smss.exe information

Information and startup locations can be examined on this page: verify all your files to make sure that they are legitimate, digitally signed and from the company Microsoft Corporation to which they should belong. smss.exe security and file info Windows NT Session Manager - Microsoft(R) Windows (R) 2000 Operating System - Microsoft Corporation Filetype : executable An executable file is a program that can be executed in your windows environment. What is smss.exe? Smss.exe is the session manager subsystem. This process is responsible for creating environment variables, starting the Win32 subsystem, creating paging files, establishing DOS device mappings, and initializing the Windows Logon Manager. As such, it is responsible for starting user sessions. This process is a critical system process and is essential to the operation of the system. Due to the critical nature of the process, it is not possible to terminate the process via the task manager. Disabling this process otherwise will render your system unbootable. The screenshot below illustrates how it should appear in the task manager: As you can see in the above screenshot, smss.exe always runs as SYSTEM. A process with this name running as a different user is a strong indicator of a malware infection. Dangers of smss As this is a critical system process that runs on every Windows NT-based (2000, XP, Vista) machine, it is common for virus writers and spyware vendors to disguise their malware as the genuine one. Some malicious files will have the same name but will be stored somewhere other than in %SystemRoot%\System32. Other malware will use a name that appears similar to it but with slight differences in spelling or with appended digits. The following malware is known to disguise itself as smss.exe: Backdoor.IRC.Flood.F (%SystemRoot%\System32\CatRoot) This is a backdoor trojan that includes an IRC bot that allows an attacker to issue remote commands. It connects to a remote IRC server on port 6667. W32.Resdoc (%SystemRoot%) This is a worm that occasionally attempts to copy itself to the A drive. W32.Dalbug.Worm (%SystemRoot%) This is a worm that registers itself as a system service called NtLmHosts. Additionally, in order to avoid detection, it removes registry entries pertaining to itself while Regedit is running and restores them afterwards. There will always be exactly one instance of this process running at any given time. The presence of multiple instances is a strong indicator of a malware infection. Common problems Windows will not boot due to smss.exe not being found If you deleted smss.exe while trying to rid your system of a virus, you may have deleted the wrong one. If you have a backup of it, restore it by connecting the hard drive to another machine or booting into a live CD of an alternative operating system. If you do not have a backup or do not have a way to restore the backup, you should perform a repair installation of Windows. This process uses 100% CPU This is typically caused by a malware infection. Possible error for this file: Application error, the application has generated errors and will be closed by windows Our recommendation:  Click here to run a FREE Scan for SMSS.EXE related errors

MD5 File security rating

A MD5 hash is a unique fingerprint of a file. Different files/versions can have the same filenames. The MD5 hash verifies that the legitimate file is not altered. Runscanner (Freeware) can help you checking the file's MD5 hashes Smss.exe files in Runscanner database   79 different item(s) in database   3 different item(s) in database   198 different item(s) in database Green items are verified safe to use Unrated items are not yet checked for safety. Red items are not safe (typically virusses, spyware or other malware) This file is digitally signed by it's publisher. This means that the file is from the company claiming to created it, this does not mean by default that the file is safe

General file info

Product name:  Microsoft(R) Windows (R) 2000 Operating System Description:  Windows NT Session Manager Company:  Microsoft Corporation Fix SMSS.EXE errors:  Free registry scan

Pacman startup database

Added by a variant of the WINSPY.AA TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a "debug64" subfolder of the Winnt or Windows folder Added by the AGENT-TR TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder Added by the AGENT.AEP TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! info provided by sysinfo.org