‎Virtual Memory Loss | DELL Technologies

Start a discussion

UNSOLVED

flea2402

updated

19 years ago

F

flea2402

35 Posts

0

2100

January 28th, 2008 18:00

Virtual Memory Loss

In the past, I've been able to leave my desktop computer on for weeks at a time with no problems. But recently I'll go back to the computer after a short while and it will say something like "not enough virtual memory left, may have to disallow access to some programs" and "error at svhost"and then the computer is extremely slow, and has trouble opening and closing programs. When I try to hit ctrl, alt, delete, it comes up for a fraction of a second and disappears so fast I can't see anything. Also I continually hear my External HDD like a program is accessing memory, but no programs are running. Also, when I right click on my C:Drive or my external HDD (E:) instead of "OPEN" it has a funny word with accents marks over the letters like this Îòêðûòü. Any help would be most appreciated. HJT Log below: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:07:50 PM, on 1/28/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\shovth.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [sis32] C:\WINDOWS\system32\winsos.exe O4 - HKLM\..\Run: [winroot] C:\WINDOWS\system32\winsn.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} (FixController Control) - http://h30155.www3.hp.com/ediags/dd/install/HPInstallMgr_v01_5.cab O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: hpdj - HP - C:\DOCUME~1\Flea\LOCALS~1\Temp\hpdj.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- End of file - 3554 bytes

F
flea2402
35 Posts
541
0
Posted January 28th, 2008 18:00
I forgot to check the box to convert carriage returns to html: This post will be easier to read - Sorry

In the past, I've been able to leave my desktop computer on for weeks at a time with no problems. But recently I'll go back to the computer after a short while and it will say something like "not enough virtual memory left, may have to disallow access to some programs" and "error at svhost"and then the computer is extremely slow, and has trouble opening and closing programs. When I try to hit ctrl, alt, delete, it comes up for a fraction of a second and disappears so fast I can't see anything. Also I continually hear my External HDD like a program is accessing memory, but no programs are running. Also, when I right click on my Crive or my external HDD (E instead of "OPEN" it has a funny word with accents marks over the letters like this Îòêðûòü.

Any help would be most appreciated. HJT Log below:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:07:50 PM, on 1/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\shovth.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [sis32] C:\WINDOWS\system32\winsos.exe
O4 - HKLM\..\Run: [winroot] C:\WINDOWS\system32\winsn.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} (FixController Control) - http://h30155.www3.hp.com/ediags/dd/install/HPInstallMgr_v01_5.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: hpdj - HP - C:\DOCUME~1\Flea\LOCALS~1\Temp\hpdj.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 3554 bytes
B
bamajim
1 Rookie
•
10376 Posts
541
0
Posted January 28th, 2008 20:00
flea2402

Is that the same pc as we looked at here?

http://www.dellcommunity.com/supportforums/board/message?board.id=si_hijack&message.id=77182#M77182

Microsoft MVP Windows-Security

CastleCops Instructor

"The world is what you make of it"
F
flea2402
35 Posts
542
0
Posted January 29th, 2008 14:00
No, That was my work laptop, this is my home desktop.
B
bamajim
1 Rookie
•
10376 Posts
542
0
Posted January 30th, 2008 14:00

flea2402

All right, let's get going

1. Go HERE and download FakeAlertFix (new version)

Save it to your Desktop. But do not run it yet.

2. Reboot into Safe Mode
This can be done by

Restart your PC, and after it starts, but before you see the Windows Splash screen
Begin tapping the F8 key twice a second untill you reach another menu screen (black background with white menu choices)
Use your arrow keys and select Safe Mode and then Enter

3. Close all Internet Explorer Windows and Run FakeAlertFix

Double click the fakealertfix.Zip file to unzip it.
Open the FakeAlertFix Folder
Double Click FakeAlertFix.vbe to run the program
Then Select O.K. at the prompt
Allow the program to run (Your desktop will disappear, then re-appear. This is normal)
When it is finished it wil produce a log C:\FakeAlertFix.txt
Copy and paste the results of that log in your reply

4. Then reboot your PC into Normal Windows Mode->> Rerun Hijackthis and post a fresh Hiajckthis log.
As well as the C:\FakeAlertfix.txt log

Note: you may have to post the results in more than one reply

Microsoft MVP Windows-Security

CastleCops Instructor

"The world is what you make of it"
B
bamajim
1 Rookie
•
10376 Posts
542
0
Posted January 30th, 2008 18:00

flea2402

It looks like your script found the shovth.exe and deleted it both times, so it looks like it keeps coming back. When I looked at the task manager after rebooting that file wasn't there, but after about 3 seconds, it appeared at the top of the list.

