What is smss.exe? Is smss.exe spyware or a virus?

How to fix smss.exe related problems?
1. Run Security Task Manager to check your smss process
2. Run Windows Repair Tool to repair smss.exe related Windows Errors
3. Run MalwareBytes to remove persistent malware

Process name: Windows NT Session Manager

Product: Windows

Company: Microsoft

File: smss.exe

Security Rating:

This is the session manager subsystem, which is responsible for starting the user session. This process is initiated by the main system thread and is responsible for various activities, including launching the Winlogon and Win32 (Csrss.exe) processes, and setting system variables. After it has launched these processes, it waits for either Winlogon or Csrss to end. If this happens normally, the system shuts down; if it happens unexpectedly, Smss.exe causes the system to stop responding (hang). http://www.neuber.com/taskmanager/process/smss.exe.html 

Note: The smss.exe file is located in the folder C:\Windows\System32. In other cases, smss.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.

Virus with same file name:
W32.Dalbug.Worm - Symantec Corporation
Adware.DreamAd - Symantec Corporation
W32.Resdoc - Symantec Corporation
Adware.Advision - Symantec Corporation
Backdoor.IRC.Flood.F - Symantec Corporation
Backdoor.IRC.Aladinz.O - Symantec Corporation
and more...

Click to Run a Free Scan for smss.exe related errors

Users Opinions

Average user rating of smss.exe: based on 317 votes. Read also the 253 reviews.

8874 users ask for this file. 102 users rated it as not dangerous. 19 users rated it as not so dangerous. 58 users rated it as neutral. 34 users rated it as little bit dangerous. 104 users rated it as dangerous. 31 users didn't rate it ("don't know").

All comments about smss.exe:
Windows Session Manager Subsystem   Alex
not dangerous, smvss.exe is used by various worms, so be careful to note the difference   rich
Microsoft system file  
appearing on the task manager, with less cpu and memory usage.when tried to kill, it says that its a critical system process and cannot be terminated  See also: Link   partha s das
it slows down my pc big time   Danny
i agree with danny it slows every thing up, must be removed   Robert
Do not touch   Optimus
2 versions of it run smss.exe and SMSS.exe, the second one isn't needed   Delf
is included in Win 2000 bootdisks   Ninkyo
If it named in the Security Task Manager "s" then it's a virus ,but if it named "smss.exe" that means OK   Haitham
macht den pc echt lamm   b_tight
danny, from what it looks like, it doesnt  
When right click on a file in explorer check ur CPU%. it boosts up to 100%, thats what smss and csrss.exe does  
It's a normal windows file, but the dang thing seems to get corrupted along with csrss.exe all the dang time. Not sure how to clean up. v.v   Dark Prophet
found it inside my windows directory and system32 the one in windows directory was smaller I have deleted it and everthing seems to work,  
Obviously this is a windows subsystem file but may be a virus with a combination of other processes that appear in the taskmanager   Telangana Reddy
Not a Virus   Mufti Mahmud
A large number of spyware and trojan programs use a version of this file and the csrss.exe, both created in the %windir% (NOT %windir/system) to contact websites and irc to download programs and give outside access to your computer.   Val
Session Manager Subsystem,Application that is used to start, manage, and delete user sessions or client sessions under Terminal Server. is NOT a security risk   John
I removed it from a client pc and had NO problems rebooting. File was in the sys32 directory too.   CJ
smss.exe, if located in system32, is LEGITIMATE AND NOT A VIRUS! If located somewhere else, and taking 100% cpu etc, it's a virus that just happens to use the same name, in an attempt to trick you! DUH  
Just read the note about this file above. If it is not in the c:\Windiws\System32 folder, it is a trojan. Go to safe mode, and simply delete it.   Piet
a file with the same name in "c:\windows\system", it like a virus, but antivirus can't detect it  
its in my startup i just unchecked it everything runs fine   Wild-e
make the pc useless by making it SLOW   stig
A virus named "ravlovgate"   Monarch Wqs
installs with BOOMBox Internet Radio ---- Spyware  See also: Link   nervewreck27
If its not in your system32 folder, delete it.   Andrew
Trend Officescan recently picked this file up as being infected by BKDR_AGENT.CZ by its real time scanner - but a full scan of c:\ reports no infected files. I one evenening between 2am and 5 am trend detected it as a virus BKDR_AGENT.CZ every minute - still looking into problem. Could be nothing or could carry a high damage risk like other variants of BKDR_AGENT   Richard
smss.exe seems to be hard to delete adware (found in the windows file not system 32). Basicly a trick as it is a shared name and the process may not be stopped as it trickes windows into making it seem as a critial component. It may be deleted by renaming it rebooting and deleating the renamed file.   Tom
I got smss.exe on my sys 5 times including sys32=45k/smss inc:\windows\=48k/ 1 in prefetch=30k/ 1 in sp1 files/i386=45k and 1 in c:\windows\software distribution\download\=50k i take it this is not good!! anyideas?   Paul
"smss.exe is a process which is a part of the Microsoft Windows Operating System. It is called the Session Manager SubSystem and is responsible for handling sessions on your system. This program is important for the stable and secure running of your computer and should not be terminated. For More Detailed Process Information Get WinTasks 5 Pro"   cornholio
its a system file   tony
not dangerous   loopthedanza
This isn't a virus. If you've installed the service pack, that file automatically gets installed with your system, no biggy. Smss stands for Session Manager SubSystem. In other words, this program is responsible for controlling sessions on your computer, which will help to stable and secure your computer. It's a critical system process, which means taskmanager can't stop it.   666 - diese Wahrheit
got it from Dhakz.cjb.net It IS a Virus BackDoor type and it shuts off my nortons. If it wasnt for my firewall , I'd never of known. Only Trend Micro online scanner found it and still cant delete it   Mike Van
if located c:\windows\system32 then ok, if not.....sneaky they have the same names...they all should be named vires....lol   giel
can also be in windows/servicepackfiles/i386 and in most cases is not dangerous   crux
It can be dangerous. If it's not in windows/system32, delete it. If it's in system32 but uses an abnormal amount of system resources, replace it from the file on a windows boot disk (for your version of windows, of course)  
irc client, some french Warez channel. Don´t know if it made any harm. Was in c:\winNT\security\database and in registry.   micke
A lot of viruses/trojans try to create files that have the same names as Windows' crucial files. Same goes for SMSS.EXE. If this file stays in the system32 or system folder of the Windows directory then it is a critical system process and should not be deleted (you cannot end its process). Otherwise, if it lies elsewhere and consumes a large amount of CPU resources then it is definitely a virus/trojan and should simply be deleted (in Safe Mode or Real Dos Mode). It can also be detected by HouseCall online virus scanner. Use the link below to launch HouseCall.  See also: Link   Danh
system file   daniel
The smss.exe is trying to connect to the internet and as a system file it should not.  
It comes with WindowsXP. It's in C:\Windows\System32 folder when you install WindowsXP.   George
Windows Session Manager Subsystem runs executive program windows, such as microsoft word!  
If you remove it would damage The CPU and says,the NTVDM has encountred illegall instruction. It can contract virus but to clean it up!   zee
I found smssxp loading in taskmanager. It stops the tasbar and desktop icons from loading. It's all over my regstry and I cant seem to get rid of it.   Sharon Kent
We all know that this file is a subsystem file, but the error that some are getting is tricky, I myself getting the same error , but the file name for mine is "unable to find smsse.exe and to make sure the path is correct and all library resources are available" thats the question I have, has any one come accross this   Frankie
If this is not some kind of Virus/Trojan, then why are so many people having this problem, non of you guys have addressed that yet that think this is a normal file.   Trev
