A list of common processes for Windows XP

Window| processes (that is, these processes are the basic conditions for the system to run, with these processes, the system will function correctly)

Smss.exe Session Manager
Csrss.exe Subsystem Server process
Winlogon.exe Admin User Login
Services.exe contains many system services
Lsass.exe manages IP Security policies and initiates Isakmp/oakley (IKE) and IP security drivers. (System Services)
Generates a session key and grants service credentials (ticket) for interactive client/server authentication. (System Services)
Svchost.exe contains many system services
Svchost.exe
SPOOLSV. EXE loads the file into memory for later printing. (System Services)
Explorer.exe explorer
Phonetic icon for Internat.exe tray area

Additional system processes (these processes are not necessary and can be added or decreased as needed through the service manager)
Mstask.exe allows programs to run at specified times. (System Services)
Regsvc.exe allows remote registry operations. (System Services)
Winmgmt.exe provides system management information (System services).
Inetinfo.exe provides FTP connectivity and management through the Internet information Services snap-in. (System Services)
Tlntsvr.exe allows remote users to log on to the system and run the console program using the command line. (System Services)
Allows you to manage Web and FTP services through the snap-in of Internet information services. (System Services)
Tftpd.exe implements the TFTP Internet standard. The standard does not require a user name and password. Part of the Remote Installation service. (System Services)
Termsrv.exe provides a multiple-session environment that allows client devices to access virtual Windows 2000
Professional desktop sessions and windows-based programs running on the server. (System Services)
Dns.exe answers query and update requests for Domain Name System (DNS) names. (System Services)

The following services are rarely used, the services above are harmful to security, and should be turned off if not necessary tcpsvcs.exe provides the ability to remotely install Windows Professional on a PXE remote boot client computer. (System Services)
The following TCP/IP services are supported: Character generator, daytime, discard, Echo, and quote of the day. (System Services)
Ismserv.exe allows messages to be sent and received between Windows Advanced Server sites. (System Services)
Ups.exe manages an uninterruptible power supply (UPS) connected to your computer. (System Services)
Wins.exe provides NetBIOS name services for TCP/IP clients that register and resolve NetBIOS names. (System Services)
Llssrv.exe License Logging Service (System service)
Ntfrs.exe to maintain file synchronization of file directory content among multiple servers. (System Services)
RsSub.exe controls the media used to store data remotely. (System Services)
Locator.exe manages the RPC name service database. (System Services)
Lserver.exe Register client licenses. (System Services)
Dfssvc.exe manages logical volumes that are distributed over a LAN or WAN. (System Services)
Clipsrv.exe supports ClipBook Viewer so that you can view the clip pages from a remote ClipBook. (System Services)
Msdtc.exe is a parallel transaction that is distributed over more than two databases, message queues, file systems, or other transaction protection resource managers. (System Services)
Faxsvc.exe helps you send and receive faxes. (System Services)
Cisvc.exe Indexing Service (System service) Dmadmin.exe Management services for Disk Management requests. (System Services)
Mnmsrvc.exe allows a privileged user to remotely access the Windows desktop using NetMeeting. (System Services)
Netdde.exe provides network transport and security features for Dynamic Data exchange (DDE). (System Services)
Smlogsvc.exe configures Performance Logs and Alerts. (System Services)
Rsvp.exe provides network signaling and local communication control installation for quality service (QoS)-dependent programs and control applications. (System Services)
RsEng.exe coordinates services and management tools that are used to store infrequently used data. (System Services)
RsFsa.exe the operation of remotely stored files. (System Services)
Grovel.exe scans the duplicate files on the 0 backup storage (SIS) volume and points the duplicate files to a data storage point to save disk space. (System Services)
SCardSvr.exe manages and accesses the smart card inserted into the computer's smart card reader. (System Services)
Snmp.exe contains agents that can monitor the activity of network devices and report to the network console workstation. (System Services)
Snmptrap.exe receives a trap message generated by a local or remote SNMP agent, and then passes the message to the SNMP management program running on this computer. (System Services)
UtilMan.exe starts and configures the accessibility tool from a single window. (System Services)
Msiexec.exe basis. MSI file to install, fix, and delete the software. (System Services)

Summarize:
The secret to discovering a suspicious process is to look at the list of processes in Task Manager, and after looking at it, a suspicious process can be found at a glance, just like finding a stranger in a familiar crowd.