Virtual memory problem on XP? No malware found

Hello,

I have a problem that begins right when I start the computer. The computer goes extremelly slow, and normally I get a message that the virtual memory has reached its maximum. I get several other error messages until the computer gets completely frozen.

If I can manage to open the Task manager, I can see that a svchost.exe process is running using more and more memory and the “Transactions load” is increasing up to the maximum.

If I kill this svchost.exe process, the “Transactions load” or “pagefile use” in the performance chart of the Task manager go back to normal, and I can work more or less normally. After a while, a new svchost.exe process starts to increase its memory use again and the “PF use” starts increasing again.

I attached a few prints screen to see the processes running in the task manager in my post in the malware removal forum.

This happens in normal mode as well as in “Safe mode with Networking Support”, but not in “Safe mode”.

I posted first in the malware removal forum, but after all types of checks, we could not find any malware on my computer causing this problem and they recommended to post on this forum.

My PC is a Pentium 4 CPU 3.00GHz, with 512 MB RAM, running Windows XP, Service Pack 2.

I tried to increase the size of virtual memory in the first place and there was no change.

I tried to run without Panda Titanium AV suite, and the problem was the same.

I'm using the PC mainly for Internet and office tasks and I did not have the problem before without installing anything else. It just started one day for an unknown reason to me.

I hope you can provide some help.

Thanks
bd

 

Hi,

Actually this happens at start-up, so except for the applications run at start-up, nothing is running. After killing the svchost.exe process and after a while, without starting any other applications, it starts again. Actually, I've noticed that more or less at the same time, the look of the Start tool bar at the bottom of the screen switches to the old Windows 2000 look, and then comes back to the Windows XP look.

I attach a print screen of all running processes "by default", i.e. without having any applications opened on my PC.

I did download the start-up manager but except for one application that I know, I did not disable anything because I am not sure what they are. I attach a print screen of the start-up manager window.

 

Does anybody have any idea about this?

Thanks in advance
bd

 

svchost.exe is a generic executable used by Windows for many, many tasks.

However, from this quote, I would suggest that this particular instance of svchost.exe is the one used by the Windows 'Themes' service:

http://img127.imageshack.us/img127/513/themesyk9.gif

Killing this service would produce these exact symptoms. I usually recommend disabling this as a performance-boosting technique. Could you live with that, bd-at-europe.com?

It is kind of workaround-ish, so we might try looking to the event logs for further information, working towards a permanent fix. Hopefully, it logs something when we kill it while pinning the CPU.

 

Hmmm... re-reading this part makes me think it could also possibly be the 'Automatic Updates' or 'Background Intelligent Transfer Service' services, as they both use the svchost.exe executable, and they should be running in Safe mode /w networking, where 'Themes' should not be running in either!

Are we absolutely certain we are killing the right instance of svchost.exe when the start bar looks like Windows 2000?

If not, we may be in luck, as there is a patch for Windows to correct this issue, as described in this thread