Smss.exe running from C:\SystemRoot\System32?

Norton Security | Norton Internet Security
1

Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Sed posuere consectetur est at lobortis. Vestibulum id ligula porta felis euismod semper. Donec ullamcorper nulla non metus auctor fringilla. Aenean lacinia bibendum nulla sed consectetur. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Cras mattis consectetur purus sit amet fermentum. Morbi leo risus, porta ac consectetur ac, vestibulum at eros. Sed posuere consectetur est at lobortis. Etiam porta sem malesuada magna mollis euismod. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Aenean eu leo quam. Pellentesque ornare sem lacinia quam venenatis vestibulum. Curabitur blandit tempus porttitor. Sed posuere consectetur est at lobortis.

2

You could also try to disable your system restore

3

Thanks for the replies.  I found at microsoft.com that these processes, as named, are normal Windows processes. For now I am assuming they are not infections.  I was thrown off by the unfamiliar syntax.  For now I would think this particlar issue is closed.

4

I find I have a process running called C:\SystemRoot\System32\smss.exe.   No % around SystemRoot, etc.  and I have no C:\SystemRoot folder.

 

I also find a process running as:

 

??\C:\WINDOWS\system32\winlogon.exe

 

I am pretty sure this means I have been infected, but system scans don’t show anything.   Any advice?

 

Thanks. 

 

Update 6/13/2008:  Checked on a PC “known” to be clean and these processes, as named, are also running on that computer, so it’s not clear that this means anything.  In principle, but if anyone has any additional information that would be very helpful.

 

 

Message Edited by glewen on 06-13-2008 06:35 AM

3 Likes
5

Both of these processes come from Microsoft.  smss.exe is the Session Manager Subsystem, while winlogin.exe is the Windows login manager. As you said, they might be possible infections. If you think they are, your best bet is to update your virus definitions, boot your system into Safe Mode, and then scan for and delete the infected files (if any).