Jump to content


Photo

virtual memory is low


  • Please log in to reply
2 replies to this topic

#1 shapemyshrubs

shapemyshrubs

    Member

  • Full Member
  • Pip
  • 2 posts

Posted 10 June 2004 - 08:45 PM

I was recently scourged with the CWS trojan and about:blank. Now I run Hijack This and CWShredder (thanks Merijn). Now I have a new problem. XP reports that i am running low on virtual memory and I'm sure it is. Eerything is running really slow, especially video performance. I remember reading a post on another forum where this dude had the same problem and it turned out to be a corrupted copy of svchost.exe and lsass.exe Startup list shows svchost runs twice. This seems odd to me.
Any replies would be greatly appreciated!

Logfile of HijackThis v1.97.7
Scan saved at 6:06:24 PM, on 6/10/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HijackThis.exe

R3 - Default URLSearchHook is missing
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O17 - HKLM\System\CCS\Services\Tcpip\..\{23BACDB5-2836-405E-A093-3E1D1140AB55}: NameServer = 10.1.1.34 10.1.1.12
O17 - HKLM\System\CS1\Services\Tcpip\..\{23BACDB5-2836-405E-A093-3E1D1140AB55}: NameServer = 10.1.1.34 10.1.1.12

#2 SpyWareBlows

SpyWareBlows

    Member

  • Full Member
  • Pip
  • 4 posts

Posted 25 June 2004 - 11:15 AM

I have the same problem, why won't anyone answer these questions? Did you figure this out?

Mike

#3 Charlesvar

Charlesvar

    Member

  • Full Member
  • Pip
  • 77 posts

Posted 25 June 2004 - 07:44 PM

OK try this:

Right click My computer > Properties > Advanced tab > in the Performance panel > settings > Advanced tab > bottom panel Virtual Memory: that number in MB's is the current size of the page file otherwise known as virtual memory. It should be for most users 1.5 times the size of your RAM - if physical memory = 256 MB, the page file should be 384 MB.

On the theory that its currupted, press the "change" bar > in the next panel labled virtual memory tick the "no paging file" button and then the "set" bar, then reboot. This erases the current page file.

When the system comes back up > go back into that last panel and tick the "system managed size" button and then the "set" bar and reboot again.

Regards - Charles

EDIT: Forgot to add, having multiple copies of svchost.exe is normal - I have up to 4 depending on what the system is doing. The reason for this is that XP's running services are "bundled" into svchost instead of listed individually.

Edited by Charlesvar, 25 June 2004 - 07:59 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button