the entry i found on my system with hijack this is REG:system.ini: Shell=Explorer.exe smss.exe - and seems not to be the "Windows Session Manager Subsystem" process since this one is also being (positively) identified by hijack this and is running under .../windows/system32 - where it is supposed to be running. i suppose it s not a normal process   beees
system files are crucial for the system processes of your comp - but - some viruses will pretend to be a system file so they cannot be detected - at the moment, my current smss.exe is running at over 500mb (which isn't good - it increases like a page file).   Jake
It's not a virus or dangerous worm.i had no probs with that. a lot of worms are having simillar names with the system files.   Vijju
Just ran Trend Micro virus scan and it says SMSS.exe (virus) cannot be removed or repaired/cleaned...   SMSS EXE TROJAN
its dangerous when is other forms, for example. smsss.exe,   ivy
ZoneAlarm reports it trying to send 50 emails, it exists in a folder called Connection Wizard. I am sure it is parasitic software.   gary
may be a trojan   J.M. Klerks
It;s very noisy regarding the pop up message  
It appears to be a harmless file if located in system 32.  See also: Link   lamont lamont
this site says that smss.exe is a trojan(no two ways about it?)  See also: Link   shimona
i look at my running procceses all the time to keep an eye on things, as well as doing regular spyware/adware checks. i,m not sure about this one though. ad aware and spybot dont pick it up. (but that means nothing does it?)after reading the above, i,m even more unsure what to do! people who make virus,s and spyware should be pelted with all the hardware they have ever f**cked up!   allan d
My error message says: 'Windows cannot find 'smsse.exe'. Make sure you typed the name correctly, and then try again. To search for a file, click the start button, and then click search? But I never asked it to search for file smsse.exe in the first place?   Tony Lewis
I had an entry in my start group (smss) this caused my IE to hang. Removed it from the registry and all is okay (worked with Miceosoft tech support)   Chris
system file located in c:\windows\system32 and is called Session Manager SubSystem and is responsible for handling sessions on your computer.   Carol
I am facing hell out of problems with this , due to this my system shuts down automatic and not able to do any thing. it succs   Pavan Kumar
Just keep your anti-virus up to date, and don't open any suspicious files or links and your should be fine!   Joki
Don't know what to believe, there are too many different opinions rofl   Foxtrot
Don't know what to believe, there are too many different opinions rofl   Foxtrot
Find the Truth about your world:  See also: Link   Unknown
compare the two versions, the one in system32 is legit, the one in system is not, it is probably a keyboard logger and should be deleted in safe mode. Counter spy blocked this application when it was trying to load into the startup registry, as the file is blocked it could not be scanned by the malware scan. McAfee latest updates did not find anything wrong, may be because it was blocked. So if it is in system delete it, if it is system32 then compare it to original. Use Windows utility sfc.exe   Tonyk
Several versions, several situations alone determine status of file. All are conditional. In specific locations as described above, is requisite system file excepting particular circumstances where modified by malicious software and displaying particular excessive behavior. In locations other than typical, as specified above, it is malicious software. 2000 Server sp4 uses version with size 312k-other systems differ perhaps in native normal file size.   Logic
New feature on Zonealarm detects some programs trying to use it. Did not monitor before new version so programs accessed it then, so it should still be OK now. PC does not have a virus or a worm.  See also: Link   Mr B.
a System file - pay attention people, if it is smss.exe and located in the system32 dir, it should be ok. Any other variation on the name or location, THAT file is bad.   Big Doc Lou
It's a file used by Alias's Maya, so if u have Maya it's possible that u find it in your computer...   BlackKnight
Check Version tab in properties. Legitimate one says Microsoft. Bad one does not, and is in /system.   Jonathon
It sends emails in background, its a worm but can't eraze it and no antivirus can detect it!   Peyman
I managed to locate it using search and simply deleted by right clicking on it   MikiT
It's just another annoying -slow the whole the thing down- tool   Domingo
Part of XP if in system32. Anywhere else, dump it.   Dav
It is virus ! , but i don,t remove it.  
Essential operating system component  
Seems pretty cool  
invite some other sites to autoconnect internet and disables taskmanager   Ashok
Task manager shows smss.exe in windows/system32 as only 348k while the SMSS.EXE in windows/system is 3,208k, making me suspicious of the larger file. For that matter, how do we know that spyware isn't programmed into the XP operating system itself?   Peter Paranoid
its a windows system file, also many viruses (like brontok) try to create the same file name in different folder to trick user into thinking it is a Windows system  See also: Link   Yos Vincenzo
MS Antispyware detects it as a possible trojan IF it is in the WINDOWS folder. If it is in WINDOWS\system32 it is okay!   ZeroVerteX http://zerovertex.com
It's a normal windows file   Sztetke
Part of the Windows system   Astral Computing
Trojan horse BackDoor.Virkel.B found in 'C:\WINDOWS\system32\nfisdprone\smss.exe' screwed my firewall and antispyware program.   Ben
in my case it is in a folder called \systemRoot\System32 and its not signed by microsoft is this folder a valid one or is not.?   lordvin
the one in windows\system has smaller size 42Kb and periodically tries to connect somewhere, removed it, evrything is OK   max_on
There is a ligitimate executable named smss.exe without which Windows will not work. People on here sayin 'it made my system go slow' are either referencing a different application masqurading as the ligitimate file, have peculiar problems which they are attributing to the file or are just confused. The risk here is that you may see a file named smss.exe running and believe it is the one which does need to run, when in reality you are looking at a virus. A good way to check is, if you are running more than one of these you may have a problem.   Alec
If not found in system32 then probably a virus. I watched this thing which was located in the windows directory quickly open regedit and then close it again. Only virii does that. This program had also set up a UDP on port 1076. It was not in the winlogon hirachy and ran off of internet explorer. Only remove if you can verify it is not the real smss.   R3DBALL
I had the virus! I had c:\windows\SMSS.exe and c:\windows\system32\SMSS.exe. Deleted BOGUS c:\windows\smss.exe and problems went away.   Daron
