Magic disappearing memory

[streetfighter 2]

I'm not happy with whatever the BHO with only a CLSID is in your HJT log. I looked on google for that CLSID and it appears to be associated with nothing good. That by itself doesn't mean it's a virus but it is a reason for concern. Backup your log, fix the BHO then restart. If the BHO is still there I'd be even more concerned.

The BHO entry in HJT for reference:
BHO: (no name) - {C7BA40A1-74F2-52BD-F411-04B15A2C8953} - (no file)

If you're up to the task, I'd recommend running combofix just to be safe.

You can try disabling the following startup programs and services (skip any that you use regularly). DO NOT USE HJT TO REMOVE THEM!:
-googleupdateservice.exe
-adobe gamma loader.exe
-Service: Adobe LM Server (just set it to manual)
-Service: Install Driver Table Manager
-Service: Windows Media Player Network Sharing Service
You run a clean system and it was a pleasure to read your HJT log!

Out of the few non-critical programs/services you have I believe the above are most likely to cause memory leaks and disabling them should have no adverse effect on your computer usage.

Unfortunately HJT does not show everything, especially in Windows 7, so there may still be an issue. My greatest concern is that strange BHO.

 

[TheMonkey]

http://img.techpowerup.org/100811/Capture091874.jpg

Now thats my destop with some things opened

Now in your case- I see processes- running and not just 1 of every process- but more like 5 of every process in different usages from 10mb to 60mb like SVxxxxx.exe

Actually makes me shout virus because thats rediculas for all that local network.exe .

and explorer.exe .

CATCH IS.

only 2gb of memory on this system.

So im telling you- once again- You need to reinstall your OS because something got jacked when installing a conflicting program or something.

As I said the explorer.exe was a one time thing, and multiple instances of SVChost.exe is completely normal ask any comp guru. When I close chrome I see 37 processes running in task manager.. looks like i'm running a little slimmer than you...

In all seriousness this isn't a virus that has already been determined.

 

[TheMonkey]

I'm not happy with whatever the BHO with only a CLSID is in your HJT log. I looked on google for that CLSID and it appears to be associated with nothing good. That by itself doesn't mean it's a virus but it is a reason for concern. Backup your log, fix the BHO then restart. If the BHO is still there I'd be even more concerned.

The BHO entry in HJT for reference:
BHO: (no name) - {C7BA40A1-74F2-52BD-F411-04B15A2C8953} - (no file)

If you're up to the task, I'd recommend running combofix just to be safe.

You can try disabling the following startup programs and services (skip any that you use regularly). DO NOT USE HJT TO REMOVE THEM!:
-googleupdateservice.exe
-adobe gamma loader.exe
-Service: Adobe LM Server (just set it to manual)
-Service: Install Driver Table Manager
-Service: Windows Media Player Network Sharing Service
You run a clean system and it was a pleasure to read your HJT log!

Out of the few non-critical programs/services you have I believe the above are most likely to cause memory leaks and disabling them should have no adverse effect on your computer usage.

Unfortunately HJT does not show everything, especially in Windows 7, so there may still be an issue. My greatest concern is that strange BHO.

Checking into that entry now..

Removed the entry, it was listed as (no file). I disabled WMP network sharing service, changed adobe LM to manual, and left the other 2 on manual (default).

After restart the BHO entry is gone... will wait to see if this makes a difference

 

[streetfighter 2]

Checking into that entry now..

Removed the entry, it was listed as (no file). I disabled WMP network sharing service, changed adobe LM to manual, and left the other 2 on manual (default).

After restart the BHO entry is gone... will wait to see if this makes a difference

I'm assuming that BHO isn't a part of your problem because it didn't put up a fight. (You can search your registry with that CLSID if you're really curious.) Hopefully those few modifications fixes your problem. Seems unlikely though . . .

 

[TheMonkey]

I'm assuming that BHO isn't a part of your problem because it didn't put up a fight. (You can search your registry with that CLSID if you're really curious.) Hopefully those few modifications fixes your problem. Seems unlikely though . . .

Only time will tell... thanks for your efforts

 

[TheMonkey]

No Luck

The problem has manifested itself again, I took a new screenshot..

 

[streetfighter 2]

I hate to say it but, aside from reformatting, it looks like you're up a particularly unpleasant creek. You could also try disabling Windows Defender but I doubt that'll do much good.

 

[twilyth]

I don't feel like going through the thread, but have you tried process explorer? That should be able to ferret out any hidden processes and give you and idea of who is gobbling memory.

 

[TheMonkey]

I don't feel like going through the thread, but have you tried process explorer? That should be able to ferret out any hidden processes and give you and idea of who is gobbling memory.

I will try this app and see if I can find any "hidden" processes...

 

[TheMonkey]

I hate to say it but, aside from reformatting, it looks like you're up a particularly unpleasant creek. You could also try disabling Windows Defender but I doubt that'll do much good.

