Windows Forum

Ask something
Discussion Locked

smss.exe doesn't stop when shutting down

0 helpful
8 replies

by pcmaster 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

When logging off, shutting down or restarting, I get an error message saying the smss.exe hasn't stopped running and then I have to hit the End button to get it to shut down or restart.

I just resently got the GRAPS virus and successfully removedall the infected files according to the instructions. This just started since the infection. I re applied SP4, but it seemed to make no difference. Anyone have ideas?

8 replies

by pctech

Hi

Here is the information I found concerning smss.exe:

http://www.liutilities.com/products/wintaskspro/processlibrary/smss/

Here is the information I found concerning the Graps virus:

http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.graps.html

This is something else Syamntec says the virus can do, "Opens port 45836 and listens for incoming connections. The backdoor commands allow a hacker to perform the following actions:
Deliver system information
Launch Denial of Service (DoS) attacks against selected targets
Install SMTP, IRC, and HTTP proxies so that the connected backdoor client can be used to anonymously send spam, operate as an IRC client, and browse the Internet." You need to assure you have these ports and services closed.

I suspect that the virus is still active, has caused corruption, and/or a hacker still has access to your system. Since this virus is network aware, I need to ask if you are connected to other computers. If so, you need to check every system on the network. Take every system off the network and run a virus scan on them. Did you disable the system restore function before removing the virus?

by pcmaster

I'm running Windows 2000 Pro so it doesn't have system restore. I believe that is an XP function. I did, however, go into Safe Mode as instructed by Symantec, performed a full scan with an updated Norton AV, identified the virus files and deleted them from the system, including the (3) wds.bat files. Edited the registry and removed the mdw.exe value as instructed. Also, located the mdw.exe file and deleted it as well.

Then, I re entered safe mode, did a full system scan and it reported no viruses. I'm on a network, however none of the other computers have the virus at all. I'm stumped.

by thamer

Background:
SMSS is the Session Manager SubSystem found in Windows NT4/2000/XP only with a purpose to start, manage, and delete user sessions (or client sessions under Terminal Server). Under Terminal Server the management part includes dealing with the different subsystems (OS/2, Win32, POSIX) which a client session may wish to run.

From what I understand, you encounter no problems running your system when you "end"/close the the file ... Have you tried running MSconfig and uncheck the file from the being run in the startup?

Also, do you see the following run key in this registry location?

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss.exe=%SystemRoot%\csrss.exe

by pcmaster

I ran MSconfig and the smss.exe file isn't on the startup list, however when looking in the task manager, the process is running.

Also, the file smss.exe is located in C:\winnt\system32\Drivers\etc where it is not on other pc's I have. There are actually two smss.exe files. One is directly in my system32 folder and the other mentioned previously. They have different dates as well. The one in my System32 folder is reflected on other machines. I tried removing the smss.exe file from the ../Drivers/etc folder, but got a different error.

The registry entry is not there, but it is also not there on other machines either. These are all Win2K Pro machines.

This discussion is closed to new replies.