Yeah, but it also found this, ARGH!

C:\WINDOWS\trayicons.exe

So for that we need another tool

1. Go HERE and download MydoomFix

Save it to your Desktop. But do not run it yet.

2. Reboot into Safe Mode
This can be done by

Restart your PC, and after it starts, but before you see the Windows Splash screen
Begin tapping the F8 key twice a second untill you reach another menu screen (black background with white menu choices)
Use your arrow keys and select Safe Mode and then Enter

3. Close all Internet Explorer Windows and Run MydoomFix

Double click the MydoomFix.Zip file to unzip it.
Open the GaggleFix Folder
Double Click MydoomFix.vbe to run the program
Then Select O.K. at the prompt
Allow the program to run (Your desktop will disappear, then re-appear. This is normal)
When it is finished it wil produce a log C:\MydoomFix.txt
Copy and paste the results of that log in your reply

4. Then reboot your PC into Normal Windows Mode->> Rerun Hijackthis and post a fresh Hiajckthis log.
As well as the C:\MydoomFix.txt log

Note: you may have to post the results in more than one reply

Microsoft MVP Windows-Security

CastleCops Instructor

"The world is what you make of it"
F
flea2402
35 Posts
542
0
Posted January 30th, 2008 18:00
So I accidently clicked on the script right after it downloaded so it ran before I could go into safe mode. I then went to safe mode and ran it again. So below are two copies of the FakeAlertFix file. After I rebooted, I was able to press ctrl, alt, delete and the task manager came up. That's good. It looks like your script found the shovth.exe and deleted it both times, so it looks like it keeps coming back. When I looked at the task manager after rebooting that file wasn't there, but after about 3 seconds, it appeared at the top of the list.

FakeAlertFix 1:
========================================
FakeAlertFix

Version 1.5.5

By bamajim @ CastleCops.com

========================================

C:\WINDOWS\trayicons.exe Found!
C:\WINDOWS\trayicons.exe Deleted!
C:\WINDOWS\system32\winsos.exe Found!
C:\WINDOWS\system32\winsos.exe Deleted!
C:\WINDOWS\system32\winsn.exe Found!
C:\WINDOWS\system32\winsn.exe Deleted!
C:\Windows\System32\WinAvXX.exe Found!
C:\Autorun.inf Deleted!
C:\WINDOWS\system32\shovth.exe Found!
C:\WINDOWS\system32\shovth.exe Deleted!
========================================

Values under HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

%windir%\system32\sessmgr.exe
C:\Program Files\BitLord\BitLord.exe
C:\Program Files\iTunes\iTunes.exe

FakeAlertFix 2:
========================================
FakeAlertFix

Version 1.5.5

By bamajim @ CastleCops.com

========================================

C:\WINDOWS\system32\shovth.exe Found!
C:\WINDOWS\system32\shovth.exe Deleted!
========================================

Values under HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

%windir%\system32\sessmgr.exe
C:\Program Files\BitLord\BitLord.exe
C:\Program Files\iTunes\iTunes.exe

New HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:08:30 PM, on 1/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} (FixController Control) - http://h30155.www3.hp.com/ediags/dd/install/HPInstallMgr_v01_5.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: hpdj - HP - C:\DOCUME~1\Flea\LOCALS~1\Temp\hpdj.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 3405 bytes
F
flea2402
35 Posts
542
0
Posted January 30th, 2008 18:00
Additionally, it's not letting me access the task manager again. So whatever your script did to fix that, it was only temporary.
F
flea2402
35 Posts
542
0
Posted January 30th, 2008 18:00
Additionally I noticed that if I right click on the C: and E: drive under my computer it still says Îòêðûòü instead of OPEN. I took a look at the autorun.inf files for each drive hear is what is in them

C:
[autorun]
open=
shell\open=Îòêðûòü
shell\open\Command=540C462D.exe
shell\open\Default=1

E:
[autorun]
open=
shell\open=Îòêðûòü
shell\open\Command=98BE14CF.exe
shell\open\Default=1

Maybe that helps.
B
bamajim
1 Rookie
•
10376 Posts
542
0
Posted January 30th, 2008 18:00
flea4202

You will have to manually delete the E:\Autorun.inf

The script will not do it for you.

Microsoft MVP Windows-Security

CastleCops Instructor

"The world is what you make of it"
F
flea2402
35 Posts
496
0
Posted January 30th, 2008 19:00
So I manually went into E:\Autorun.inf, deleted it and it came back after a reboot with the same content

[autorun]
open=
shell\open=Îòêðûòü
shell\open\Command=98BE14CF.exe
shell\open\Default=1