What is smss.exe? Is smss.exe spyware or a virus?
How to fix smss.exe related problems?
1. Run Security Task Manager to check your smss process
2. Run Windows Repair Tool to repair smss.exe related Windows Errors
3. Run MalwareBytes to remove persistent malware
Process name: Windows NT Session Manager
Product: Windows
Company: Microsoft
File: smss.exe
Security Rating:
This is the session manager subsystem, which is responsible for starting the user session. This process is initiated by the main system thread and is responsible for various activities, including launching the Winlogon and Win32 (Csrss.exe) processes, and setting system variables. After it has launched these processes, it waits for either Winlogon or Csrss to end. If this happens normally, the system shuts down; if it happens unexpectedly, Smss.exe causes the system to stop responding (hang).
Note: The smss.exe file is located in the folder C:\Windows\System32. In other cases, smss.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.
Virus with same file name:
W32.Dalbug.Worm - Symantec Corporation
Adware.DreamAd - Symantec Corporation
W32.Resdoc - Symantec Corporation
Adware.Advision - Symantec Corporation
Backdoor.IRC.Flood.F - Symantec Corporation
Backdoor.IRC.Aladinz.O - Symantec Corporation
and more...
Click to Run a Free Scan for smss.exe related errors
Users Opinions
Average user rating of smss.exe: based on 317 votes. Read also the 253 reviews.
8874 users ask for this file. 102 users rated it as not dangerous. 19 users rated it as not so dangerous. 58 users rated it as neutral. 34 users rated it as little bit dangerous. 104 users rated it as dangerous. 31 users didn't rate it ("don't know").
| All comments about smss.exe: | |
|---|---|
| Windows Session Manager Subsystem Alex | |
| not dangerous, smvss.exe is used by various worms, so be careful to note the difference rich | |
| Microsoft system file | |
| appearing on the task manager, with less cpu and memory usage.when tried to kill, it says that its a critical system process and cannot be terminated See also: Link partha s das | |
| it slows down my pc big time Danny | |
| i agree with danny it slows every thing up, must be removed Robert | |
| Do not touch Optimus | |
| 2 versions of it run smss.exe and SMSS.exe, the second one isn't needed Delf | |
| is included in Win 2000 bootdisks Ninkyo | |
| If it named in the Security Task Manager "s" then it's a virus ,but if it named "smss.exe" that means OK Haitham | |
| macht den pc echt lamm b_tight | |
| danny, from what it looks like, it doesnt | |
| When right click on a file in explorer check ur CPU%. it boosts up to 100%, thats what smss and csrss.exe does | |
| It's a normal windows file, but the dang thing seems to get corrupted along with csrss.exe all the dang time. Not sure how to clean up. v.v Dark Prophet | |
| found it inside my windows directory and system32 the one in windows directory was smaller I have deleted it and everthing seems to work, | |
| Obviously this is a windows subsystem file but may be a virus with a combination of other processes that appear in the taskmanager Telangana Reddy | |
| Not a Virus Mufti Mahmud | |
| A large number of spyware and trojan programs use a version of this file and the csrss.exe, both created in the %windir% (NOT %windir/system) to contact websites and irc to download programs and give outside access to your computer. Val | |
| Session Manager Subsystem,Application that is used to start, manage, and delete user sessions or client sessions under Terminal Server. is NOT a security risk John | |
| I removed it from a client pc and had NO problems rebooting. File was in the sys32 directory too. CJ | |
| smss.exe, if located in system32, is LEGITIMATE AND NOT A VIRUS! If located somewhere else, and taking 100% cpu etc, it's a virus that just happens to use the same name, in an attempt to trick you! DUH | |
| IT MAY HAVE CAUSED MY SYSTEM TO CONSTANTLY HANG. ESPECIALLY WHEN ONLINE. MAURICE | |
| Just read the note about this file above. If it is not in the c:\Windiws\System32 folder, it is a trojan. Go to safe mode, and simply delete it. Piet | |
| a file with the same name in "c:\windows\system", it like a virus, but antivirus can't detect it | |
| its in my startup i just unchecked it everything runs fine Wild-e | |
| make the pc useless by making it SLOW stig | |
| A virus named "ravlovgate" Monarch Wqs | |
| installs with BOOMBox Internet Radio ---- Spyware See also: Link nervewreck27 | |
| If its not in your system32 folder, delete it. Andrew | |
| Trend Officescan recently picked this file up as being infected by BKDR_AGENT.CZ by its real time scanner - but a full scan of c:\ reports no infected files. I one evenening between 2am and 5 am trend detected it as a virus BKDR_AGENT.CZ every minute - still looking into problem. Could be nothing or could carry a high damage risk like other variants of BKDR_AGENT Richard | |
| smss.exe seems to be hard to delete adware (found in the windows file not system 32). Basicly a trick as it is a shared name and the process may not be stopped as it trickes windows into making it seem as a critial component. It may be deleted by renaming it rebooting and deleating the renamed file. Tom | |
| I got smss.exe on my sys 5 times including sys32=45k/smss inc:\windows\=48k/ 1 in prefetch=30k/ 1 in sp1 files/i386=45k and 1 in c:\windows\software distribution\download\=50k i take it this is not good!! anyideas? Paul | |
| "smss.exe is a process which is a part of the Microsoft Windows Operating System. It is called the Session Manager SubSystem and is responsible for handling sessions on your system. This program is important for the stable and secure running of your computer and should not be terminated. For More Detailed Process Information Get WinTasks 5 Pro" cornholio | |
| its a system file tony | |
| not dangerous loopthedanza | |
| This isn't a virus. If you've installed the service pack, that file automatically gets installed with your system, no biggy. Smss stands for Session Manager SubSystem. In other words, this program is responsible for controlling sessions on your computer, which will help to stable and secure your computer. It's a critical system process, which means taskmanager can't stop it. 666 - diese Wahrheit | |
| got it from Dhakz.cjb.net It IS a Virus BackDoor type and it shuts off my nortons. If it wasnt for my firewall , I'd never of known. Only Trend Micro online scanner found it and still cant delete it Mike Van | |