If smss.exe runs from a diffrent directory than system32\ (mine ran from system\) IT'S A TROJAN VIRUS! But be aware! Do not under any circumstances delete the MS systemfile system32\smss.exe - that's not a virus. Read the note in the top of this page!  
I found this in a folder named 'WinSecurity' in Windows. It suddenly appeared after a browsing session and i isolated the time/date it arrived. Taking the advice of 'if its not in System32 file delete it' I deleted the whole folder. it also had services.exe and other malware programs in there   Baloney
My AVG anti virus detects this file as a VIRUS, but for some reason will not get rid of it. It is very frustrating to say the least   Ashley
Smss and lsass and csrss are Normal Files ** When they are located in the system32 directory **. If they are in the root Window folder They are SPYWARE. If you want to nat get infected with these files in the future, Here's What to do. Reboot in safe mode, go to your windows directory and locate the offending file. copy a version(Ms Certified) of that file from windows\servicepackfiles\i386 to your windows directory and write-protect them. By the way most spyware programs have another one unnamed that re-creates the offending files and makes them hard to get rid of.  
This file is not a virus! is a cool process that helps windows to run well , lol   xobkcah
look at the date it was created, if after windows install or update and is in windows system not sys32 then it is a virus. mine was installed by a bogus key gen (yea i know) and ever since 1/26/06 it attempts to shut down NIS 2005. i will rename and delete....not in sys32!  
A system process, but many virus's/trojans masqaurade uder its name, usually, if its a system task, its ok, in a user task, get rid of it  
Kaspersky says: Win32.IRCBot.nw - Trojan Downloader   Uli
This .Exe file in a complement of windows, is process run with winlogon and other several files, dont delete this file is a manager of the systems based on microsoft windows  See also: Link   Oss Agent
the false smss.exe in folder system blocked the microsoft smss.exe in folder system32   titus
My AVG antivirus reported this file as a virus, i chose to "heal it" and now when i start my computer it says "cannot find smss.exe"   someguy
in task manger it says i got two runing at once 1 takes 99 of cpu help please  
May be virus even if located in system32 dir. Mine was a virus and was located in c:\windows\system32\winhelp. Check if windows is running more than one smss.exe, if it is then you have a virus.   Ubi Fumus
if it's 50 K then fine larger it's bad   Marcus
get a hint dipshits, calm down, smss.exe it NOT A VIRUS and is essential retards, smsc.exe is a virus dicks   keeping_it_cool
This file slows down the whole damn computer it terrible thing it has to be removed. i used ewido to find it   yeh_cheezzz
this seemed to come from a file sent thru messenger while on chat. It has locked me out of nortons and is constantly changing my home page to virushelpzone how do I fix this?  See also: Link   Amanda
connected to virus named exmodule32   Danny
my file is legit its in the right folder and everything....I'm using previx1 and AVG....Everytime Previx gives me an alert to send something to jail it says the root file was smss.exe, how do i go about cleaning the file up if it is legit and should not be deleted? For an example one of the processes it stop that it stops is win3022, there has been a big variety and different one but there is always win in it...thank you.   Greg
seems to be trojan. it cause pc to hang, cant type, keyboard freezes   kerbear
Windows session manager, ok if in windows\system32.   Dave
yep, everything started when these popups of norton antivirus showed up saying that something is trying to send e-mails. There is a smss.exe in the system folder(another in system32 probably normal one) for me so i guess i have to delete it, but how?   mhm
I had to start my computer in safe mode to remove it... I had to remove everything though.   Kent
its a trojan no two ways about it delete it!   tanchi
all i know is i been around pc's a long time. an every time i install an os like win 98 se or winxp i always take a snap shot of the processes running an save it to paint :) an then i get more used to programs running on my pc :) but yes "smss.exe" is in the win xp pro setup so im not sure about this file lol   Blaine J.
Ive never seen such differing opinions on one subject. This link has been most unhelpful   The Blind leading the Blind
The file smss.exe in %windows%\system32 is the real one. A Backdoor install a different file in the %windows%\system directory. The virus itself is commonly larger than the original file.   Valis Fauntleroy
on my system smss.exe uses 224K mem and 144K VM. if it uses SIGNIFICANTLY more than this, then it may indeed be malware   Mirddes
AVG recognises it as a back door trojan, searched for files on computer and found 3 so deleted the two which were not located in windows sytem32   Phil
It is the Windows NT Session Manager located in C:\WINDOWS\system32. It is an ESSENTIAL windows component. Among other things, it runs programs listed in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager key in the Registy.   Maur
Downloaded a "crack" from eMule and it installed this file 'smss.exe' to '\windows\system' folder instead of '\windows\system32', where the MS certified original 'ssms.exe' is located. It also created an entry in registry at HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. Just delete the entry and the file and everything is Ok.   Carlos
Windows Session manager. Unfortunately, as of 6/15/2006, PcMag is advising users to delete it....even/especially in system32 folder.   setirich
It is usually part of the operating system but sometimes it might be a trojan.   vinod
May or may not be a virus, it depends if it has been attacked or not.   Ryan
the same like smss.exe but in c:\windows\system folder not in the c:\windows\system32, where you can find the real smss.exe, signed by MS   Lanfeust
McAfee Antivirus scanned it as virus   Aditya
its a normal system file but it can have the same as a virus but remember viruses often try to change the name like with a SMSS or SmSS or smsse or semmss things that have the same name or that have a similar name so be careful always check for duplicated files and see which one is running from where   sawalha
Just read the note about this file above. If it is not in the c:\Windiws\System32 folder, it is a trojan. Go to safe mode, and simply delete it.   magesh babu
I finally got it - used Free WinPatrol program at Download.com  
If located in C:\WINDOWS\system32 its perfectly fine. dont touch it   P e t e r
smss located in windows system file causes norton auto protect to shut down I removed it works fine   looker
If it's in Windows/System32/dllcache and also in Windows/System32, and 45k, it's the Microsoft file. If you find it in C:\Windows, and it's a lot smaller, KILL IT.   Grant
