Open Task Manager , right-click the process, and select "Open file location." If it is in a temporary folder or System32 , it may be a Trojan masquerading as the real file.

Boot into :

Open ( taskschd.msc ) and look for unusual tasks with random names or that reference crashserverdamon . Disable/delete them.