| if located c:\windows\system32 then ok, if not.....sneaky they have the same names...they all should be named vires....lol giel | |
| can also be in windows/servicepackfiles/i386 and in most cases is not dangerous crux | |
| It can be dangerous. If it's not in windows/system32, delete it. If it's in system32 but uses an abnormal amount of system resources, replace it from the file on a windows boot disk (for your version of windows, of course) | |
| irc client, some french Warez channel. Don´t know if it made any harm. Was in c:\winNT\security\database and in registry. micke | |
| A lot of viruses/trojans try to create files that have the same names as Windows' crucial files. Same goes for SMSS.EXE. If this file stays in the system32 or system folder of the Windows directory then it is a critical system process and should not be deleted (you cannot end its process). Otherwise, if it lies elsewhere and consumes a large amount of CPU resources then it is definitely a virus/trojan and should simply be deleted (in Safe Mode or Real Dos Mode). It can also be detected by HouseCall online virus scanner. Use the link below to launch HouseCall. See also: Link Danh | |
| system file daniel | |
| The smss.exe is trying to connect to the internet and as a system file it should not. | |
| It comes with WindowsXP. It's in C:\Windows\System32 folder when you install WindowsXP. George | |
| Windows Session Manager Subsystem runs executive program windows, such as microsoft word! | |
| If you remove it would damage The CPU and says,the NTVDM has encountred illegall instruction. It can contract virus but to clean it up! zee | |
| I found smssxp loading in taskmanager. It stops the tasbar and desktop icons from loading. It's all over my regstry and I cant seem to get rid of it. Sharon Kent | |
| We all know that this file is a subsystem file, but the error that some are getting is tricky, I myself getting the same error , but the file name for mine is "unable to find smsse.exe and to make sure the path is correct and all library resources are available" thats the question I have, has any one come accross this Frankie | |
| If this is not some kind of Virus/Trojan, then why are so many people having this problem, non of you guys have addressed that yet that think this is a normal file. Trev | |
| the entry i found on my system with hijack this is REG:system.ini: Shell=Explorer.exe smss.exe - and seems not to be the "Windows Session Manager Subsystem" process since this one is also being (positively) identified by hijack this and is running under .../windows/system32 - where it is supposed to be running. i suppose it s not a normal process beees | |
| system files are crucial for the system processes of your comp - but - some viruses will pretend to be a system file so they cannot be detected - at the moment, my current smss.exe is running at over 500mb (which isn't good - it increases like a page file). Jake | |
| It's not a virus or dangerous worm.i had no probs with that. a lot of worms are having simillar names with the system files. Vijju | |
| Just ran Trend Micro virus scan and it says SMSS.exe (virus) cannot be removed or repaired/cleaned... SMSS EXE TROJAN | |
| its dangerous when is other forms, for example. smsss.exe, ivy | |
| ZoneAlarm reports it trying to send 50 emails, it exists in a folder called Connection Wizard. I am sure it is parasitic software. gary | |
| may be a trojan J.M. Klerks | |
| It;s very noisy regarding the pop up message | |
| It appears to be a harmless file if located in system 32. See also: Link lamont lamont | |
| this site says that smss.exe is a trojan(no two ways about it?) See also: Link shimona | |
| i look at my running procceses all the time to keep an eye on things, as well as doing regular spyware/adware checks. i,m not sure about this one though. ad aware and spybot dont pick it up. (but that means nothing does it?)after reading the above, i,m even more unsure what to do! people who make virus,s and spyware should be pelted with all the hardware they have ever f**cked up! allan d | |
| My error message says: 'Windows cannot find 'smsse.exe'. Make sure you typed the name correctly, and then try again. To search for a file, click the start button, and then click search? But I never asked it to search for file smsse.exe in the first place? Tony Lewis | |
| I had an entry in my start group (smss) this caused my IE to hang. Removed it from the registry and all is okay (worked with Miceosoft tech support) Chris | |
| system file located in c:\windows\system32 and is called Session Manager SubSystem and is responsible for handling sessions on your computer. Carol | |
| I am facing hell out of problems with this , due to this my system shuts down automatic and not able to do any thing. it succs Pavan Kumar | |
| Just keep your anti-virus up to date, and don't open any suspicious files or links and your should be fine! Joki | |
| Don't know what to believe, there are too many different opinions rofl Foxtrot | |
| Don't know what to believe, there are too many different opinions rofl Foxtrot | |
| Find the Truth about your world: See also: Link Unknown | |
| compare the two versions, the one in system32 is legit, the one in system is not, it is probably a keyboard logger and should be deleted in safe mode. Counter spy blocked this application when it was trying to load into the startup registry, as the file is blocked it could not be scanned by the malware scan. McAfee latest updates did not find anything wrong, may be because it was blocked. So if it is in system delete it, if it is system32 then compare it to original. Use Windows utility sfc.exe Tonyk | |
| Several versions, several situations alone determine status of file. All are conditional. In specific locations as described above, is requisite system file excepting particular circumstances where modified by malicious software and displaying particular excessive behavior. In locations other than typical, as specified above, it is malicious software. 2000 Server sp4 uses version with size 312k-other systems differ perhaps in native normal file size. Logic | |
| New feature on Zonealarm detects some programs trying to use it. Did not monitor before new version so programs accessed it then, so it should still be OK now. PC does not have a virus or a worm. See also: Link Mr B. | |