just ordinary windows process that cause no problem   goodeye
If running from system32 as user 'SYSTEM' then most likely ok. If you see a second instance of this running as the current user and it is located somewhere else, it is a virus.   Eric
There's a worm on the net, disguised as a Corel X3 keygen (~26 kB) , that installs itself in C:\Windows\System as smss.exe. It is a mass-sending spam messages. Avast can't detect is as threat yet, but is able to detect the abnormal e-mail activity. Other symptoms are the presence of files named domains.txt, fnames.txt and lnames.txt (and/or files with these names and .cab extension)in your Local Configurations\Temp folder.   cesar
When located in the WINDOWS folder both csrss.exe and smss.exe are viruses. The real versions are located in windows/system32   cal
smss.exe is not a risk. if it has another name, like SMSS.exe, it could be a virus!   Silverstar
Hmm, every time i try to delete it, it dosen't delete, instead it says "Cannot delete smss: It is being used by another person or program. Close any programs that might being useing the file and try again."   Adamisk
I've got infected smss.exe and it tries to do download some sh.t from web   nickson
It appeared in my system after downloading a file from a dubious source. From that point I noticed some other strange things happening (setup.exe appearing in root of shares). This caused me to start investigating. In event log, I noticed that the Security Centre had started getting turned off along with Windows Firewall. This started after a certain date. I then searched for files created on that date and found smss.exe in Windows\system. I am 100% sure this instance is a virus!   smss cracker
I found one copy in my windows\ system 48K and one in windows\system32 50K. i deleted the first one. Actually the antivir guard didn't pick it up but i ran a full scan tonight and found it. only the file in windows\system was reported as a trojan so only the one in system32 is legit   Will
it is possible the file c:\windows\system32\smss.exe can get corrupted: i had that problem with csrss.exe once (also in sys32 folder)   Ninja
Keeping_it_cool, you need to calm down... Like your name... If it's eating up mem like mad, it is bad. But yes, windows does have a required smss.exe file... Solve your problems by switching to Linux!!!   Dave
Microsoft Defender and msconfig identify it as unkown file and when I removed the file Backdoor Trojan EOD, which was being reported repeatedly in temp folder by AVG 7 stopped and in Temp folder no longer there appears an application which tries to access internet as reported by Mcaffe Antivirus on the network computer of mine   P C Bhandari
Session Manager Subsystem, a application that is used to start, manage, and delete user sessions or client sessions under "Terminal Server". This is NOT a security risk retards!!! Leave it alone.~~~   Rico S suav'e
open up start menu, search smss.exe, if located in windows/system32 you are good to go.   asdf
Lanfeust--" the same like smss.exe but in c:\windows\system folder not in the c:\windows\system32, where you can find the real smss.exe, signed by MS" --+-- mine is, its the only one existing on my comp., everything runs great   Enlightened Fool
AVG picked it up, 3 of them they also were gave the name Trojan flooder. AKE located in windows/system32 winlogon.exe I run it in safe mode and then scanned, I then deleted the two files and not the one in sys32 but my computer won't load up and says 'Terminal error, fatal exception' and just gives an error code...   Aaron
Search for smss in the windows search (Start Seacrch) and if it appears in windows/system32 its fine. If it is not in that file then something else is going on and it should be deleted - ie virus/trojan   Ben
Um, it seems relatively fine, but I find two processes by the same name, one run by SYSTEM and one run by me on my computer. I wonder if either of these is a virus...  See also: Link   Prateem
csrss &smss are sys files, but can get hijacked!   bert
if its in it its normal place /system32 then its safe , but if it in windows then you are in big issues  
smss.exe is a process which is a part of the Microsoft Windows Operating System. It is called the Session Manager Subsystem and is responsible for handling sessions on your system. This program is important for the stable and secure running of your computer and should not be terminated. dumbasses...   Bizzizle
May be PWS.MARAN trojan (ouviewer.dll). See McAfee link for details.  See also: Link   Dan
it will lock date of the system at calender. upto a particular year ie 1980-2099. it will not go beyond this limit.   Arpit Pandya
Slows down my pc big time. Especially noticable when playing online games like Counter Strike.   ArslanHamid
My PC (XP with SP2) has smss.exe located at both: Windows\System32\ ,and Windows\System32\dllcache\ . Both are signed by Microsoft, are same 49.5K size, and both have the same install date. I suspect that both are legimate, but why would there be TWO installed smss.exe ?   Juan Pablo
smss.exe is a process which is a part of the Microsoft Windows Operating System. It is called the Session Manager Subsystem and is responsible for handling sessions on your system. This program is important for the stable and secure running of your computer and should not be terminated   Brian
smss is more accurately the Session Manager SubSystem and is very important in booting a Windows computer. It is the first process started after booting  See also: Link   FMasic
ok if in windows\system32.   AMS
It doesn't allow me to access the TaskManager, secondly when I try do delete it from a non system's folder it keeps on reappearing. It doesn't allow me to install any spyware/antivirus. When I try to do it the system restart's. What is the solution for this.   Roshan
Somehow my computer contracted the Trojan. QHorse virus last night. All research suggests that I visited an infected site. Shortly after that my smss.exe file tried to connect and b/c Norton said it was a low threat, I clicked okay. Now I'm having a heck of a time trying to clear this up. Virus alerts keep popping up even though the system scan was clear. Any ideas?.   Georganne
erm, i got three versions, 1 50kb, 2 45 kb.... 1 is in windows/system32, one is in winnt/system32 and the last one is in winnt/servicepackfiles/1386  
Finally I managed to delete the infected smss.exe file located at C:\WINDOWS\system\....it's not an easy task. First I tried using Hijack this to delete the file on reboot, but it failed. So I went to the registry editor and deleted every entry pointing towards the smss file under the system folder. Then I turned off System Restore. Then restarted in safe mode and deleted all files in the C:\Documents and Settings\My name\Local Settings\Temp folder and the smss file in the system folder. At last rebooted, and the file was gone :)   CNSZU
