Sometimes smss.exe and other system errors EXE errors may be related to problems in the Windows registry. Several programs can share the same smss.exe file, but when these programs are uninstalled or changed, sometimes orphaned (invalid) EXE registry entries are left behind.
Basically, this means that while the actual path to the file may have changed, its incorrect former location is still recorded in the Windows registry. When Windows tries looking up these incorrect file references (file locations on your PC), smss.exe errors can occur. In addition, malware infection may have corrupted the registry entries associated with MSDN 2939. Thus, these invalid EXE registry entries need to be repaired to fix the root of the problem.
Manually editing the Windows registry to remove invalid smss.exe keys is not recommended unless you are PC service professional. Errors made while editing the registry can cause your PC to malfunction and cause irreparable damage to your operating system. In fact, even a single comma in the wrong place can prevent your computer from booting!
Because of this risk, we highly recommend using a trusted registry cleaner such as %% product %% (Developed by Microsoft Gold Certified Partner) to scan and repair any smss.exe-related registry problems. Using a registry cleaner automates the process of finding invalid registry entries, missing file references (like the one causing your smss.exe error), and broken links within the registry. Before each scan, a backup copy that allows you to undo any changes with one click and protects you from possible damage to your computer. The best part is that fixing registry errors can dramatically improve system speed and performance.
A warning: If you are not experienced user PC, we do NOT recommend editing the Windows registry manually. Incorrect use Registry Editor can cause serious problems and require reinstall Windows... We do not guarantee that problems resulting from improper use of Registry Editor can be fixed. Your use of the Registry Editor is at your own risk.
To manually repair your Windows registry, first you need to create a backup by exporting a portion of the registry related to smss.exe (eg.MSDN 2939):
- Click on the button Begin.
- Enter " command" v search bar ... DO NOT PRESS YET ENTER!
- Holding the keys CTRL-Shift on the keyboard, press ENTER.
- A dialog box for access will be displayed.
- Click on Yes.
- The black box opens with a blinking cursor.
- Enter " regedit" and press ENTER.
- In the Registry Editor, select the smss.exe-related key (eg.MSDN 2939) you want to back up.
- On the menu File choose Export.
- In the list Save to select the folder where you want to save the MSDN 2939 backup key.
- In field File name enter a name for your backup file, such as "MSDN 2939 Backup".
- Make sure in the box Export range value selected Selected branch.
- Click on Save.
- The file will be saved with the extension .reg.
- You now have a backup of your smss.exe-related registry entry.
The next steps for manually editing the registry will not be described in this article, as they can most likely damage your system. If you would like more information on manually editing the registry, please see the links below.
Among the many processes that users of different versions of Windows OS can observe in the "Task Manager", SMSS.EXE is constantly present. We will find out what he is responsible for, and determine the nuances of his work.
To display SMSS.EXE in "Task Manager", required in its tab "Processes" click the button "Show processes of all users"... This situation is due to the fact that given element is not included in the core of the system, but, despite this, it is constantly running.
So, after you clicked on the above button, the name will appear among the list items "SMSS.EXE"... Some users are worried about the question: is it a virus? Let's define what this process does and how safe it is.
Functions
It must be said right away that the real SMSS.EXE process is not only completely safe, but without it even a computer cannot work. Its name is an abbreviation of the English expression “Session Manager Subsystem Service”, which can be translated into Russian as “Session Management Subsystem”. But this component it is customary to call it easier - Windows Session Manager.
As mentioned above, SMSS.EXE is not included in the kernel of the system, but, nevertheless, it is a vital element for it. When the system starts, it launches such important processes as ( Client / Server Execution Process) and ( "Login program"). That is, we can say that when the computer starts, it is the object we are studying in this article that starts one of the first and activates other important elements, without which the operating system will not work.
After completing its immediate task of launching CSRSS and WINLOGON Session Manager although it functions, it is in a passive state. If you look at "Task Manager" then we will see that this process consumes very few resources. However, if it is forced to terminate, the system will crash.
In addition to the main task described above, SMSS.EXE is responsible for launching the system scan utility disk CHKDSK, the initialization of environment variables, the production of operations for copying, moving and deleting files, as well as loading the Known DLL libraries, without which the system is also impossible.
File location
Let's determine where the SMSS.EXE file is located, which initiates the process of the same name.
Virus
As we said, the SMSS.EXE process is not viral. But, at the same time, malware can also disguise itself as it. Among the main signs of the virus are the following:
The first three points are a direct indication that SMSS.EXE is fake. The latter is only an indirect confirmation, since sometimes a process can consume a lot of resources, not because it is viral, but because of any system failures.