| a System file - pay attention people, if it is smss.exe and located in the system32 dir, it should be ok. Any other variation on the name or location, THAT file is bad. Big Doc Lou | |
| It's a file used by Alias's Maya, so if u have Maya it's possible that u find it in your computer... BlackKnight | |
| Check Version tab in properties. Legitimate one says Microsoft. Bad one does not, and is in /system. Jonathon | |
| It sends emails in background, its a worm but can't eraze it and no antivirus can detect it! Peyman | |
| I managed to locate it using search and simply deleted by right clicking on it MikiT | |
| It's just another annoying -slow the whole the thing down- tool Domingo | |
| Part of XP if in system32. Anywhere else, dump it. Dav | |
| It is virus ! , but i don,t remove it. | |
| Essential operating system component | |
| Seems pretty cool | |
| invite some other sites to autoconnect internet and disables taskmanager Ashok | |
| Task manager shows smss.exe in windows/system32 as only 348k while the SMSS.EXE in windows/system is 3,208k, making me suspicious of the larger file. For that matter, how do we know that spyware isn't programmed into the XP operating system itself? Peter Paranoid | |
| its a windows system file, also many viruses (like brontok) try to create the same file name in different folder to trick user into thinking it is a Windows system See also: Link Yos Vincenzo | |
| MS Antispyware detects it as a possible trojan IF it is in the WINDOWS folder. If it is in WINDOWS\system32 it is okay! ZeroVerteX http://zerovertex.com | |
| It's a normal windows file Sztetke | |
| Part of the Windows system Astral Computing | |
| Trojan horse BackDoor.Virkel.B found in 'C:\WINDOWS\system32\nfisdprone\smss.exe' screwed my firewall and antispyware program. Ben | |
| windows\ServicePackFiles\i386 | |
| in my case it is in a folder called \systemRoot\System32 and its not signed by microsoft is this folder a valid one or is not.? lordvin | |
| the one in windows\system has smaller size 42Kb and periodically tries to connect somewhere, removed it, evrything is OK max_on | |
| There is a ligitimate executable named smss.exe without which Windows will not work. People on here sayin 'it made my system go slow' are either referencing a different application masqurading as the ligitimate file, have peculiar problems which they are attributing to the file or are just confused. The risk here is that you may see a file named smss.exe running and believe it is the one which does need to run, when in reality you are looking at a virus. A good way to check is, if you are running more than one of these you may have a problem. Alec | |
| If not found in system32 then probably a virus. I watched this thing which was located in the windows directory quickly open regedit and then close it again. Only virii does that. This program had also set up a UDP on port 1076. It was not in the winlogon hirachy and ran off of internet explorer. Only remove if you can verify it is not the real smss. R3DBALL | |
| I had the virus! I had c:\windows\SMSS.exe and c:\windows\system32\SMSS.exe. Deleted BOGUS c:\windows\smss.exe and problems went away. Daron | |
| If smss.exe runs from a diffrent directory than system32\ (mine ran from system\) IT'S A TROJAN VIRUS! But be aware! Do not under any circumstances delete the MS systemfile system32\smss.exe - that's not a virus. Read the note in the top of this page! | |
| I found this in a folder named 'WinSecurity' in Windows. It suddenly appeared after a browsing session and i isolated the time/date it arrived. Taking the advice of 'if its not in System32 file delete it' I deleted the whole folder. it also had services.exe and other malware programs in there Baloney | |
| My AVG anti virus detects this file as a VIRUS, but for some reason will not get rid of it. It is very frustrating to say the least Ashley | |
| Smss and lsass and csrss are Normal Files ** When they are located in the system32 directory **. If they are in the root Window folder They are SPYWARE. If you want to nat get infected with these files in the future, Here's What to do. Reboot in safe mode, go to your windows directory and locate the offending file. copy a version(Ms Certified) of that file from windows\servicepackfiles\i386 to your windows directory and write-protect them. By the way most spyware programs have another one unnamed that re-creates the offending files and makes them hard to get rid of. | |
| This file is not a virus! is a cool process that helps windows to run well , lol xobkcah | |
| look at the date it was created, if after windows install or update and is in windows system not sys32 then it is a virus. mine was installed by a bogus key gen (yea i know) and ever since 1/26/06 it attempts to shut down NIS 2005. i will rename and delete....not in sys32! | |
| A system process, but many virus's/trojans masqaurade uder its name, usually, if its a system task, its ok, in a user task, get rid of it | |
| Kaspersky says: Win32.IRCBot.nw - Trojan Downloader Uli | |
| This .Exe file in a complement of windows, is process run with winlogon and other several files, dont delete this file is a manager of the systems based on microsoft windows See also: Link Oss Agent | |
| the false smss.exe in folder system blocked the microsoft smss.exe in folder system32 titus | |
| My AVG antivirus reported this file as a virus, i chose to "heal it" and now when i start my computer it says "cannot find smss.exe" someguy | |
| in task manger it says i got two runing at once 1 takes 99 of cpu help please | |
| May be virus even if located in system32 dir. Mine was a virus and was located in c:\windows\system32\winhelp. Check if windows is running more than one smss.exe, if it is then you have a virus. Ubi Fumus | |
| if it's 50 K then fine larger it's bad Marcus | |
| get a hint dipshits, calm down, smss.exe it NOT A VIRUS and is essential retards, smsc.exe is a virus dicks keeping_it_cool | |
| This file slows down the whole damn computer it terrible thing it has to be removed. i used ewido to find it yeh_cheezzz | |
| this seemed to come from a file sent thru messenger while on chat. It has locked me out of nortons and is constantly changing my home page to virushelpzone how do I fix this? See also: Link Amanda | |
| connected to virus named exmodule32 Danny | |