i looked into the afore mentioned program and after looking on a few forums decided to not allow it. zone alarm is the best for detecting those dodgy intruders.   lokey69666
My windows XP installation has the following surplas example, which is safe, and comes from the installation process: "C:\i386\SYSTEM32\SMSS.EXE" being size 470016 and is date-time stamped: 04/08/2004 06:00   Peter Lee
This file connects to an ip, than a program which can control this trojan. It lists all pc vertical and you can chose aynone for what do yo want  See also: Link   Cagdas
Si no esta en el directorio win32, y esta en C:/windows, es un virus; me tranco el pc pero logre activar el Norton CD luego use un noadware, que me indico adonde estaba, lo borre, y listo. El verdadero esta en win32.   Alfred Juillet
As stated above, this is a Windows system file known as Session Manager SubSystem or "Microsoft Windows NT Session Manager" as its display name. The file ships with the operating system, and again, is simply the application that manages user and client sessions on your Windows XP PC. Viruses and malware can always disguise themselves as other files and programs, even with the same display/file name, and windows system files such as this are commonly immitated in this manner. If you find a file of this name in anywhere other than the "windows/system32" folder, it is in all likelyhood malware.   Moosa
It was not in the system 32 and totally shocked my CPU, i was not able to refresh my virus scanner or use the internet. Then I deleted it in safe mode and everything is okay now. Hijackthis helped me to solve the matter.  See also: Link   Genie
Trend Micro recently picked up this as a generic trojan, and i attempted to delete. the location of the infected file was in Windows/system32. Also DEP (Data Execution Prevention) keeps closing this program. DEP is telling me that it is ending a critical process, because the file is in windows/system32. Can anyone Help me? the smss.exe is only using 52k or memory so that makes me believe that it is not a trojan. Anyone able to help?   Fraser
smss.exe is harmless, watch out for **ssms.exe** for this is a wormy virus  See also: Link   Bennett
When ONLY in C:\Windows\System32\smss.exe it is OK. Session Manager Subsystem. It will launch winlogon.exe (and csrss.exe) to start user sessions as SYSTEM user in your task manager processes window. It sttempts to load and access the internet using lsass.exe from your local IP assigned address to a remote server IP address (like :389) using UDP (outbound) protocol. This is NORMAL. What is causing the difference of opinion above, are the cases where a virus/trojan has installed itself in c:\windows\system directory and renamed itself to smss.exe, smse.exe, smce.exe, etc,   Michael
use trojan remover 6.6.3 download it from the net   manny
This is an important process to keep running, without it your system will be unstable. Although there is the minute chance thast it could be malicious (aka virus, tojan, ect.). Do what asdf said, if it is system32 folder it is the correct file. If however it is in another location, you might have problems.  See also: Link   Ctullu
if you found this file in C:\ or D:\ or in C:\windows\ folder, this is virus. Try also to search the killer. exe. And Also the autorun.inf on a given folder. Try to open the the autorun.inf with notepad. If you will found the smss inside the autorun.inf, then the autorun.inf makes the smss.exe virus to run everytime you open the mentioned drive and or directory   rexzel0230
I need help, its in C:\Program Files\MSMS\smss.exe and its got stuff like win32process.pyd. I have a smss.exe in my windows\system32 file so i;m not sure. Please post a reply on this site   In Need of Help
I've been using smss.exe with SP1 for many years now, with no adverse effects! Oh yea, I know there's no updtds for SP1 now. However I still use it with a router and turned auto updtds off ever since SP1 stopped support. And guess what no problems!!! Don't over kill as many above who has all that extra time to dream!   MC
windows system file related to the "Secundary session service". If you need to run processes/apps with different user name with strong secuirty else you should disable the service in services.msc. it's located in \%windir%\system32 and ..\dllcache. if is in other location is a VIRUS/TROJAN   Nowar
Company: N/A Product: KillSec Threat: Spyware Description It installs a service and creates autorun entries which run automatically on every system startup. It collects passwords and usernames of banking pages ad send it periodically to a server. It contatcs It downloads additional data from that server. The original file is deleted after execution but creates a copy in the profile folder of the current user. Also it deletes the files of the internet explorer cache. It hides its own files an registry keys. It infects the exporer.exe but after restart explorer.exe is fi   yomi
ssms.exe that can be found in c:\windows\system32 folder is virus or spyware.coz,if you want to find this file to the said folder using explorer it will go back to the desktop.and if you want to uncheck thru starup using msconfig the dialogue box will disappear,or if you want to disable it using SAFEMODE you cant do anything.So in my opinion the original ssms.exe file that supporting in booting the computer was changed this file was sabutage your windows file and some program dont run and execute carefully because of this file and how to delete this without damaging the windows system   kitnanamet
It is not dangerous but it does not allow to open the Folder Option and Command prompt.   wkhan
it activates automatically and start blinking. when we try to open the task manager to stop the service then it automatically disappears. so we can not stop the service. we can not open the command prompt. also we can install the AntiViruses.   wkhan
smss.exe is transferred and is hidden in my flash disk.. Its a virus.. When I open task manager and other programs, it is minimized.   earLX
I hav been infected by smss.exe virus twice and to get rid of it, I have to format the whole disk. It appears in my task manager with a username and also as a system file. when i opens task manager, its a matter of few seconds that it minimizes. It closes the window from wherever i accessed it. I tried msconfig, regedit n even when I tried to remove it online, it also closed that. It's a hell.   SID
Its part of widowsXP, I have 2 friends that work for microsoft!!! its part of your system 32 file!!!   jooboo
well my computer was infected by smss.exe and its has its buddy the killer.exe i use a kill box to stop its process its located in C:\windows\smss.exe, C:\windows\killer.exe and it infect my other partition D:\smss.exe after that i use a flash disinfector to To fix the error associated with that file i deleted  
disables task manager, reloads itself when crtl+alt+del, created some other copies around. found it under net meeting. doesn't have a proper pulisher, but yeah.net...   CBB
