with that smss.exe usage either, when I look at the Task Manager now, it's only using 260K.

Jimw - I've already got the latest versions of AAW, Spybot, SpywareBlaster, PestPatrol, and have a reputable AV in "BitDefender" & firewall in Sygate Pro, etc - You name it, I've got it - so I don't think protection is an issue atm. I did a virus scan a few hours ago which turned up clean, but I've always had numerous instances of svchost.exe regardless of whether my system was found clean or infected. Atm, I've still got the two listed under SYSTEM and one under NETWORK SERVICE & the last under LOCAL SERVICE. All of them have lowered usages since the time I originally posted. I'm not clear on what you're suggesting is going on with the four instances of svchost.exe, not two...

"Winlogon.exe" http://www.liutilities.com/products/wintaskspro/processlibrary/winlogon/ cannot be ended through the Task Manager, giving the response "This is a critical system process. Task Manager cannot end this process," however my pc is only used by me & I do not use passwords, so I don't know that I actually need it. The point that I'm the only one using this pc is important, in that it seems that a number of these system processes pertain to administrative controls...

I think taking a look at "Black Viper's Windows XP Home and Professional Services Configurations" http://www.blackviper.com/WinXP/servicecfg.htm while compared with my own setup in Services may provide some more info on whether I truly need something enabled or not - I'll give that a go...

Just saw your response after posting - thanks as well to msgale.

Message Edited by arnon on 05-07-2004 02:33 PM

Your response about "winlogon.exe" is exactly what I was trying to say.  They don't know exactly what it does or why its needed, and you do not know exactly Windows XP works, so you can't make a logical decision either.  You refer to "administrative tasks",  but by your statements you really do not understand what that means.

Message Edited by msgale on 05-07-2004 02:45 PM

Message Edited by kippy50 on 05-07-2004 03:50 PM

Message Edited by kippy50 on 05-07-2004 03:51 PM

Msgale,

Clearing up the memory isn't a dire need, but I've recently upgraded AV's from AVG to BitDefender which requires more memory usage. I'm also using 384mb of ram (730mhz) which itself already includes an upgrade - so I won't be adding any more befor upgrading pc's.

Point taken about the site, though I don't see how detrimental it would be or how something could end up "broken" by merely experimenting w/ the system processes; ending a process in the Task Manager or setting a service from "Automatic" to "Manual" in Services...

Guys, lets get it right.  svchost on windows XP Pro can and usually have a different size for each separate process.  From my WIndows XP Pros system 4116k, 26744k, 2244k, 4392k, and 3102k.  On my server (Windows 2003 Advanced server) there is nine instances of svchost.exe running using between  1384k and 26020k.  It is imperitive to get it right when giving advice.  A good check and one which has saved me alot of grief is to/test out the problem before posting.  I did that in this case, which allows me to say what I am saying.  

arnon,

The bottom line in all of this is that your original post indicates that you are currently using only 1/6 of the total memory assets of your system. Experimentation will probably advance your knowledge of the impact of having processes running or not running but it is certainly not a pressing need.

I mistakenly wrote down an "I" instead of "L" - it is indeed the system process, "lsass.exe - Local Security Authority Service."
[...]
Atm, I've still got the two listed under SYSTEM and one under NETWORK SERVICE & the last under LOCAL SERVICE. All of them have lowered usages since the time I originally posted. I'm not clear on what you're suggesting is going on with the four instances of svchost.exe, not two...

Thanks for clarifying that it was really LSSS, and not ISASS. I was alarmed by the fact that ISASS is a known Trojan, with a name that looks like LSASS in carefully chosen sans-serif fonts (Isass lsass) (Isass lsass), and by the size discrepancy between two of the running copies of svchost. Four isn't unusual. Apparently the size differences aren't either.

In any case, I clearly was incorrect.

Jim

Be careful about these processes. See http://www.liutilities.com/products/wintaskspro/processlibrary/lsass/ for futher info about Isass.exe. A possible Trojan MAY have the same name as a needed Windows process.