| my file is legit its in the right folder and everything....I'm using previx1 and AVG....Everytime Previx gives me an alert to send something to jail it says the root file was smss.exe, how do i go about cleaning the file up if it is legit and should not be deleted? For an example one of the processes it stop that it stops is win3022, there has been a big variety and different one but there is always win in it...thank you. Greg | |
| seems to be trojan. it cause pc to hang, cant type, keyboard freezes kerbear | |
| Windows session manager, ok if in windows\system32. Dave | |
| yep, everything started when these popups of norton antivirus showed up saying that something is trying to send e-mails. There is a smss.exe in the system folder(another in system32 probably normal one) for me so i guess i have to delete it, but how? mhm | |
| I had to start my computer in safe mode to remove it... I had to remove everything though. Kent | |
| its a trojan no two ways about it delete it! tanchi | |
| all i know is i been around pc's a long time. an every time i install an os like win 98 se or winxp i always take a snap shot of the processes running an save it to paint :) an then i get more used to programs running on my pc :) but yes "smss.exe" is in the win xp pro setup so im not sure about this file lol Blaine J. | |
| Ive never seen such differing opinions on one subject. This link has been most unhelpful The Blind leading the Blind | |
| The file smss.exe in %windows%\system32 is the real one. A Backdoor install a different file in the %windows%\system directory. The virus itself is commonly larger than the original file. Valis Fauntleroy | |
| on my system smss.exe uses 224K mem and 144K VM. if it uses SIGNIFICANTLY more than this, then it may indeed be malware Mirddes | |
| AVG recognises it as a back door trojan, searched for files on computer and found 3 so deleted the two which were not located in windows sytem32 Phil | |
| It is the Windows NT Session Manager located in C:\WINDOWS\system32. It is an ESSENTIAL windows component. Among other things, it runs programs listed in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager key in the Registy. Maur | |
| Downloaded a "crack" from eMule and it installed this file 'smss.exe' to '\windows\system' folder instead of '\windows\system32', where the MS certified original 'ssms.exe' is located. It also created an entry in registry at HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. Just delete the entry and the file and everything is Ok. Carlos | |
| Windows Session manager. Unfortunately, as of 6/15/2006, PcMag is advising users to delete it....even/especially in system32 folder. setirich | |
| It is usually part of the operating system but sometimes it might be a trojan. vinod | |
| May or may not be a virus, it depends if it has been attacked or not. Ryan | |
| the same like smss.exe but in c:\windows\system folder not in the c:\windows\system32, where you can find the real smss.exe, signed by MS Lanfeust | |
| McAfee Antivirus scanned it as virus Aditya | |
| its a normal system file but it can have the same as a virus but remember viruses often try to change the name like with a SMSS or SmSS or smsse or semmss things that have the same name or that have a similar name so be careful always check for duplicated files and see which one is running from where sawalha | |
| Just read the note about this file above. If it is not in the c:\Windiws\System32 folder, it is a trojan. Go to safe mode, and simply delete it. magesh babu | |
| I finally got it - used Free WinPatrol program at Download.com | |
| If located in C:\WINDOWS\system32 its perfectly fine. dont touch it P e t e r | |
| smss located in windows system file causes norton auto protect to shut down I removed it works fine looker | |
| If it's in Windows/System32/dllcache and also in Windows/System32, and 45k, it's the Microsoft file. If you find it in C:\Windows, and it's a lot smaller, KILL IT. Grant | |
| just ordinary windows process that cause no problem goodeye | |
| If running from system32 as user 'SYSTEM' then most likely ok. If you see a second instance of this running as the current user and it is located somewhere else, it is a virus. Eric | |
| There's a worm on the net, disguised as a Corel X3 keygen (~26 kB) , that installs itself in C:\Windows\System as smss.exe. It is a mass-sending spam messages. Avast can't detect is as threat yet, but is able to detect the abnormal e-mail activity. Other symptoms are the presence of files named domains.txt, fnames.txt and lnames.txt (and/or files with these names and .cab extension)in your Local Configurations\Temp folder. cesar | |
| When located in the WINDOWS folder both csrss.exe and smss.exe are viruses. The real versions are located in windows/system32 cal | |
| smss.exe is not a risk. if it has another name, like SMSS.exe, it could be a virus! Silverstar | |
| Hmm, every time i try to delete it, it dosen't delete, instead it says "Cannot delete smss: It is being used by another person or program. Close any programs that might being useing the file and try again." Adamisk | |
| I've got infected smss.exe and it tries to do download some sh.t from web nickson | |
| It appeared in my system after downloading a file from a dubious source. From that point I noticed some other strange things happening (setup.exe appearing in root of shares). This caused me to start investigating. In event log, I noticed that the Security Centre had started getting turned off along with Windows Firewall. This started after a certain date. I then searched for files created on that date and found smss.exe in Windows\system. I am 100% sure this instance is a virus! smss cracker | |
| I found one copy in my windows\ system 48K and one in windows\system32 50K. i deleted the first one. Actually the antivir guard didn't pick it up but i ran a full scan tonight and found it. only the file in windows\system was reported as a trojan so only the one in system32 is legit Will | |
| it is possible the file c:\windows\system32\smss.exe can get corrupted: i had that problem with csrss.exe once (also in sys32 folder) Ninja | |
| Keeping_it_cool, you need to calm down... Like your name... If it's eating up mem like mad, it is bad. But yes, windows does have a required smss.exe file... Solve your problems by switching to Linux!!! Dave | |
| Microsoft Defender and msconfig identify it as unkown file and when I removed the file Backdoor Trojan EOD, which was being reported repeatedly in temp folder by AVG 7 stopped and in Temp folder no longer there appears an application which tries to access internet as reported by Mcaffe Antivirus on the network computer of mine P C Bhandari | |