It shows up as a nero image file and is hidden adn accompanied bu other files too . You may delete it as many times as u want but it shows up again with all the accompanying files. It also doesn't let you chose"show hidden files" from the folder options(no matter how many times u select it, it'll always be deselected the next time u open folder options). Also, it closes the task manager automatically when it is one of the processes.   Nishant Sharma
Note that in corporate networks, this file may be located in windows\system32 on the users home drive, eg h:\   dallas
warning men! smss.exe virus always produce other FunnyScandal.avi.exe. Slowing down your comp? thats right, it happens in my mate's comps. smss.exe uses standard defoult .exe icon, but the virus i found using diffrent somewhat like other application icon. I usually found the virus version inside the first dir of drive, but the functional one is in the WINDOW/system32 folder. Don't screw up unless you know what youre doing with WINDOWS things   Alph Vick Kyuz
It is damn smart that if your check for anything with .exe on google it shuts down your pc.   Mantar
This is also the name of the SQL Server Management Studio exe. It would normally live in \Program Files\Microsoft SQL Server\{90 100}\Tools\Binn\VSShell\Common7\IDE   Michael Tillett
This process is NORMALLY AN ESSENTIAL WINDOWS COMPONENT, but occasionally malicious software will masquerade as smss.exe. If you only have one copy of it running then chances are it's OK (and shouldn't be removed as it's an essential component of Windows), but if you have two copies one may be malicious. If it's not running in windows\system32 then it may be malicious (download Process Explorer if you're not sure where the file is running from - see link for further details). Any good virus checker should tell you if it's a virus.  See also: Link   Saskia
Most people have no idea this is one of the core processes of Windows: The Session Manager Subsystem, responsible for creating environment variables, paging files, the winlogon manager; starts all other various subsystems. Located in %SystemRoot%\system32\   martix
It IS NOT A VIRUS!! if in properties of file writed :MicroSoft. any were else it is virus!:  See also: Link   JiRaFFFFFFFFFFFFFFFFFFF
when i instale new win xp and some therd pharty it was instal and i see in tskmanager but avg connot fin it   mcse 2000 microsoft
A while ago my computer started shutting down as soon as i logged onto an account and since them i've been cruising through my computer researching every virus i can find this showed up in C:\I386 I'm not sure what it was for though so just something to think about it came up in all capital letters SMSS.EX_   Miles
Keeps on resetting explorer.exe- the taskbar which has every thing. I'm trying to find a solution to it because i don't want to formart my pc.   Abdusamed
it is file in windows but! there is a replase version of smss it is a VIRUS   salam
Check the task manager and if 2 smss.exe running u have problems, i had the windows smss.exe and one in windows\32\apple\smss.exe (virus) Ran VGA to stop it and its many downloads then deleted file, it also had a ke logger associated with it, so look for a key file in windows32 open the key file with txt document to see all the key strokes it has captured :((   Infected by smss
This file is usually ~92k os system memory usage, if more it is a trojan, also have detected it can be seen as SMSS.exe using over 1000k memory. combined with csmss.exe and msmsg.exe can overload processor withour showing on task manager. remove windows messenger from windows components, then kill app and won't show agian. Removal is not yet avaliable but infection can be controlled, since this won't infect other apps or programs   ChillFactor
well yea it is a system file as well it is a new malware that goes around on USB drives to infect computers and slow them down completely   vapula
when you connect a device from the usb port everything gets into the problem . none of the programs will respond anymore . unless you remove the device you had already connected to your computer   hasan
The version I have is the 'SQL Server Management Studio'. The process is written Ssms.exe. MSSQL 2008. A path may look like C:\Programme\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\Ssms.exe   Taku
smss.exe is sometimes a virus like on my PC. Located in C:\Program Files\smss\smss.exe (Windows Vista Home 32bit (86x)) SIZE in my PC is 120Kb CAN NOT JUST REMOVE!!! antivirus is flashing, but i will kill him now , safemode   Davidhopar
Windows service, some AV software suspects on SMSS.EXE, meaning on mailcious soft with similar name like SMS.exe,SSMS.exe or SMMS.exe which is variants of an malicious soft   Zocky Digital Tech & Art-Veles,Macedonia
Not much other then for VISTA USERS you well have random duplicates of these .exe files on purpose and all should be in system 32 but 1/2 well be nicely *scattered* around in your X86 M$ ect.. Folders which r in Windows/winsxs, thnx to M$'s idea of not unifying the .exes ( I found 4 on mine, 2 have size variations but in different folders) no threat found yet.   Motoko
this process is running in my PC. It slow down your PC. Must Remove. The other viruses are installed with this like regsvr.exe, csrss.exe etc. They dont touch your OS.. but they make system slow....   Omkar
i do have smss.exe virus from a rogue flashstick in "c:\windows\system32 " - yes there is a space. it blocked blocked my AV and gave itself auto permit with windows defender so it took some time for me to work out that i had it.i killed the processes and unplugged my internet hoping to restart my comp to get my AV back, scan and get rid of it. which then leads me to my current problem. i am unable to login to my desktop, 2seconds after my comps tries to boot up to the desktop it logs out to the user login page. i have tried all f8 - safe mode options and for each one it still logs me out -.-   trent
use spyhunter to clean   amir
Well I realised by now that this is a windows component, however it seems versions of this file are used for malice. I just wanted to note that another version of this may come with an SP(3) update, but should not alarm you in that case.   Ariel
some kind of virus with the same name with smss. .my friend computer are infected by this virus and usually it take a long time to make the computer system slower.   Einstain
safe if it is in your system folder, dangerous if it is found somewhere else   Yohyohyoh
Reported as Vundo.JE trojan by AVG, redirect browser results and slow down PC   Denied
smss.exe (Flood.F Trojan) - Details If a process named smss.exe is running on your computer, you may have been infected with a strain of the Flood.F trojan. smss.exe is considered to be a security risk, not only because antivirus programs flag Flood.F Trojan as a trojan, but also because other sites consider it a Trojan as well. Flood.F Trojan is likely a Trojan and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of smss.exe may cause serious harm to your system and will likely cause a number of problems, loss of data, loss of control   M Ali
