Can I copy smss.exe from one computer to another?

[Triumph]

My dad's smss.exe got infected with a virus somehow, and since this is a critical Windows program, it can't be deleted or quarantined. It is also hogging all the resources, taking MUCH MUCH more CPU time than any other program, on the order of hours.

So can I just copy smss.exe from my computer and put it on his in DOS mode?

 

[Crusty]

What OS and filesystems are you using?

 

[Triumph]

win 2k, what do you mean file system? FAT32?

 

[bacillus]

have you tried running sfc /scannow from the command prompt?

 

[Triumph]

Originally posted by: bacillus
have you tried running sfc /scannow from the command prompt?

tried that, didn't fix the problem.

 

[NogginBoink]

What makes you think it got infected with a virus?

WFP won't let you delete it because it's determined that the version on the computer is the correct version. It determines this using a cryptographic hash to which only Microsoft has the key. The chances of a virus author being able to replace smss.exe (or any other MSFT file for that matter) and at the same time subvert WFP to 'trust' the malicious code is so close to zero that it's not worth considering.

I submit that you've probably misdiagnosed your problem. What is the REAL problem that you're trying to solve?

 

[Triumph]

Originally posted by: NogginBoink
What makes you think it got infected with a virus?

WFP won't let you delete it because it's determined that the version on the computer is the correct version. It determines this using a cryptographic hash to which only Microsoft has the key. The chances of a virus author being able to replace smss.exe (or any other MSFT file for that matter) and at the same time subvert WFP to 'trust' the malicious code is so close to zero that it's not worth considering.

I submit that you've probably misdiagnosed your problem. What is the REAL problem that you're trying to solve?

The real problem is that there is a copy of smss.exe in c:/winnt/web/printers/images, that is executed upon startup by some script command (i have no idea where it came from), and it can't be shutdown with task manager (because Windows says it is a critical system process). And that copy of smss is using all of the CPU resources. I don't know how that happened, that's why I'm here to get help.

So I went into c:/winnt/web/printers/images, renamed smss.exe to smss.123, now the startup script can't find the file it's looking for and it doesn't load smss.exe. However, windows of course runs the REAL smss.exe located in c:/winnt/system32. And all I get now is an error on startup from that script saying it can't find the file it's looking for.