| Session Manager Subsystem, a application that is used to start, manage, and delete user sessions or client sessions under "Terminal Server". This is NOT a security risk retards!!! Leave it alone.~~~ Rico S suav'e | |
| open up start menu, search smss.exe, if located in windows/system32 you are good to go. asdf | |
| Lanfeust--" the same like smss.exe but in c:\windows\system folder not in the c:\windows\system32, where you can find the real smss.exe, signed by MS" --+-- mine is, its the only one existing on my comp., everything runs great Enlightened Fool | |
| AVG picked it up, 3 of them they also were gave the name Trojan flooder. AKE located in windows/system32 winlogon.exe I run it in safe mode and then scanned, I then deleted the two files and not the one in sys32 but my computer won't load up and says 'Terminal error, fatal exception' and just gives an error code... Aaron | |
| Search for smss in the windows search (Start Seacrch) and if it appears in windows/system32 its fine. If it is not in that file then something else is going on and it should be deleted - ie virus/trojan Ben | |
| Um, it seems relatively fine, but I find two processes by the same name, one run by SYSTEM and one run by me on my computer. I wonder if either of these is a virus... See also: Link Prateem | |
| csrss &smss are sys files, but can get hijacked! bert | |
| if its in it its normal place /system32 then its safe , but if it in windows then you are in big issues | |
| smss.exe is a process which is a part of the Microsoft Windows Operating System. It is called the Session Manager Subsystem and is responsible for handling sessions on your system. This program is important for the stable and secure running of your computer and should not be terminated. dumbasses... Bizzizle | |
| May be PWS.MARAN trojan (ouviewer.dll). See McAfee link for details. See also: Link Dan | |
| it will lock date of the system at calender. upto a particular year ie 1980-2099. it will not go beyond this limit. Arpit Pandya | |
| Slows down my pc big time. Especially noticable when playing online games like Counter Strike. ArslanHamid | |
| My PC (XP with SP2) has smss.exe located at both: Windows\System32\ ,and Windows\System32\dllcache\ . Both are signed by Microsoft, are same 49.5K size, and both have the same install date. I suspect that both are legimate, but why would there be TWO installed smss.exe ? Juan Pablo | |
| smss.exe is a process which is a part of the Microsoft Windows Operating System. It is called the Session Manager Subsystem and is responsible for handling sessions on your system. This program is important for the stable and secure running of your computer and should not be terminated Brian | |
| smss is more accurately the Session Manager SubSystem and is very important in booting a Windows computer. It is the first process started after booting See also: Link FMasic | |
| ok if in windows\system32. AMS | |
| It doesn't allow me to access the TaskManager, secondly when I try do delete it from a non system's folder it keeps on reappearing. It doesn't allow me to install any spyware/antivirus. When I try to do it the system restart's. What is the solution for this. Roshan | |
| Somehow my computer contracted the Trojan. QHorse virus last night. All research suggests that I visited an infected site. Shortly after that my smss.exe file tried to connect and b/c Norton said it was a low threat, I clicked okay. Now I'm having a heck of a time trying to clear this up. Virus alerts keep popping up even though the system scan was clear. Any ideas?. Georganne | |
| erm, i got three versions, 1 50kb, 2 45 kb.... 1 is in windows/system32, one is in winnt/system32 and the last one is in winnt/servicepackfiles/1386 | |
| Finally I managed to delete the infected smss.exe file located at C:\WINDOWS\system\....it's not an easy task. First I tried using Hijack this to delete the file on reboot, but it failed. So I went to the registry editor and deleted every entry pointing towards the smss file under the system folder. Then I turned off System Restore. Then restarted in safe mode and deleted all files in the C:\Documents and Settings\My name\Local Settings\Temp folder and the smss file in the system folder. At last rebooted, and the file was gone :) CNSZU | |
| i looked into the afore mentioned program and after looking on a few forums decided to not allow it. zone alarm is the best for detecting those dodgy intruders. lokey69666 | |
| My windows XP installation has the following surplas example, which is safe, and comes from the installation process: "C:\i386\SYSTEM32\SMSS.EXE" being size 470016 and is date-time stamped: 04/08/2004 06:00 Peter Lee | |
| This file connects to an ip, than a program which can control this trojan. It lists all pc vertical and you can chose aynone for what do yo want See also: Link Cagdas | |
| Si no esta en el directorio win32, y esta en C:/windows, es un virus; me tranco el pc pero logre activar el Norton CD luego use un noadware, que me indico adonde estaba, lo borre, y listo. El verdadero esta en win32. Alfred Juillet | |
| As stated above, this is a Windows system file known as Session Manager SubSystem or "Microsoft Windows NT Session Manager" as its display name. The file ships with the operating system, and again, is simply the application that manages user and client sessions on your Windows XP PC. Viruses and malware can always disguise themselves as other files and programs, even with the same display/file name, and windows system files such as this are commonly immitated in this manner. If you find a file of this name in anywhere other than the "windows/system32" folder, it is in all likelyhood malware. Moosa | |
| It was not in the system 32 and totally shocked my CPU, i was not able to refresh my virus scanner or use the internet. Then I deleted it in safe mode and everything is okay now. Hijackthis helped me to solve the matter. See also: Link Genie | |
| Trend Micro recently picked up this as a generic trojan, and i attempted to delete. the location of the infected file was in Windows/system32. Also DEP (Data Execution Prevention) keeps closing this program. DEP is telling me that it is ending a critical process, because the file is in windows/system32. Can anyone Help me? the smss.exe is only using 52k or memory so that makes me believe that it is not a trojan. Anyone able to help? Fraser | |