(S)ession (M)anager (S)ubsy(s)tem(.exe), or smss.exe is a component of the Microsoft Windows NT operating system and successor operating systems. It is executed during the startup process of Windows NT, Windows 2000, XP, Server 2003 and Vista.  See also: Link   BeNiceOnTheNet
%windir%\System32\smss.exe is a vital windows component. Don't delete it. Just check "command line" box in what columns to see in task manager and its clearly visible what is running and from where. Dont give ppl advice to delete stuff if you have no clue what you'r on about.   The Swede.
Many antiviruses couldn't clean any infections that do infect this file   Hossam
If it's located in the "C:\WINDOWS\Fonts" directory, then it's a virus, it could cause booting problems, destroying other programs in your OS, could also cause glitches in hardwares. Only seen it about a year ago (2009), usually only get this virus if the user is an novice & don't know how to delete the temp files after surfing the net. Reinstalling the OS couldn't rid the virus, I think one need to reformat the HDD before reinstalling the OS to fix it.   Billidiot shit Gates Microft OS
Critical system file   Andrew
Normally, this file is not a virus and is a vital system process when starting up your PC. On the other hand, there is a virus with the same name that attaches itself to all of your execution processes and eventually does damage as time goes on. Use the task manager provided on this page to see if you have the virus. The icon will be a purple octopus like figure (it gives me nightmares.) Make sure you put your computer in safe mode before you quarantine it, not doing so may result in a failed quarantine.   The truth
That's Windows system file  See also: Link   Podić Elvir
smss.exe Is A File Copied To C:\Windows\System32 After A Fresh Installation Of Windows And It's Harmless. If smss.exe Is Detected Elsewhere, Then It Becomes Suspicious And Should Be Removed.   Tony
SSMS - SQL Server Management Studio   NozzNazz
Kaspesrsky 2011 say it's dangerous but it's used by Logmein.com to remote access my computer.   K
This is the session manager subsystem, which is responsible for starting the user session. This process is initiated by the system thread and is responsible for various activities, including launching the Winlogon and Win32 (Csrss.exe) processes and setting system variables. After it has launched these processes, it waits for either Winlogon or Csrss to end. If this happens "normally," the system shuts down; if it happens unexpectedly, Smss.exe causes the system to stop responding (hang). it is a valid windows process  See also: Link   Dave Berry
"high" criticality, detected by my Kaspersky AV 2011.   wrektime
Smss.exe is the Windows Session Manager SubSystem in Windows 2000/XP/2003/Vista/7.Smss.exe is responsible for handling user sessions on your system by starting the system thread and other critical tasks. The smss.exe process is responsible for launching winlogon.exe and csrss.exe processes, and setting system variables. After winlogon.exe and csrss.exe have been launched, smss.exe waits until they end. If there are no errors, the system shuts down normally. However, if Winlogon or Csrss end unexpectedly, the smss.exe process makes the system hang and stop responding.  See also: Link   Andrew Davis
the windows recovery console has a copy in c:\cmdcons\system32\ this is normal if you have the recovery console installed   ~Grim
It's not a virus. but can be infected by some trojans.   Mametov Alexander
it CAN be a virus, just check if there is just ONE smss.exe in your process list, if more: VIRUS ALERT!   :)
If it's smss.exe then safe if SMSS.exe/EXE then check it out without an internet conection. If it slows your pc down change to windows classic theme   Eivis
smss.exe is safe, it comes when you install windows... nothing to worry about. ;-)   jex da pogi
It is safe. Your computer needs it!   Big Balls
It is MS SQL server management studio   Dinhdq
It's safe! It's a normal Windows file at all. It really makes your PC slower but it's safe :-}.   Alexandar Vitkov
smss.exe can be infected become a virus like crss.exe   RommoR
this is running in processes and located in systemroot\system32\smss.exe but when i try to use the link the advanced system care IObit process manager provides I get the cannot find message. Am going to have to go delving in places I'd rather not delve into just to ascertain whether I have more than one version of this file Although ASC does tell me that the smss.exe file that is running in processes is not signed by microsoft which makes me more than suspicious that it is the cause of my antivirus being unable to complete any quick or full scans, instead the entire system closes down in an instant! However when I scan every part of my c;\ drive seperately I can complete the individual scans but nothing is picked up. I shall report back if I have any measure of success and thanks for all the input folks.   Dean
smss.exe is a process which is a part of the Microsoft Windows Operating System. It is called the Session Manager Subsystem and is responsible for handling sessions on your system. This program is important for the stable and secure running of your computer and should not be terminated.   virus
Not dangerous, its an important file.  
Its safe :) Windows process :D   QuaSter
If you're running x64 windows it will show as smss.exe*32 in the task manager and thats a virus the system process Does not have the *32 and btw you can open the file location if it leads to anywhere but the system32 file it's a virus   Salvatore
It's System File and also someone used its name for virus. Look its properties by clicking right properties. If it signed by Microsoft it isn't a virus. But if it isn't signed by Microsoft, it is a virus  
Came up dangerous for "Dr web" with a occasional message that takes a few clicks to, rid off.I have located the file, scan it, and "no threats detected"   Adam
Only shows up in Security Manager as a pop up only, not on list. On pop up, system freeze, unable to obtain add'l info. This happened 3 times, you know it's not good. Plus on my pop up it states si in the top upper portion of the pop up for smss.exe.   Sharon
When closing this, it gave me the warning that if I ended this process, my OS would shut down (Win7). After scanning it with 3 Antivirus, it seems safe   Devcon

If you know more about smss.exe, share your knowledge and help other users.

Security Rating:
Your opinion
about this file:
Web page with more details:
Your first name:

More process information

Is smss.exe spyware or a virus, trojans, adware or worm? Is there a known smss.exe error?

Other Processes

[smss.exe in German] [all processes]