Virtual memory problem on XP?

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by bd@europe.com, Aug 10, 2007.

  1. bd@europe.com

    bd@europe.com Private E-2

    Hello,

    I have a problem that begins right when I start the computer. The computer goes extremelly slow, and normally I get a message that the virtual memory has reached its maximum. I get several other error messages until the computer gets completely frozen.

    If I can manage to open the Task manager, I can see that a svchost.exe process is running using more and more memory and the “Transactions load” is increasing up to the maximum.

    If I kill this svchost.exe process, the “Transactions load” or “pagefile use” in the performance chart of the Task manager go back to normal, and I can work more or less normally. After a while, a new svchost.exe process starts to increase its memory use again and the “PF use” starts increasing again.

    I attach a few prints screen to see the processes running in the task manager.

    This happens in normal mode as well as in “Safe mode with Networking Support”, but not in “Safe mode”.

    I have gone through the malware removal recommendations and will attach all the logs. I could not find much, except for a "Dropper.Small" virus in the system restore files of the Administrator user in safe mode. I guess I could remove these files by switching system restore off and on, but I haven't done so yet following the recommendations.

    My PC is a Pentium 4 CPU 3.00GHz, with 512 MB RAM, running Windows XP, Service Pack 2.

    I don't know if this problem is due to malware, but hopefully you can provide some advice.

    Thanks
    bd
     

    Attached Files:

  2. bd@europe.com

    bd@europe.com Private E-2

    I attach more logs
     
  3. bd@europe.com

    bd@europe.com Private E-2

    I attach the hijackthis log
     

    Attached Files:

  4. bd@europe.com

    bd@europe.com Private E-2

    The previous logs were not correctly attached.
     

    Attached Files:

  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please download and run CWShredder

    Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    After clicking fix, exit HJT

    Please copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    Now download The Avenger by Swandog469, and save it to your Desktop.

    * Extract avenger.exe from the Zip file and save it to your desktop
    * Run avenger.exe by double-clicking on it.
    * Check the 'Input script manually' box.
    * Click on the magnifying glass icon.
    * Copy everything in the Quote box below, and paste it in the box that opens:

    * Now click the 'Done' button.
    * Click on the traffic light icon and OK the prompt.
    * You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt

    Attach new logs for:
    Avenger
    ShowNew
    GetRun
     
    Last edited: Aug 10, 2007
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please use the latest versions of ShowNew and Get Run:
    ShowNew
    and
    GetRun.
     
  7. bd@europe.com

    bd@europe.com Private E-2

    Hi,

    Thanks for your reply.
    I have gone through all the steps:

    Run CWShredder. It removed:
    - CWS.Jksearch
    - CWS.HiddenDll

    Run HJT and fixed the 2 quotes.
    Updated the registry.
    Allowed Avenger to delete the 3 entries
    Run the newest version of ShowNew and GetRun

    I attach the logs.

    Right now the problem remains.

    BD
     

    Attached Files:

  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    We have one more to clean up before I give you the final cleaning.

    Run avenger.exe by double-clicking on it.
    * Check the 'Input script manually' box.
    * Click on the magnifying glass icon.
    * Copy everything in the Quote box below, and paste it in the box that opens:
    Now click the 'Done' button.
    * Click on the traffic light icon and OK the prompt.
    * You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt

    Attach new logs for:
    Avenger
    Shownew
    HJT

    Please tell me how things are running.
     
  9. bd@europe.com

    bd@europe.com Private E-2

    Hi,

    I encountered some problems this time while running avenger.
    After going through all the steps and rebooting the computer, the command window came out and the script was showing messages that it could not find C:\avenger\*.reg and some backup files. Then it was stuck and in the taskmanager I could see that the transactions load was going up. I killed the svchost.exe process and the avenger script kept on running but generated an empty log.

    I run it one more time and this time it went a bit better. I had to kill also the svchost.exe process but the avenger generated the log saying that it deleted the entry you mentioned.

    I attach the logs of avenger, hjt and shownew.

    The thing is that the problem remains the same.

    Besides, my Panda antivirus software warned me that the Internet explorer configuration had changed. Apparently it has a back-up copy of the configuration in case I would need to restore it. Was it something that we changed in the previous steps?
     

    Attached Files:

  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    C:\WINDOWS\RENT2005.INI ---->?

    Please print these instructions out, or write them down, as you can't read them during the fix.

    Download and Install RogueRemover Free .

    Run RogueRemover and select Scan and the program will walk you through the remaining steps.

    I'm going to post two sets of instructions below. Each will be enclosed in separate Quote boxes. Make sure to complete the first one 100% before moving on to the second one.

    A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. BUT Reboot in Safe Mode.

    The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed.

    Now reboot into normal mode and attach this new rapport.txt log here.
    Now attach new logs from:

    * GetRunKey
    * ShowNew
    * HJT

    How are things working now?
     
  11. bd@europe.com

    bd@europe.com Private E-2

    Hi,

    RENT2005 is a program that I installed from a safe source.

    Rogue Remover did not detect any items.

    I attach the log from SmitfraudFix Step 1.
     

    Attached Files:

  12. bd@europe.com

    bd@europe.com Private E-2

    I attach the log from SmitfraudFix step 2. Does it matter with which username I run it in Safe mode? I run it with my username. Should I run it with the Administrator username?

    The problem is still the same.
     

    Attached Files:

  13. bd@europe.com

    bd@europe.com Private E-2

    I attach GetRunKey, ShowNew and HJT logs
     

    Attached Files:

  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not seeing anything in your logs ......You may wish to install a startup manager and stop any programs that you don't want running.

    This sounds more like a driver problem .....or something that does not load in safe mode.

    Are you having any malware issues at this time?
     
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You could try a few things:
    • increase the size of virtual memory
    • uninstall Panda Titanium and use some things that are not so resource intensive. This security suite is probably bringing your system to its knees.
    • install more RAM. 512 MB is just not adequate these days.
     
  16. bd@europe.com

    bd@europe.com Private E-2

    "You may wish to install a startup manager"
    Do you have any recommendations?

    "Are you having any malware issues at this time?"

    Except from the problem I have described, no.
    If it is not malware related, do you believe that I could find some help in any other forum?

    increase the size of virtual memory
    I tried it in the first place and there was no change.

    uninstall Panda Titanium and use some things that are not so resource
    intensive. This security suite is probably bringing your system to its knees.

    I tried it already, uninstalled it and tried to run without it, and the problem was the same.

    install more RAM. 512 MB is just not adequate these days.
    I'm using the PC mainly for Internet and office tasks. I did not have the problem before without installing anything else.

    I guess I'll just try to format the PC and reinstall it.

    Thanks for your help anyway.
     
  17. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    This is a good and free Startup Manager

    You could try the software section to further check your system.

    And there are alternatives here Freeware Picks.

    Good luck.:)
     
  18. bd@europe.com

    bd@europe.com Private E-2

    OK. Thanks
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds