I have two questions and a problem. Firstly, when looking at the Windows Task Manager (processes tab) there are many processes which I do not recognise (such as LSASS.EXE, CSRSS.EXE, SMSS.EXE, etc). I presume these processes are critical to the Windows system, but is there a way to find out what these processes are, so I know what is running in the background? Secondly, Windows Defender regularly detects DSSAGENT. I always delete the item, but after a few days it reappears. Should I be worried about this behaviour? Finally, every time the computer starts it detects new hardware to install. The hardware is Symantec Settings Manager (which sounds more like software to me’¦). Every time this message appears I must click ‘Cancel’, since clicking ‘Continue’ prompts for a CD which I do not have. Interestingly, I do not have any Symantec products installed on the computer, and there are no such products listed in the Add/Remove Programs control panel. How can I stop the computer from attempting to install this hardware on startup, and can you explain how this situation arose? The computer is running Windows XP Home Edition.

It is always good to know what is running on your computer, so I am glad to see you taking a keen interest in this matter. The best place to look-up processes is www.processlibrary.com. This site will allow you to search for processes and, if the process is in the ProcessLibrary.com database, will return a description of the process. The three processes you quoted in your question are in the database, so head to the website and have a look. As another general rule of thumb, I always scrutinise heavily any processes running under my username. If the username column is not visible in the Task Manager, go to the ‘View’ menu > ‘Select Columns’ and enable ‘User Name’. Then, click the ‘User Name’ column to sort the processes by user name. I have found most of the at-risk processes (e.g. spyware, adware) are running under an individual user’s account, and not the system users. However, this is not always the case so don’t automatically treat the system processes as legitimate. That said, if you are unsure about any processes don’t just close them, since they could be vital system services. Make sure you research and understand what you are doing before modifying any processes.

Regarding the issue with DSSAGENT, looking up this process on ProcessLibrary.com (www.processlibrary.com/directory/files/DSSAGENT/index.php) yields results indicating this process is adware. Since the process reappears after removal, it is likely some other process on the computer is still present and recreating the process. There is even an article on Microsoft Knowledge Base (support.microsoft.com/kb/296077) about this process and the problems it can cause. So, we need to remove the process. Firstly, try downloading and running the removal utility (support.learningco.com/brodcastpatch.asp) offered by the organisation which included DSSAGENT in their product. While I have not run this removal utility myself, it seems relatively legitimate.

Should the removal utility not work, you could try a manual removal of DSSAgent. Firstly, use CTRL-ALT-DEL and, should the DSSAgent process be running, close the process. Next, go to the ‘Start’ menu > ‘Search’ and search the hard drive for the ‘DSSAgent.exe’ file (make sure you also enable the advanced search option to search system folders and hidden files and folders). Once the file has been found, rename the file to something else (e.g. ‘DSSAgent_old.exe’ or ‘DSSAgent.old’). This is just in case something goes wrong, and we need to restore the file. Once the file has been renamed, we need to remove the registry entries which caused DSSAgent to load on startup. Go to the ‘Start’ menu > ‘Run’ and type ‘regedit’ (without the quotes) and click OK. Navigate the following registry key:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows CurrentVersionRun.
Look in the right-hand pane and delete any entries relating to DSSAgent.exe. Repeat this procedure for this next registry key:
HKEY_CURRENT_USERSoftwareMicrosoftWindows CurrentVersionRun.
Restart the computer and scan the computer again to check whether the file has been recreated. If not, and there are no side effects, you can go back and delete the ‘DSSAgent.exe’ file which was renamed during the procedure.

Now, turning to the prompt appearing, asking to install the Symantec Settings Manager hardware. This is very strange for the obvious reason this is not hardware and also considering you do not have any Symantec software installed on the computer! There are some reports of others experiencing a similar issue, but I have been unable to find a definitive solution to the issue. Since you do not have any Symantec software installed, the most likely source of the software is remnants of a previous installation of Symantec software (e.g. Norton Antivirus, Norton Internet Security). When such software is installed, the Symantec Settings Manager (ccSetMgr.exe) is both a process and service running in the Windows background. It is likely this process/service is running on your computer, and causing the hardware installation wizard to appear. So, we need to disable the process and service. Firstly, check whether the process is running. Press CTRL-ALT-DEL and look at the Processes tab for the ‘ccSetMgr.exe’ process. Do not worry if this process is not present, just read on and continue with this procedure. The ccSetMgr.exe process does not load using the usual method of being in the ‘Run’ registry key, but instead loads as a Windows service. So, we need to disable the service. Go to the ‘Start’ menu > ‘Control Panel’. In the window that appears, open the ‘Administrative Tools’ control panel (you may first need to click the ‘Performance and Maintenance’ category) and then open ‘Services’. Scroll through the list of services until you find ‘Symantec Settings Manager’. Once found, right-click on the service and select ‘Properties’. Change the ‘Startup type’ to ‘Disabled’, and then click the ‘Stop’ button to immediately terminate the service. Click OK and close the Control Panel. Restart the computer and check if the problem persists.