
Search filename

Download

File information

Database statistics

Total:	809,521
Whitelist:	252,181

Top process list

	svchost.exe
	iexplore.exe
	csrss.exe
	rundll32.exe
	lsass.exe
	alg.exe
	wuauclt.exe
	ccapp.exe
	explorer.exe
	ctfmon.exe
	spoolsv.exe
	services.exe
	smss.exe
	jusched.exe
	winlogon.exe
	mdm.exe
	rthdcpl.exe
	hkcmd.exe
	msascui.exe
	alcxmntr.exe

What is Smss.exe

Client Server Runtime Process - Microsoft� Windows� Operating System - Microsoft Corporation

Run a Free Scan for SMSS.EXE related errors

File description

Smss.exe with description Client Server Runtime Process is a process file from company Microsoft Corporation belonging to product Microsoft� Windows� Operating System.
The file is digitally signed from JiangXi YouMa ChuangDa Software Technology Co.,Ltd - GlobalSign Time Stamping Authority
We do not recommend removing digitally signed files from JiangXi YouMa ChuangDa Software Technology Co.,Ltd

What is smss.exe?
Smss.exe is the session manager subsystem. This process is responsible for creating environment variables, starting the Win32 subsystem, creating paging files, establishing DOS device mappings, and initializing the Windows Logon Manager. As such, it is responsible for starting user sessions.

This process is a critical system process and is essential to the operation of the system. Due to the critical nature of the process, it is not possible to terminate the process via the task manager. Disabling this process otherwise will render your system unbootable. The screenshot below illustrates how it should appear in the task manager:

As you can see in the above screenshot, smss.exe always runs as SYSTEM. A process with this name running as a different user is a strong indicator of a malware infection.

Dangers of smss
As this is a critical system process that runs on every Windows NT-based (2000, XP, Vista) machine, it is common for virus writers and spyware vendors to disguise their malware as the genuine one.

Some malicious files will have the same name but will be stored somewhere other than in %SystemRoot%\System32. Other malware will use a name that appears similar to it but with slight differences in spelling or with appended digits. The following malware is known to disguise itself as smss.exe:

Backdoor.IRC.Flood.F (%SystemRoot%\System32\CatRoot)

This is a backdoor trojan that includes an IRC bot that allows an attacker to issue remote commands. It connects to a remote IRC server on port 6667.

W32.Resdoc (%SystemRoot%)

This is a worm that occasionally attempts to copy itself to the A drive.

W32.Dalbug.Worm (%SystemRoot%)

This is a worm that registers itself as a system service called NtLmHosts. Additionally, in order to avoid detection, it removes registry entries pertaining to itself while Regedit is running and restores them afterwards.

There will always be exactly one instance of this process running at any given time. The presence of multiple instances is a strong indicator of a malware infection.

Common problems

Windows will not boot due to smss.exe not being found

If you deleted smss.exe while trying to rid your system of a virus, you may have deleted the wrong one. If you have a backup of it, restore it by connecting the hard drive to another machine or booting into a live CD of an alternative operating system. If you do not have a backup or do not have a way to restore the backup, you should perform a repair installation of Windows.

This process uses 100% CPU

This is typically caused by a malware infection.

Automatic startup locations

	001 Running Processes
	002 Autorun registry entries local machine
	003 Autorun registry entries Current User
	004 All users startup startmenu
	005 Current user startup startmenu
	006 Start Menu\Programs\Startup
	007 Roaming Start Menu\Programs\Startup
	008 Autorun registry entries Default user
	009 Autorun registry entries SYSTEM user
	010 Installed services
	033 Winlogon Userinit
	034 Winlogon Shell
	035 Active Setup Installed Components
	073 %windir%\Tasks
	135 Current User Runonce (+ subkeys)
	139 Windows\load
	167 HKLM Policies\Explorer\Run

Digital signatures found for this file

	Signer of certificate	Issuer of certificate
	JiangXi YouMa ChuangDa Software Technology Co.,Ltd	GlobalSign Time Stamping Authority
	Karmasis Ltd. Inc.	COMODO Time Stamping Signer
	Microsoft Corporation	Microsoft Time-Stamp Service
	Microsoft Windows	Microsoft Time-Stamp Service
	Microsoft Windows	Microsoft Timestamping Service
	Microsoft Windows	VeriSign Time Stamping Services Signer
	Microsoft Windows 2000 Publisher	VeriSign Time Stamping Service
	Microsoft Windows 2000 Publisher (Europe)	VeriSign Time Stamping Service
	Microsoft Windows 2000 Publisher (Europe)	VeriSign Time Stamping Service CA SW1
	Microsoft Windows Component Publisher	Microsoft Timestamping Service
	Microsoft Windows Component Publisher	VeriSign Time Stamping Services Signer
	Microsoft Windows Publisher	VeriSign Time Stamping Service
	Microsoft Windows Publisher	VeriSign Time Stamping Services Signer
	Microsoft Windows XP Publisher	VeriSign Time Stamping Service
	Microsoft Windows XP Publisher	VeriSign Time Stamping Services Signer

MD5 security rating in our database

		150	files (Not yet rated and not signed)
		3	files (Not yet rated and digitally signed)
		7	files (Safe and not signed)
		235	files (Safe and digitally signed)

Some versions of this filename have not yet been checked for safety.

Warning: Some malware might rename itself to smss.exe. Always make sure that your file is from a verified publisher.

Application errors

Fix smss.exe application error: Run a FREE registry scan

User comments.

There are no comments yet.

Please add your comments if you have more information about this file or if you know how to solve smss.exe application errors.

File rating :

Are you human? How much is 19+20:

Browse files by letter

More system processes

smssas.exe	smsscheduler.exe	smsse.exe
smsserveru.exe	smsservice.exe	smss-le.service.exe
smssm.exe	smssni.exe	smssqlbkup.exe
smsssoax.dll	smsstarter.exe	smssvc.exe