Session Manager Subsystem - SMSS.EXE

Smss.exe will appear in your Windows\System or System32 folder. It is an early part of the Windows Boot sequence. This "native" application is responsible for many boot tasks including chkdsk, security tokens, driver initialization, WinLogon and other tasks required before the user interface is available. It's also used during Windows setup allowing users to install or repair installations before the Windows UI is activated. This file should be left in place.

If you find files called smss.exe and csrss.exe in your c:\Widows folder, you may have the W32.Dalbug.Worm. More information can be found at http://securityresponse.symantec.com/avcenter/venc/data/w32.dalbug.worm.html. You'd want to remove smss.exe and csmss.exe from your Windows folder as well as lmhsvc.exe from your Windows\System32 folder. Please do NOT remove the valid copies of smss.exe or csrss.exe from your Windows\System or System32 folder.

If you find smss.exe in a folder called \Windows\msagent\system, you may have the W32/Sober-L worm. More information on this mass mailing worm can be found at http://www.sophos.com/virusinfo/analyses/w32soberl.html. This file should be removed using WinPatrol. Again, leave the legitimate smss.exe in your Windows\System or System32 folder in place.

Safe

Required

Microsoft.com