| smss.exe is harmless, watch out for **ssms.exe** for this is a wormy virus See also: Link Bennett | |
| When ONLY in C:\Windows\System32\smss.exe it is OK. Session Manager Subsystem. It will launch winlogon.exe (and csrss.exe) to start user sessions as SYSTEM user in your task manager processes window. It sttempts to load and access the internet using lsass.exe from your local IP assigned address to a remote server IP address (like 172.16.101.4 :389) using UDP (outbound) protocol. This is NORMAL. What is causing the difference of opinion above, are the cases where a virus/trojan has installed itself in c:\windows\system directory and renamed itself to smss.exe, smse.exe, smce.exe, etc, Michael | |
| use trojan remover 6.6.3 download it from the net manny | |
| This is an important process to keep running, without it your system will be unstable. Although there is the minute chance thast it could be malicious (aka virus, tojan, ect.). Do what asdf said, if it is system32 folder it is the correct file. If however it is in another location, you might have problems. See also: Link Ctullu | |
| if you found this file in C:\ or D:\ or in C:\windows\ folder, this is virus. Try also to search the killer. exe. And Also the autorun.inf on a given folder. Try to open the the autorun.inf with notepad. If you will found the smss inside the autorun.inf, then the autorun.inf makes the smss.exe virus to run everytime you open the mentioned drive and or directory rexzel0230 | |
| I need help, its in C:\Program Files\MSMS\smss.exe and its got stuff like win32process.pyd. I have a smss.exe in my windows\system32 file so i;m not sure. Please post a reply on this site In Need of Help | |
| I've been using smss.exe with SP1 for many years now, with no adverse effects! Oh yea, I know there's no updtds for SP1 now. However I still use it with a router and turned auto updtds off ever since SP1 stopped support. And guess what no problems!!! Don't over kill as many above who has all that extra time to dream! MC | |
| windows system file related to the "Secundary session service". If you need to run processes/apps with different user name with strong secuirty else you should disable the service in services.msc. it's located in \%windir%\system32 and ..\dllcache. if is in other location is a VIRUS/TROJAN Nowar | |
| Company: N/A Product: KillSec Threat: Spyware Description It installs a service and creates autorun entries which run automatically on every system startup. It collects passwords and usernames of banking pages ad send it periodically to a server. It contatcs http://85.249.22.240. It downloads additional data from that server. The original file is deleted after execution but creates a copy in the profile folder of the current user. Also it deletes the files of the internet explorer cache. It hides its own files an registry keys. It infects the exporer.exe but after restart explorer.exe is fi yomi | |
| ssms.exe that can be found in c:\windows\system32 folder is virus or spyware.coz,if you want to find this file to the said folder using explorer it will go back to the desktop.and if you want to uncheck thru starup using msconfig the dialogue box will disappear,or if you want to disable it using SAFEMODE you cant do anything.So in my opinion the original ssms.exe file that supporting in booting the computer was changed this file was sabutage your windows file and some program dont run and execute carefully because of this file and how to delete this without damaging the windows system kitnanamet | |
| It is not dangerous but it does not allow to open the Folder Option and Command prompt. wkhan | |
| it activates automatically and start blinking. when we try to open the task manager to stop the service then it automatically disappears. so we can not stop the service. we can not open the command prompt. also we can install the AntiViruses. wkhan | |
| smss.exe is transferred and is hidden in my flash disk.. Its a virus.. When I open task manager and other programs, it is minimized. earLX | |
| I hav been infected by smss.exe virus twice and to get rid of it, I have to format the whole disk. It appears in my task manager with a username and also as a system file. when i opens task manager, its a matter of few seconds that it minimizes. It closes the window from wherever i accessed it. I tried msconfig, regedit n even when I tried to remove it online, it also closed that. It's a hell. SID | |
| Its part of widowsXP, I have 2 friends that work for microsoft!!! its part of your system 32 file!!! jooboo | |
| well my computer was infected by smss.exe and its has its buddy the killer.exe i use a kill box to stop its process its located in C:\windows\smss.exe, C:\windows\killer.exe and it infect my other partition D:\smss.exe after that i use a flash disinfector to To fix the error associated with that file i deleted | |
| disables task manager, reloads itself when crtl+alt+del, created some other copies around. found it under net meeting. doesn't have a proper pulisher, but yeah.net... CBB | |
| It shows up as a nero image file and is hidden adn accompanied bu other files too . You may delete it as many times as u want but it shows up again with all the accompanying files. It also doesn't let you chose"show hidden files" from the folder options(no matter how many times u select it, it'll always be deselected the next time u open folder options). Also, it closes the task manager automatically when it is one of the processes. Nishant Sharma | |
| Note that in corporate networks, this file may be located in windows\system32 on the users home drive, eg h:\ dallas | |
| warning men! smss.exe virus always produce other FunnyScandal.avi.exe. Slowing down your comp? thats right, it happens in my mate's comps. smss.exe uses standard defoult .exe icon, but the virus i found using diffrent somewhat like other application icon. I usually found the virus version inside the first dir of drive, but the functional one is in the WINDOW/system32 folder. Don't screw up unless you know what youre doing with WINDOWS things Alph Vick Kyuz | |
| It is damn smart that if your check for anything with .exe on google it shuts down your pc. Mantar | |
| GEFLÖ-TÖLDFILUFDJCFVHDFJKHJMBHNV VXUJIULVCBCVMVGGVBFCUDFGMFGDN | |
| This is also the name of the SQL Server Management Studio exe. It would normally live in \Program Files\Microsoft SQL Server\{90 100}\Tools\Binn\VSShell\Common7\IDE Michael Tillett | |
