容易让人产生怀疑的正常进程

executable service descriptive name (service name)
certsvc.exe certificate services (certsvc)
cisvc.exe indexing service (cisvc)
clipsrv.exe clipbook (clipsrv)
dfssvc.exe distributed file system (dfs)
dmadmin.exe logical disk manager administrative service (dmadmin)
dns.exe dns server (dns)
faxsvc.exe fax service (fax)
grovel.exe single instance storage groveler (groveler)
inetinfo.exe iis admin service (iisadmin)
ftp publishing service (msftpsvc)
network news transfer protocol (nntpsvc)
simple mail transport protocol (smtpsvc)
site server ils service (ldapsvcx)
world wide web publishing service (w3svc)
ismserv.exe intersite messaging (ismserv)
llssrv.exe license logging service (licenseservice)
locator.exe remote procedure call locator (rpc locator)
lsass.exe ipsec policy agent (policy agent)
kerberos key distribution center (kdc)
net logon (netlogon)
nt lm security support provider (ntlmssp)
security accounts manager (samss)
lserver.exe terminal services licensing (termservlicense)
mnmsrvc.exe netmeeting remote desktop sharing (mnmsrvc)
mqsvc.exe message queuing (msmq)
msdtc.exe distributed transaction coordinator (msdtc)
msiexec.exe windows installer (msiserver)
mstask.exe task scheduler (schedule)
netdde.exe network dde (netdde)
network dde dsdm (netddedsdm)
nscm.exe windows media station service (nsstation)
nslservice.exe on-line presentation broadcast (nslservice)
nspm.exe windows media program service (nsprogram)
nspmon.exe windows media monitor service (nsmonitor)
nsum.exe windows media unicast service (nsunicast)
ntfrs.exe file replication service (ntfrs)
regsvc.exe remote registry service (remoteregistry)
rseng.exe remote storage engine (remote storage engine)
rsfsa.exe remote storage file(remote_storage_file_system_administraton)
rsfsa.exe remote storage notification (remote_storage_user_link)
rssub.exe remote storage media (remote_storage_subsystem)
rsvp.exe qos admission control (rsvp)
scardsrv.exe smart card (scardsrv)
smart card helper (scarddriver)
services.exe alerter (alerter)
application management (appmgmt)
computer browser (browser)
dhcp client (dhcp)
distributed link tracking client (trkwks)
distributed link tracking server (trksvr)
dns client (dnscache)
event log (eventlog)
logical disk manager (dmserver)
messenger (messenger)
plug and play (plugplay)
protected storage (protectedstorage)
runas service (seclogon)
server (lanmanserver)
tcp/ip netbios helper service (lmhosts)
windows management instrumentation driver
extensions (wmi)
windows time (w32time)
workstation (lanmanworkstation)
sfmprint.exe print server for macintosh (macprint)
sfmsvc.exe file server for macintosh (macfile)
smlogsvc.exe perFORMance logs and alerts (sysmonlog)
snmp.exe snmp service (snmp)
snmptrap.exe snmp trap service (snmptrap)
spoolsv.exe print spooler (spooler)
svchost.exe com+ event system (eventsystem)
internet authentication service (ias)
internet connection sharing (sharedaccess)
network connections (netman)
remote access auto connection manager (rasauto)
remote access connection manager (rasman)
remote procedure call (rpcss)
removable storage (ntmssvc)
routing and remote access (remoteaccess)
system event notification (sens)
telephony (tapisrv)
tcpsvcs.exe boot inFORMation negotiation layer (binlsvc)
dhcp server (dhcpserver)
simple tcp/ip services (simptcp)
tcp/ip print server (lpdsvc)
termsrv.exe terminal services (termservice)
tftpd.exe trivial ftp daemon (tftpd)
tlntsrv.exe telnet (tlntsrv)
ups.exe uninterruptible power supply (ups)
utilmon.exe utility manager (utilmon)
winmgmt.exe windows management instrumentation (winmgmt)
wins.exe windows internet name service (wins)