NFOHump.com :: View topic

Page 1 of 1

Mutantius
VIP Member

Posts: 18594
Location: In Elektro looking for beans

Posted: Sat, 9th Apr 2005 20:31 Post subject: Smss.exe...	Quick Quote Quote

Hi guys, recently everytime I start up windows, my Smss.exe takes up all my cpu... This is indeed a weird prob since my friends here at this lan got their Smss.exe running thoough only with 0% in cpu usage.... I have tried running Nod32 to scan the darn thing but it aint show a thing... I've also looked across several paths and searched to find a replica of the file... Because when I enter the task manager I can see 2 smss.exe running.... What to do? Im not running sp2... and the exe is indeed blocket by sygate firewall "Why don't you zip it, Zipfero?" - fraich3

Profile
PM

Steve-O 2004

Posts: 2851

Posted: Sat, 9th Apr 2005 21:05 Post subject:

tried Panada online scan ??

Looks like its a Virus / Trojan

Most Trusted Site I would use for Virus's is symantec -

http://securityresponse.symantec.com/avcenter/venc/data/w32.dalbug.worm.html

Quote:

W32.Dalbug.Worm then copies itself as %windir%\System32\lmhsvc.exe, so that the worm is run each time that you restart the computer.

Once it is running, W32.Dalbug.Worm inserts and executes these files:

* %windir%\Smss.exe
* %windir%\Csrss.exe

Also Found this -

http://www.neuber.com/taskmanager/process/smss.exe.html

Quote:

Note: The smss.exe file is located in the c:\windows\System32 folder. In other cases, smss.exe is a virus, spyware, trojan or worm!

Quote:

Virus with same name:
W32.Dalbug.Worm - Symantec Corporation
Adware.DreamAd - Symantec Corporation
W32.Resdoc - Symantec Corporation
Adware.Advision - Symantec Corporation
Backdoor.IRC.Flood.F - Symantec Corporation
Backdoor.IRC.Aladinz.O - Symantec Corporation
and more...

Also this site -

http://www.auditmypc.com/process/smss.asp

Quote:

smss.exe (Flood.F Trojan) - Details

If a process named smss.exe is running on your computer, you may have been infected with a strain of the Flood.F trojan.

smss.exe is considered to be a security risk, not only because antivirus programs flag Flood.F Trojan as a trojan, but also because other sites consider it a Trojan as well.

Flood.F Trojan is likely a Trojan and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of smss.exe may cause serious harm to your system and will likely cause a number of problems, loss of data, loss of control or leaking private information.

You should visit our free spyware removal page to make sure your system does not have other programs like smss.exe.

George W Bush -

'...more and more of our imports are coming from overseas.'

Profile
PM

skidrow
Moderator

Posts: 8691

Posted: Sat, 9th Apr 2005 23:04 Post subject:	Quick Quote Quote

i have it to, and it aint no virus here. http://www.liutilities.com/products/wintaskspro/processlibrary/smss/ http://www.iamnotageek.com/a/Smss.exe.php

Profile
PM

Steve-O 2004

Posts: 2851

Posted: Sat, 9th Apr 2005 23:43 Post subject:

skidrow wrote:

i have it to, and it aint no virus here.

http://www.liutilities.com/products/wintaskspro/processlibrary/smss/
http://www.iamnotageek.com/a/Smss.exe.php

I think thats because theres a Real one thats Good and theres a Fake one thats Bad Smile

George W Bush -

'...more and more of our imports are coming from overseas.'

Profile
PM

Mutantius
VIP Member

Posts: 18594
Location: In Elektro looking for beans

Posted: Sun, 10th Apr 2005 02:05 Post subject:	Quick Quote Quote

Found it and solved it more explain to come "Why don't you zip it, Zipfero?" - fraich3

Profile
PM

Steve-O 2004

Posts: 2851

Posted: Thu, 21st Apr 2005 19:18 Post subject:

Mutantius wrote:

Found it and solved it Smile

more explain to come Smile

you still havent explained what you have done Razz

.. the suspence is killing me Very Happy

George W Bush -

'...more and more of our imports are coming from overseas.'

Profile
PM

Page 1 of 1

All times are GMT + 1 Hour