Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

HijackThis automated log analyzer! Submit a log and you will receive ALL the information we have in our DB's on everything on your system INSTANTLY!

Smss.exe


Click here to Run a Free Scan for Smss.exe Related Errors

What is it?
Session Manager SubSystem - smss.exe

What does it do?
smss.exe - This is the session manager subsystem, which is responsible for starting the user session. This process is initiated by the system thread and is responsible for various activities, including launching the Winlogon and Win32 (Csrss.exe) processes and setting system variables. After it has launched these processes, it waits for either Winlogon or Csrss to end. If this happens "normally," the system shuts down; if it happens unexpectedly, Smss.exe causes the system to stop responding (hang).

Additional Reading:
Smss.exe does not resolve forward references in environment

You will not be able to end this through task manager!

More info



Virus Precaution:

The smss.exe which is from Microsoft is located at c:windowsSystem32smss.exe . We've been able to find several viruses that run as smss to trick you.

Adware.Advision - Symantec Corporation
Adware.DreamAd - Symantec Corporation
Backdoor.IRC.Aladinz.O - Symantec Corporation
Backdoor.IRC.Flood.F - Symantec Corporation
W32.Dalbug.Worm - Symantec Corporation
W32.Resdoc - Symantec Corporation
Fix Smss.exe Errors: Free Scan

Recommended: Run a Free Performance Scan to automatically optimize memory, CPU and Internet Settings




Smss.exe is a Windows System File and should be in a system directory. If it is then this application is safe.

Startup DB Entries:
[Services.dll]"Added by the SOBER-L WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\msagent\system and note the space at the beginning of the ""Startup Item"" field" b
[winsystem.sys]"Added by the SOBER.K WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\msagent\win32 and note the space at the beginning of the ""Startup Item"" field" b
[.nvsvc]"Added by the IRCBOT-FP TROJAN! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup!" b
[DHCP]"Added by the WINSPY.AG TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\display" b
[info]"Added by the VB.EIW WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %System%\inetsrv" b
[InteliSys]"Advertisingvision adware. Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%" b
[internet]"Added by the MIFENG-K TROJAN! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!" b
[Kernel Safe Mode]"Added by the 78CRACK-A TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%" b
[KernellApps32]"Added by the BANCBAN-AN TROJAN! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup!" b
[MDSA Sentinel X]"SentinelX surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the smss.exe process which is always located in %System%. This one is located in %ProgramFiles%\MDSA Software" u
[Microsoft Session Manager Subsystem]"Added by the KALEL-D WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!" b
[Microsoft Windows Session Manager Subsystem]"Added by the PROXYSER-R TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%" b
[MULTIMEDIA KEYBOARD88]"Added by the SILLYFDC WORM! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup!" b
[NarmonVirusAnti]"Added by the AUTORUN-DV WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder" b
[Remove 54tr10]"Added by the BRONTOK-CH WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data" b
[SMSS]"Added by the FLOOD.F BACKDOOR! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Catroot"" subfolder" b
[smssLevel4]"Unidentified malware! ! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Windows Media Player\Skins\WindowsMediaSkin\Data\Level4" b
[System Session Manager]"Added by the KALEL-E WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!" b
[SysUtils]"Added by the AUTORUN-AWW WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%" b
[Virscanner]"Added by the DWNLDR-GWE TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%" b

Service DB Entries:
ssms Added by the SPYBOT.ADJ WORM! Note: This is not the legitimate Windows process SMSS.EXE (Which is al
sql-smss Added by the W32/Tilebot-GI WORM! Note: This worm rojan is located in C:%WINDIR% folder.
SMSS (SMSS) Added by the W32/Tilebot-V WORM! Note: This worm file is found in the Windows or Winnt folder.
Card Adapter (NETDown) Added by an unidentified TROJAN! of the Sdbot family. Note: This is not the legitimate Windows Proce
aol software (Aol Software) Added by the W32/Tilebot-FM WORM! Note: This is not the legitimate Windows process (Which is always
Windows Management Updater (WinManUpdater) Added by the Troj/Kaos-E TROJAN! Note: This worm rojan is located in C:%WINDIR%
Windows NT Session Manager Microsoft Windows NT Session Manager
Windows NT Session Manager (SMSS) Added by the Backdoor.IRCBot.rh as identified by ewido. Note: This worm rojan is located in C:%WINDI
Windows NT Session Managers Added by the W32/Sdbot-CPN WORM! Note: This worm rojan is located in C:%WINDIR% Note: not to be conf
Windows Object Manager W32.Banish.A@mm - Symantec Description: Randomly copied characteristics of an already existing servi

Disclaimer

Every attempt has been made to ensure the information about Smss.exe is accurate but alot of malware applications try to pose as valid applications. If it is something other than what was posted above please leave some feedback in the forum.
Printer Friendly

User Comments
w32.allimIt made me rebot my hard drive all over again...
smss.exemade me reboot-- had to reformat afterward because my computer wouldn't boot up & I still have the virus, I am having a hard time getting it back to normal
GaaraShould I remove the smss.exe file?
EdwardZone Alarm reports Spy Sweeper trying to open smss.exe. I don't know why - since I have auto-update disabled.
R3D3(V)P710V\I don't remember exactly which one, but I've seen smss.exe, or csrss.exe, (one of them, or both) shuts off the PC instantly upon their "taskmanager" process termination.
Windows Files
lsass.exe | csrss.exe | alg.exe | dwwin.exe | Svchost.exe | Spoolsv.exe | wowexec.exe | cidaemon.exe | wmiprvse.exe | ctfmon.exe | Winlogon.exe | wuauclt.exe | Smss.exe | msmsgs.exe | rundll32.exe | mdm.exe | ntvdm.exe | wscntfy.exe | explorer.exe | ntdll.dll | iexplore.exe | msdxm.ocx | wisptis.exe | wdfmgr.exe | MsiExec.exe | PDVDServ.exe | DLLhost.exe | gcasdtserv.exe | shdoclc.dll | Winmgmt.exe | cisvc.exe | oleaut32.dll | taskmgr.exe | inetinfo.exe | Shell32.dll | mspmspsv.exe | internat.exe | hal.dll | comctl32.dll | mstask.exe |