csrss and winlogon

Good day. I recently found something suspicious when i open Task Manager. Here's a screenshot :

http://img139.imageshack.us/img139/8792/0000qy1.th.png

And explorer.exe is in uppercase?

Did a full system scan with Ewido/AVG anti-spyware and NOD32 but nothing was found. Hope someone can help me with this, thanks.

 

hello, Lucy!
I found nothing wrong in your screenshot. Anyway, you could go to msconfig and see what do you have in the startup field and additionally scan those files on VirusTotal.

 

Hi pykko, thanks for replying.

I mean isn't it weird to have "??" in front of drive C? Plus, i don't remember explorer's exe is in uppercase. Both msconfig and services.msc don't show anything weird on startup entry.

 

They appear to me like legit system files.

 

Marcos, I actually changed my mind now. I've noticed the "??" which seems to me a virus like behaviour. I know those are quick deleted files...

I think it has those ?? to hide it from the OS and to run on startup. But perhaps I am wrong.

 

Hello,
There could be a simpler answer. Do you use a localized version of Windows? Is your username in local language? It could be as simple as that.
Mrk

 

No, i'm using English version Windows XP Pro SP1. My account username is by default "user".

It's weird that only csrss and winlogon are like that, the other processes in system32 folder are in the correct path. Did another full system scan but NOD32 and AVG Anti-spyware still found nothing.

 

Nothing wrong with your system, it's normal that these 2 processes have \??\ in front of the path.

 

And Windows is "case non-sensitive" so explorer.exe and EXPLORER.exe are the same since they can't co-exist in the same folder/directory.

Regards,

Pieter

 

Guess i was just being paranoid

Thank you all for helping.

 

No problem. It's better too ask then to keep on going in insecurity.

 

Well, nice to see Lucy is all right.