So what to do if you find one or more of the above signs of viral activity?
So, we found out that SMSS.EXE is an important process that is responsible for starting operating system and a number of other tasks. At the same time, sometimes under the guise of this file a viral threat may also be lurking.
Microsoft Windows 10 and more early versions... It is called the Session Manager - a subsystem of the session manager and is responsible for sessions on the system. Its launch is important for the stable and safe functioning of the computer and should not stop.
Features of the smss.exe process.
What does smss.exe do
The smss.exe process is a component of Microsoft Windows. It runs at boot time and handles many tasks including creating an environment variable, starting kernel and user modes, creating DOS sync for various devices, create swap files in virtual memory and start login to Windows system... When completed, these tasks are idle and may appear as active in the Task Manager. It requires other system processes, otherwise the system will be shut down.
Why smss.exe loads the processor heavily
Errors are often caused by conflicting user profiles or installation files, misuse or related directories, or a malicious attack on the system. When conflicts arise in a profile or with a file, the application may not transfer data between the required files. In you can see that smss.exe is loading the processor. At misuse or a damaged file or application directory as a whole may not be able to start. Malicious attacks or viruses infecting the computer with the smss.exe process can render the entire system frozen or unable to perform any necessary computing functions. Regardless of the reason, upon detection system errors computer definition better solution should be the first step.
Remove smss.exe virus
In most cases, the smss.exe session manager control manager is considered safe. However, such programs sometimes become infected, and some malware is disguised and identified as known safe system files. When this happens, they can be very difficult to detect, but using extensive scanning, they are usually found and safely removed almost immediately. General messages errors that users may see include:
- File not found;
- The file cannot be found;
- The device was not recognized as a missing file.
Since the manager is associated with USB connections to a computer, keyboard, mouse, or other hardware connected via a USB cable, it may not work properly due to an error. If you have no experience in managing tasks on a computer, it is best to let the system scanner or registry scanner handle them. Many tasks are necessary to perform certain operations, and deleting them can lead to a crash, restart of the program or the entire computer. How to remove smss.exe virus in Windows 10? Run the built-in antivirus. To do this, click Start, type "Virus & threat protection" and press Enter. In the window that opens, click the "Check now" button and wait for the operation to complete. If malware is detected, follow the instructions of the wizard - you will need to clean the system of unnecessary software and viruses.
The only time the system is loaded is when an application update comes from the software manufacturer. Be very careful when downloading from third-party sites, as they may contain additional software installed without the user's consent, which can cause an even bigger problem than the error you receive as a result of a missing or incorrect utility! When these errors appear, check if any new hardware or software has been added. If so, simply uninstalling new hardware or software can fix the problem. If not, follow these steps:
- Scan for any driver updates for new hardware. If new hardware or programs have been downloaded, they may require updated drivers. Download new, protected drivers and restart your PC.
- Download and install updates. Regardless Windows versions you are using, it is always recommended to install the latest security updates.
- Use antivirus apps.
Most antivirus scanners will protect your computer from major threats. For increased protection, use the built-in Windows scanner malware... If the above steps fail to fix the problem, the cause might be outdated hardware or software... If the processes do not recognize winlogon.exe or csrss.exe, the computer will not be able to boot. If any of the processes stops unexpectedly, the computer shuts down, crashes, or restarts. If you notice such errors, it is highly recommended that you fix the problem as quickly as possible. Since this process is vital to Windows boot errors can damage the startup involved system files... Therefore, the use of antivirus software is mandatory!
Answers:
Alexey:
These are system processes. Not viruses.
TU-154:
These are all system processes. Go to Service Management (Start - Run - services.msc) and look at the service executable files in the service properties. Get an immediate answer to your question.
Basil:
These are all system services that are required to run. To find out what it is, just look at the file properties: smss.exe - Windows NT Session Manager; lass.exe - LSA Shell; csrss.exe - Client Server Runtime Process. In order not to rack your brains in the future whether it is a virus or a useful file, install antivirus and antispyware. Which is not important, it is important to update the databases in a timely manner.
Mikev:
The processes are systemic, but any viruses can use them to run.
Vitaly:
A virus appeared that "mows" under the system. module Writes to C: \ Windows \ smss.exe See properties. Delete. Also from the registry (with the specified path - not to be confused with a normal exe).
Inna:
I had it. It turned out to be a virus.