Defender was already disabled, thanks for all the help offered. I am probably not going to format seeing as all I have to do is restart and I am usually good for hours to weeks. I am more interested in eventually figuring out the issue than removing it.

 

[RejZoR]

Unless you're experiencing problems, i wouldn't really bother with it. The thing is, ppl used to have all their RAM as empty as possible. Latest Windows do the opposite. Use as much as possible and free it as needed. So what Task Manager says is rather menaingless these days as OS caches stuff on its own.

 

[TheMonkey]

Unless you're experiencing problems, i wouldn't really bother with it. The thing is, ppl used to have all their RAM as empty as possible. Latest Windows do the opposite. Use as much as possible and free it as needed. So what Task Manager says is rather menaingless these days as OS caches stuff on its own.

I understand, and this has already been mentioned. If you notice in the screenshot the amount of cached memory is 664mb. The allocated memory is over 3,000mb this is the problem. It is, according to windows, not allocated to cache but allocated to active processes which cannot be determined. All memory allocated to cache is label with cache/standby not "in use".

 

[TheMonkey]

I don't feel like going through the thread, but have you tried process explorer? That should be able to ferret out any hidden processes and give you and idea of who is gobbling memory.

Here is a screenshot of process explorer running. I didn't noticed anything that looked suspicious but ill let you guys take a peek.

I am adding another pic, perhaps this is caused by this write caching feature on the HDD's? I cannot disable it on all my HDD's, it tells me that the feature cannot be disabled on certain drives. I have disabled it on all that allow me to do so, I am going to restart and report back if the problem presents itself again.

 

[EastCoasthandle]

End these processes and see what happens to your memory usage using just task manager:
dllhost.exe
MSMpEng.exe
everything.exe
rundll32.exe (all of them)

 

[TheMonkey]

End these processes and see what happens to your memory usage using just task manager:
dllhost.exe
MSMpEng.exe
everything.exe
rundll32.exe (all of them)

I killed all but dllhost which did not appear in taskmanager.. no changes

 

[EastCoasthandle]

Use AutoRuns and look at your startup processes. If you already deleted some of those processes then reboot 1st before using autoruns.

 

[TheMonkey]

Use AutoRuns and look at your startup processes. If you already deleted some of those processes then reboot 1st before using autoruns.

Autoruns attached

 

[mordant80]

Is your windows media player network sharing service disabled by chance? If not it has caused me strange cpu usage and memory usage issues that forced me to reboot like you.. i'd make sure it's disabled if you're not using it. just a thought.

Edit: Nevermind, I see that you have

 

[EastCoasthandle]

Other then making sure that both MSE and Malwarebytes don't "auto run" the only other thing that stands out is that:Google Installer" "Google Inc." "c:\users\rainbow-pilot\appdata\local\google\update\googleupdate.exe". I can't seem to find anything about what that is. Specially the rainbow-pilot subdirectory it creates in the user directory. Do you know what that is?

Run Hijackthis and see what comes up.

Edit: I recall something similar on some one else's computer in which Chrome was uninstalled leaving that. If that's the case try and uninstal/remove that if you don't need it.

 

[TheMonkey]

Other then making sure that both MSE and Malwarebytes don't "auto run" the only other thing that stands out is that:Google Installer" "Google Inc." "c:\users\rainbow-pilot\appdata\local\google\update\googleupdate.exe". I can't seem to find anything about what that is. Specially the rainbow-pilot subdirectory it creates in the user directory. Do you know what that is?

Run Hijackthis and see what comes up.

Edit: I recall something similar on some one else's computer in which Chrome was uninstalled leaving that. If that's the case try and uninstal/remove that if you don't need it.

I assume googleupdate came with chrome... I have deleted the update dir, I'm sure if chrome needs it it will recreate the folder. The google users dir contains the folders Chrome/Crashreports/Update.

 

[streetfighter 2]

I can't seem to find anything about what that is. Specially the rainbow-pilot subdirectory it creates in the user directory. Do you know what that is?

Run Hijackthis and see what comes up.

Edit: I recall something similar on some one else's computer in which Chrome was uninstalled leaving that. If that's the case try and uninstal/remove that if you don't need it.

"rainbow-pilot" is his username. I'm sorry TheMonkey, I beg your forgiveness but when I read your HJT log this caught me off guard as well. I nearly died laughing when I matched it to your avatar. No matter how long I've been doing this crap, nothing could have prepared me for that. Much love!

EastCoastHandler- We've been down that path (regarding HJT logs) and although I was unable to shed light on the problem, perhaps you could (link).

I assume googleupdate came with chrome... I have deleted the update dir, I'm sure if chrome needs it it will recreate the folder. The google users dir contains the folders Chrome/Crashreports/Update.

I've explored it briefly and the directory (%localappdata%\google\update) and executable appear to check out. