On Sat, 19 Apr 2008 08:43:07 -0400, jgulow@webtv.net (John
the WebTV Man) wrote:

>Here's the latest..
>
>The problem still is that the computer will run normally for a period,
>then "stall" and not espond to either Mouse or Keyboard. By pulling the
>Power Plug and then reconnecting and restarting right away, it will
>again run normally for a period of time. AVG will provide a pop-up
>Threat Alert for a Trojan Horse Generic4.TAB detected in the "smss.exe"
>file. If I click "Ignore", the computer may continue to run. I have made
>online downloads where the computer ran for over an hour without
>stalling/freezing.

On a Win2k system using (virus updated definitions) AVG, I
scanned smss.exe, it did not detect it as a trojan. On that
Win2k system smss.exe was version 5.0.2195.6601, approx 45KB
in size, CRC value B8EB12B4. One copy is in the
/winnt/system32 folder, and an identical backup copy is in
the /winnt/system32/dllcache/ folder.

It might be possible I have an older version of this file
than you, but check yours as I doubt AVG should be detecting
this as a virus - and it may be one. Therefore if you are
infected you should work on removing those and/or doing a
clean windows install, otherwise who knows how much of your
problems are malware - even if there is another, different
problem present.


>The "Beast" is a Presario 5000 with a 900 MHz AMD Athlon CPU, 256 Mb
>RAM, 30 Gb Quantum Fireball HD, Windows 2000 Pro SP4 with ALL the
>upgrades, 56K PCTEL Platinum v.90 Compaq modem, SMC 10/100 Compaq LAN
>card, gForce nVidia Compaq Video card, CDROM, CD-RW, 3-5" 1.44Mb FD.
>Installed s/w includes... AVG 7.5 Anti-Virus, MS Office 2000, SpyBot
>S&D, Ad-Aware, and some lesser applications.
>
>I have spent the best part of yesterday and this morning playing with
>the computer and have tried a number of things to no avail. Here are
>some of the things I did, that made no difference to the problem:
>
>[1] Ran a complete Anti-Virus scan using AVG 7.5 with latest
>updates...it found nothing....made no improvement.

Then I don't understand why it was previously flagging
SMSS.EXE as a trojan. Also keep in mind that AVG, and other
AV products, may not find 100% of the malware and once one
such program finds it's way onto your system it may download
others if you have a working internet connection, and/or
replicate itself including a thread watching the files so if
they're removed they get replaced again. Some of those are
a real PITA and require running in safe mode, checking file
dates, what's running in the background, looking for hidden
files in the recycle bin and more... all kinds of tricky
things these malware might do to stay on a system.


>[2] Ran SpyBot S&D new update install and it picked up 12
>items...removed them and rebooted....made no improvement.
>
>[3] Ran new instal and updaatel of Ad-Aware and it detected 56 Cokies
>items which I deleted...made no difference
>
>[4] I replaced the2 256Mb RAM sticks with 2 new known good ones....made
>no difference, still had the Freeze condition.

Run memtest86+ for a couple hours, if there are any errors
that will need corrected before anything else... but I doubt
memory is causing the problem unless it's quite instable,
fewer errors will tend to cause crashes of one sort or
another instead of complete lockup.


>
>[5] Removed 2 USB Flash Drives [that both share IRQ 11] I had installed
>and that made no difference as I still got a Freeze.
>
>[6] I have rechecked and installed ALL the Microsoft Win2K
>Updates....all 65 of them and it made no difference afterward...still
>got the Freezes.
>
>[7] I ran the defrag [even tho it didn't really need Defrag] and after
>restart, that made no difference as a stall happened about 20 minutes
>later.

Don't defrag anymore until you know if the memory is stable.
If memtest86+ finds errors, now all your data is potentially
corrupt and should be gone through. Needing to defrag is a
performance factor only, will never cause this kind of
problem (lockup).


>
>In GOOGLE checking the "smss.exe". I found that a problem was a sign of
>a Trojan infection. Said that the SMSS.EXE file should be located in the
>C:\WINNT\system32\config folder...and if not, that was a sign of the
>Trojan problem. I have not found a "fix" to correct that problem and any
>help or suggestions are ost welcome and appreciated.

Well... do you have any copies of that file anywhere besides
\system32\ -and- \system32\dllcache\ folders?

If you do have other copies, delete them. If you can't in
regular mode, reboot to safe mode. Sometimes with really
difficult problems it is helpful to pull the drive out,
mount in another system, boot the other system to it's own
OS installation (not the one on the drive you just moved)(be
careful about this, sometimes a bios will see a new drive
and it happens to have defaulted to trying to boot the new
one), THEN scan the drive for malware.

If it'll help, here's a copy of smss v5.0.2195.6601 from
win2k w/SP4 & patches.
http://69.36.166.207/usr_1034/smss.exe
You can google for various CRC calc utilities to compare
your copy of smss.exe, it's CRC value to the one above or
the CRC value I listed further up in this post.

Another thing you might do is make a Ubuntu LiveCD, boot the
system to that and see if it freezes up. If so, odds are
high it is a hardware problem. If not, odds are better it's
something wrong with your windows installation and/or
malware on it still.