Du:
During installation, the backdoor creates a randomly named folder in the Windows system directory and copies itself to this folder with the name csrss.exe. For example:% System% \ drtusi \ csrss.exe Also in this folder the backdoor creates the following files:% System% \ drtusi \ csrss.dat% System% \ drtusi \ csrss.ini Then the original executable file is deleted. The backdoor creates a link to itself in the startup directory:% UserProfile% \ Start Menu \ Programs \ Startup \ csrss.lnk Then registers itself in the startup keys of the system registry: "csrss" = "" Adds the following entries to system registry: "Load" = "% System% \ \ csrss.exe" "Run" = "% System% \ \ csrss.exe" B Windows case The 95/98 / ME backdoor modifies the win.ini file by adding the following lines to it: load =% System% \ \ csrss.exe run =% System% \ \ csrss.exe Also, the backdoor adds the following entries to the system registry: "Hidden" = "2" "SuperHidden" = "0" "ShowSuperHidden" = "0" "DisableRegistryTools" = "1" "NoAdminPage" = "1" Actions: The program connects to various IRC servers and receives commands remote control from the "master". The range of available commands is very diverse and allows you to exercise full control over the system, as well as attack other computers, download files, etc. In addition, the backdoor has the following functionality: at the command of an attacker, it spreads a link via MSN Messenger channels urging users to download a copy of this backdoor; while the link looks very safe: http://www.vbulettin.com/, - very similar to the address of the authoritative journal of the antivirus industry Virus Bulletin, and may cause confusion among users; downloading and launching various files on the infected computer; deleting files; stopping various active processes; restarting the computer; DoS attacks; Sending detailed information about the system to the attacker, including passwords and other secret information entered from the keyboard; execution of various commands on the infected computer; uploading your updates; other things.
Loki:
csrss.exe-virus-worm. It spreads over the Internet in the form of files attached to infected messages. The worm is Windows application(A PE EXE file), about 6K in size (packed using UPX, the unpacked file is about 15K in size), written in Visual basic... The worm activates only if the user launches the infected file himself (by double-clicking on the attachment). Note: the actual .EXE file name in the attachment is hidden by the "fake" .JPG name using additional opportunities MS Outlook. Thus, an infected EXE attachment looks like a .JPG file in the message, but when this attachment is opened, it is processed as an EXE file. Attachments of this kind are automatically blocked by default by MS Outlook 97 SP2 and higher. Then the worm installs itself into the system and starts its propagation procedures. Installation. During installation, the worm copies itself with the name "csrss.EXE" to the Windows system directory and registers this file in the auto-start key of the system registry: HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Run SystemSARS32 =% WindowsDir% \ csrss.EXE Mailing ... When sending infected messages, the worm connects to MS Outlook and sends itself to all addresses found in the address book. Infected messages contain: Subject: Alert! SARS Is being Spread! Text: Hi !, This is a beta test SARS. Please check an attachment!
Charmer:
It is possible that these are systemic processes. But as already mentioned above, viri are mowed under them. I just had one of these, so I'm not 100% sure that your processes are normal.
Sprite8:
And how to cure it, remove it? I have an antivirus, it does not see csrss.exe. What to do?
Serega:
Just ran into this worm. How I picked it up - I don't know. The suspicion arose when I accidentally looked into the history of those blocked in OutpostFirewall. scrss.exe tries to send something to h00k.info every 2 minutes. Included in the search and found two such files, one in the root of windows, the other in system32. The one in C: \\ windows does not belong to microsoft. I turned it off from startup and tried to rename it. Ended up with a blue screen. After rebooting, it disappeared. Everything is in order in the outpost magazine, except - an inaccessible process sends IGMP to the address 224.0.0.22 I do not know if this is somehow connected ... By the way, this is not the first time that Avast antivirus software has failed me! He does not see new viruses! And for the sake of interest, I typed the address h00k.info in the browser there is a very nice rhyme and nothing else. Hosted on paid hosting tosay.ru.
Michael:
csrss.exe - this vir was deleted by me via DOS. After his presence on my computer - my sites (I speculate in hosting) - some of them acquired a code in the body of the page that drove my traffic to the url ttp: //traff.step57.info.
Petro:
I immediately realized that the virus was killing the process, but it cuts in again, killed three.exe in the C: \\ WINDOWS folder, but again it appears soon. Well, let's fight, the question is how?