| This process is NORMALLY AN ESSENTIAL WINDOWS COMPONENT, but occasionally malicious software will masquerade as smss.exe. If you only have one copy of it running then chances are it's OK (and shouldn't be removed as it's an essential component of Windows), but if you have two copies one may be malicious. If it's not running in windows\system32 then it may be malicious (download Process Explorer if you're not sure where the file is running from - see link for further details). Any good virus checker should tell you if it's a virus. See also: Link Saskia | |
| Most people have no idea this is one of the core processes of Windows: The Session Manager Subsystem, responsible for creating environment variables, paging files, the winlogon manager; starts all other various subsystems. Located in %SystemRoot%\system32\ martix | |
| It IS NOT A VIRUS!! if in properties of file writed :MicroSoft. any were else it is virus!: See also: Link JiRaFFFFFFFFFFFFFFFFFFF | |
| when i instale new win xp and some therd pharty it was instal and i see in tskmanager but avg connot fin it mcse 2000 microsoft | |
| A while ago my computer started shutting down as soon as i logged onto an account and since them i've been cruising through my computer researching every virus i can find this showed up in C:\I386 I'm not sure what it was for though so just something to think about it came up in all capital letters SMSS.EX_ Miles | |
| Keeps on resetting explorer.exe- the taskbar which has every thing. I'm trying to find a solution to it because i don't want to formart my pc. Abdusamed | |
| it is file in windows but! there is a replase version of smss it is a VIRUS salam | |
| Check the task manager and if 2 smss.exe running u have problems, i had the windows smss.exe and one in windows\32\apple\smss.exe (virus) Ran VGA to stop it and its many downloads then deleted file, it also had a ke logger associated with it, so look for a key file in windows32 open the key file with txt document to see all the key strokes it has captured :(( Infected by smss | |
| This file is usually ~92k os system memory usage, if more it is a trojan, also have detected it can be seen as SMSS.exe using over 1000k memory. combined with csmss.exe and msmsg.exe can overload processor withour showing on task manager. remove windows messenger from windows components, then kill app and won't show agian. Removal is not yet avaliable but infection can be controlled, since this won't infect other apps or programs ChillFactor | |
| well yea it is a system file as well it is a new malware that goes around on USB drives to infect computers and slow them down completely vapula | |
| when you connect a device from the usb port everything gets into the problem . none of the programs will respond anymore . unless you remove the device you had already connected to your computer hasan | |
| The version I have is the 'SQL Server Management Studio'. The process is written Ssms.exe. MSSQL 2008. A path may look like C:\Programme\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\Ssms.exe Taku | |
| smss.exe is sometimes a virus like on my PC. Located in C:\Program Files\smss\smss.exe (Windows Vista Home 32bit (86x)) SIZE in my PC is 120Kb CAN NOT JUST REMOVE!!! antivirus is flashing, but i will kill him now , safemode Davidhopar | |
| Windows service, some AV software suspects on SMSS.EXE, meaning on mailcious soft with similar name like SMS.exe,SSMS.exe or SMMS.exe which is variants of an malicious soft Zocky Digital Tech & Art-Veles,Macedonia | |
| Not much other then for VISTA USERS you well have random duplicates of these .exe files on purpose and all should be in system 32 but 1/2 well be nicely *scattered* around in your X86 M$ ect.. Folders which r in Windows/winsxs, thnx to M$'s idea of not unifying the .exes ( I found 4 on mine, 2 have size variations but in different folders) no threat found yet. Motoko | |
| this process is running in my PC. It slow down your PC. Must Remove. The other viruses are installed with this like regsvr.exe, csrss.exe etc. They dont touch your OS.. but they make system slow.... Omkar | |
| i do have smss.exe virus from a rogue flashstick in "c:\windows\system32 " - yes there is a space. it blocked blocked my AV and gave itself auto permit with windows defender so it took some time for me to work out that i had it.i killed the processes and unplugged my internet hoping to restart my comp to get my AV back, scan and get rid of it. which then leads me to my current problem. i am unable to login to my desktop, 2seconds after my comps tries to boot up to the desktop it logs out to the user login page. i have tried all f8 - safe mode options and for each one it still logs me out -.- trent | |
| use spyhunter to clean amir | |
| Well I realised by now that this is a windows component, however it seems versions of this file are used for malice. I just wanted to note that another version of this may come with an SP(3) update, but should not alarm you in that case. Ariel | |
| some kind of virus with the same name with smss. .my friend computer are infected by this virus and usually it take a long time to make the computer system slower. Einstain | |
| safe if it is in your system folder, dangerous if it is found somewhere else Yohyohyoh | |
| Reported as Vundo.JE trojan by AVG, redirect browser results and slow down PC Denied | |
| smss.exe (Flood.F Trojan) - Details If a process named smss.exe is running on your computer, you may have been infected with a strain of the Flood.F trojan. smss.exe is considered to be a security risk, not only because antivirus programs flag Flood.F Trojan as a trojan, but also because other sites consider it a Trojan as well. Flood.F Trojan is likely a Trojan and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of smss.exe may cause serious harm to your system and will likely cause a number of problems, loss of data, loss of control M Ali | |
| (S)ession (M)anager (S)ubsy(s)tem(.exe), or smss.exe is a component of the Microsoft Windows NT operating system and successor operating systems. It is executed during the startup process of Windows NT, Windows 2000, XP, Server 2003 and Vista. See also: Link BeNiceOnTheNet | |
| %windir%\System32\smss.exe is a vital windows component. Don't delete it. Just check "command line" box in what columns to see in task manager and its clearly visible what is running and from where. Dont give ppl advice to delete stuff if you have no clue what you'r on about. The Swede. | |
