Comments on: csrss.exe, smss.exe and lsass.exe http://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/ A technology news blog covering software, mobile phones, gadgets, security, the Internet and other relevant areas. Sat, 11 Feb 2012 22:58:45 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Martin Brinkmannhttp://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/comment-page-1/#comment-1398558 Martin Brinkmann Fri, 30 Dec 2011 16:17:45 +0000 http://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/#comment-1398558 I'm dumb because? Did not get the reason for your impoliteness. I’m dumb because? Did not get the reason for your impoliteness.

]]> By: Matthiashttp://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/comment-page-1/#comment-1398517 Matthias Fri, 30 Dec 2011 13:49:20 +0000 http://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/#comment-1398517 Martin, you're dumb. (and dangerous) Those 3 files are ESSENTIAL to Windows NT !!! It's maybe its BASIS. SMSS manages the NT sessions with SERVICES.EXE and WINLOGON.EXE. Plus CSRSS manages the windows and graphics. LSASS is to connect to NT sessions !! In addition, Winlogon follows the session's process, and services.exe manages the running services between the sessions (as TELNET service, the antivirus' scanner service, DDE network service, etc.) Martin, you’re dumb. (and dangerous)

Those 3 files are ESSENTIAL to Windows NT !!! It’s maybe its BASIS.

SMSS manages the NT sessions with SERVICES.EXE and WINLOGON.EXE.
Plus CSRSS manages the windows and graphics.
LSASS is to connect to NT sessions !!

In addition, Winlogon follows the session’s process, and services.exe manages the running services between the sessions (as TELNET service, the antivirus’ scanner service, DDE network service, etc.)

]]> By: sam the techhttp://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/comment-page-1/#comment-759230 sam the tech Sat, 02 May 2009 05:42:12 +0000 http://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/#comment-759230 well guess what. to me its a frigin virus with fancy names. cause i gon on my comp wich is fine and any other well runing comp and i never say any of those 3 process. a process that is exe runned under a username.(not local or system) that pretend to be undeletable is a trojan, virus to me. the way it work is you can not delete a single one you need to delete all at the same time dont' forget one or lese your comp wont boot not completly . cheers well guess what.

to me its a frigin virus with fancy names.

cause i gon on my comp wich is fine and any other well runing comp and i never say any of those 3 process.

a process that is exe runned under a username.(not local or system) that pretend to be undeletable is a trojan, virus to me.

the way it work is you can not delete a single one
you need to delete all at the same time
dont’ forget one or lese your comp wont boot
not completly
. cheers

]]> By: urborn2diehttp://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/comment-page-1/#comment-536865 urborn2die Fri, 14 Nov 2008 16:52:30 +0000 http://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/#comment-536865 Yogesh: If those are inside the system32 folder do NOT erase them. they are needed to run windows and you wont be able to erase them. One thing that must be said is that even with a file being in the system32 dir does not mean its NOT a virus. Make suer your antivirus scanner AND a anti malware/spyware program are updated and running. AVG internet program is great since it covers both virus and malware protection. Yogesh:
If those are inside the system32 folder do NOT erase them. they are needed to run windows and you wont be able to erase them.

One thing that must be said is that even with a file being in the system32 dir does not mean its NOT a virus. Make suer your antivirus scanner AND a anti malware/spyware program are updated and running. AVG internet program is great since it covers both virus and malware protection.

]]> By: yogeshhttp://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/comment-page-1/#comment-356776 yogesh Sat, 31 May 2008 12:20:03 +0000 http://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/#comment-356776 hello,i am getting problem with the smss.exe,crss.exe and winlogon.exe it is located in my system32 directory i can't do anything, every time i delete the file windows notify denied. please send me your update. thank you. hello,i am getting problem with the smss.exe,crss.exe and winlogon.exe it is located in my system32 directory i can’t do anything, every time i delete the file windows notify denied. please send me your update. thank you.

]]> By: z0iidhttp://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/comment-page-1/#comment-262419 z0iid Thu, 14 Feb 2008 14:26:19 +0000 http://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/#comment-262419 system32\dllcache is used to store system copies/backups of windows dll's. sfc (System File Checker) uses this to replace system dll's that get corrupted, deleted, renamed, or otherwise removed. If you suspect your system files have been tampered with - at the cmd prompt, type: sfc /scannow system32\dllcache is used to store system copies/backups of windows dll’s. sfc (System File Checker) uses this to replace system dll’s that get corrupted, deleted, renamed, or otherwise removed. If you suspect your system files have been tampered with – at the cmd prompt, type: sfc /scannow

]]> By: TANUJ KUMARhttp://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/comment-page-1/#comment-261427 TANUJ KUMAR Wed, 13 Feb 2008 06:22:59 +0000 http://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/#comment-261427 HI , i am found this file smss.exe it is system32 but it is also found system32\dllcache. it would be trojan or virus.... HI , i am found this file smss.exe it is system32 but it is also found system32\dllcache. it would be trojan or virus….

]]> By: Martinhttp://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/comment-page-1/#comment-238657 Martin Tue, 15 Jan 2008 22:36:14 +0000 http://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/#comment-238657 It is most likely a virus or trojan. Try scanning it with virustotal.com or download a virus scanner like AVG or Antivir and check it with them. It is most likely a virus or trojan. Try scanning it with virustotal.com or download a virus scanner like AVG or Antivir and check it with them.

]]> By: Mountainhttp://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/comment-page-1/#comment-238647 Mountain Tue, 15 Jan 2008 22:19:53 +0000 http://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/#comment-238647 I found this file smss.exe not only in System32 but also found in Windowmedia/Skin or smt like that ! Do u think it would be Trojan or Virus ? I found this file smss.exe not only in System32 but also found in Windowmedia/Skin or smt like that ! Do u think it would be Trojan or Virus ?

]]> By: 解释Windows进程中的三个文件 » Ghacks CNhttp://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/comment-page-1/#comment-227436 解释Windows进程中的三个文件 » Ghacks CN Sun, 30 Dec 2007 14:26:41 +0000 http://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/#comment-227436 [...] 原文链接。 [...] [...] 原文链接。 [...]

]]> By: Jenhttp://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/comment-page-1/#comment-225964 Jen Fri, 28 Dec 2007 06:10:48 +0000 http://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/#comment-225964 To summarize, don't mess with any of them unless they arent' located in C:\Windows\System32. :) To summarize, don’t mess with any of them unless they arent’ located in C:\Windows\System32. :)

]]> By: Mhttp://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/comment-page-1/#comment-225791 M Thu, 27 Dec 2007 21:44:15 +0000 http://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/#comment-225791 Sorry dude but this was a totally half-assed post. If you aspire to tell people what these processes are actually doing (even if briefly) then don't just tell us their full names and repeat the same line (not in system32 = trojan) THREE times in a 10 line post. No point bringing up a topic if you have to end up dodging around it. Sorry dude but this was a totally half-assed post. If you aspire to tell people what these processes are actually doing (even if briefly) then don’t just tell us their full names and repeat the same line (not in system32 = trojan) THREE times in a 10 line post. No point bringing up a topic if you have to end up dodging around it.

]]> By: z0iidhttp://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/comment-page-1/#comment-225701 z0iid Thu, 27 Dec 2007 18:16:31 +0000 http://www.ghacks.net/2007/12/27/csrssexe-smssexe-and-lsassexe/#comment-225701 smss.exe is also responsible for running services.exe, which of course in turn, is responsible for all services running on your computer. smss.exe is also responsible for running services.exe, which of course in turn, is responsible for all services running on your computer.

]]>