Red_Lion:
I just found a way to \ "cure \" such good smss.exe. The point is that there is an empty file in autoloading, which does not explicitly show what it is launching, and is overwritten each time it starts. Everything was decided simply - msconfig and cut it off and the application with the name starting with the letter b and a random set of numbers \\ letters (clearly visible, because it has no semantic meaning).
Andrey:
I came across two questionable processes: csrss.exe and lsass.exe. The task manager shows that csrss.exe continuously reads information, and lsass continuously writes and reads. Should healthy processes do this continuously? If not, how to get rid of virae?
Max:
Damn, I felt with my spinal cord that it must be an infection! Only now I did not understand how to recognize - is it a process or a horse? Who will tell me - I will be very grateful. By the way, Avast! It doesn't find anything and the firewall keeps noticing that svhost wants to connect to something - that's also a problem - I don't know if it's okay or not? Drop me at least a couple of lines who knows how to distinguish an smss process or a virus - I will be very grateful.
Desperado:
I was alarmed that the csrss command required a disk and the task manager was disabled. I did this (maybe my experience will help someone): using the RegCleaner program and using the command to execute - msconfig deleted from startup all files that aroused suspicion (usually with a meaningless set of characters instead of a name), then with latest update I cleaned the antivirus (I have NOD32) of virae, then installed an anti-Trojan (Ad-aware) and also performed a deep scan after the update. The anti-Trojan found a couple more worms that the anti-virus cannot see, after removing them everything became the same. It is also necessary to delete all newly generated files with the .exe extension (usually folders with the name \ "new folder.exe \" or \ "administrator.exe \"), because this is a virus, when you double-click on which it will start. They are created by the worm itself. Make sure that after deleting these folders are not created again, if this happens, then you have not deleted it from startup. After all these actions, in my opinion, everything works as before, as it should, but I'm still not sure that the computer is cured!
J:
Recently, I have come across a lot of similar viry. Only usually clients turn to when the computer either does not boot, or hangs tightly. It happens in half of the cases, when loading, a system crash occurs due to antivirus and a blue window of death. I fought and I fight: Safe Mode, removing antivirus, removing all temporary files and folders, cleaning Run in the registry on Current_User and Local_Machine. Then reboot, install antivirus and full scan local drives. It takes a little time, you can't delete anything superfluous, but after a rough manual cleaning, you are completely sure that when the system boots, the virus does not enter the memory.
Glory:
csrss.exe-system process csrcs.exe-virus
Sergey:
Take a look at c: Program Files - Common Files - Install Shield - Update Service. If these files are there, you need to delete them. My internet slowed down terribly. After I deleted these files from the specified location, the Internet started working.
This is an archived question. Adding replies is disabled.
The process that is linked to the filename smss.exe is known as Windows Session Manager SubSystem. This is a critical component of Windows operating system s and should not be terminated or altered in any way. The file launches a process that manages all your sessions on your PC, whether you are working with an MS Office application, browsing the Internet, or utilizing other applications installed on your computer. The file launches the kernel mode, win32k.sys, and the user mode, winsrv.dll, and other subsystems listed as required in the subsystems ’registry. All of these modules are necessary to launch an executable. Simply put, you need the file in order to use any of your applications on the PC. The file is installed through your Windows OS service pack. The file is approximately 61.5 KB large, and uses very little RAM space; only about 300 KB. Location of the file is C: \ Windows \ System 32 \ smss.exe. This is a Windows-protected file.
How can I stop smss.exe and should I?
Most non-system processes that are running can be stopped because they are not involved in running your operating system. smss.exe... is used by Microsoft Windows, If you shut down smss.exe, it will likely start again at a later time either after you restart your computer or after an application start. To stop smss.exe, permanently you need to uninstall the application that runs this process which in this case is Microsoft Windows, from your system.
After uninstalling applications it is a good idea to scan you Windows registry for any left over traces of applications. Registry Reviver by ReviverSoft is a great tool for doing this.
Is this a virus or other security concern?
ReviverSoft Security Verdict
Please review smss.exe and send me a notification once it has
been reviewed.
What is a process and how do they affect my computer?
A process usually a part of an installed application such as Microsoft Windows, or your operating system that is responsible for running in functions of that application. Some application require that they have processes running all the time so they can do things such as check for updates or notify you when you get an instant message. Some poorly written applications have many processes that run that may not be required and take up valuable processing power within your computer.
Is smss.exe known to be bad for my computer "s performance?
We have not received any complaint about this process having higher than normal impact on PC performance. If you have had bad experiences with it please let us know in a comment below and we will investigate it further.