| Many antiviruses couldn't clean any infections that do infect this file Hossam | |
| If it's located in the "C:\WINDOWS\Fonts" directory, then it's a virus, it could cause booting problems, destroying other programs in your OS, could also cause glitches in hardwares. Only seen it about a year ago (2009), usually only get this virus if the user is an novice & don't know how to delete the temp files after surfing the net. Reinstalling the OS couldn't rid the virus, I think one need to reformat the HDD before reinstalling the OS to fix it. Billidiot shit Gates Microft OS | |
| Critical system file Andrew | |
| Normally, this file is not a virus and is a vital system process when starting up your PC. On the other hand, there is a virus with the same name that attaches itself to all of your execution processes and eventually does damage as time goes on. Use the task manager provided on this page to see if you have the virus. The icon will be a purple octopus like figure (it gives me nightmares.) Make sure you put your computer in safe mode before you quarantine it, not doing so may result in a failed quarantine. The truth | |
| That's Windows system file See also: Link Podić Elvir | |
| smss.exe Is A File Copied To C:\Windows\System32 After A Fresh Installation Of Windows And It's Harmless. If smss.exe Is Detected Elsewhere, Then It Becomes Suspicious And Should Be Removed. Tony | |
| SSMS - SQL Server Management Studio NozzNazz | |
| Kaspesrsky 2011 say it's dangerous but it's used by Logmein.com to remote access my computer. K | |
| This is the session manager subsystem, which is responsible for starting the user session. This process is initiated by the system thread and is responsible for various activities, including launching the Winlogon and Win32 (Csrss.exe) processes and setting system variables. After it has launched these processes, it waits for either Winlogon or Csrss to end. If this happens "normally," the system shuts down; if it happens unexpectedly, Smss.exe causes the system to stop responding (hang). it is a valid windows process See also: Link Dave Berry | |
| "high" criticality, detected by my Kaspersky AV 2011. wrektime | |
| Smss.exe is the Windows Session Manager SubSystem in Windows 2000/XP/2003/Vista/7.Smss.exe is responsible for handling user sessions on your system by starting the system thread and other critical tasks. The smss.exe process is responsible for launching winlogon.exe and csrss.exe processes, and setting system variables. After winlogon.exe and csrss.exe have been launched, smss.exe waits until they end. If there are no errors, the system shuts down normally. However, if Winlogon or Csrss end unexpectedly, the smss.exe process makes the system hang and stop responding. See also: Link Andrew Davis | |
| the windows recovery console has a copy in c:\cmdcons\system32\ this is normal if you have the recovery console installed ~Grim | |
| It's not a virus. but can be infected by some trojans. Mametov Alexander | |
| it CAN be a virus, just check if there is just ONE smss.exe in your process list, if more: VIRUS ALERT! :) | |
| If it's smss.exe then safe if SMSS.exe/EXE then check it out without an internet conection. If it slows your pc down change to windows classic theme Eivis | |
| smss.exe is safe, it comes when you install windows... nothing to worry about. ;-) jex da pogi | |
| It is safe. Your computer needs it! Big Balls | |
| It is MS SQL server management studio Dinhdq | |
| It's safe! It's a normal Windows file at all. It really makes your PC slower but it's safe :-}. Alexandar Vitkov | |
| smss.exe can be infected become a virus like crss.exe RommoR | |
| this is running in processes and located in systemroot\system32\smss.exe but when i try to use the link the advanced system care IObit process manager provides I get the cannot find message. Am going to have to go delving in places I'd rather not delve into just to ascertain whether I have more than one version of this file Although ASC does tell me that the smss.exe file that is running in processes is not signed by microsoft which makes me more than suspicious that it is the cause of my antivirus being unable to complete any quick or full scans, instead the entire system closes down in an instant! However when I scan every part of my c;\ drive seperately I can complete the individual scans but nothing is picked up. I shall report back if I have any measure of success and thanks for all the input folks. Dean | |
| smss.exe is a process which is a part of the Microsoft Windows Operating System. It is called the Session Manager Subsystem and is responsible for handling sessions on your system. This program is important for the stable and secure running of your computer and should not be terminated. virus | |
| Not dangerous, its an important file. | |
| Its safe :) Windows process :D QuaSter | |
| If you're running x64 windows it will show as smss.exe*32 in the task manager and thats a virus the system process Does not have the *32 and btw you can open the file location if it leads to anywhere but the system32 file it's a virus Salvatore | |
| It's System File and also someone used its name for virus. Look its properties by clicking right properties. If it signed by Microsoft it isn't a virus. But if it isn't signed by Microsoft, it is a virus | |
| Came up dangerous for "Dr web" with a occasional message that takes a few clicks to, rid off.I have located the file, scan it, and "no threats detected" Adam | |
| Only shows up in Security Manager as a pop up only, not on list. On pop up, system freeze, unable to obtain add'l info. This happened 3 times, you know it's not good. Plus on my pop up it states si in the top upper portion of the pop up for smss.exe. Sharon | |
| When closing this, it gave me the warning that if I ended this process, my OS would shut down (Win7). After scanning it with 3 Antivirus, it seems safe Devcon | |
Show All
More process information
Is smss.exe spyware or a virus, trojans, adware or worm? Is there a known smss.exe error?
- Search for spyware
- MalwareBytes (spyware removal)
Other Processes
kernel32.dll logonui.exe mobsync.exe penservice.exe smss.exe svchost.exe system taskeng.exe thumbs.db winlogon.exe winmgmt.exe wmiexe.exe wmiprvse.exe wpcumi.exe wscntfy.exe wuauclt.exe
[smss.exe in German] [all processes]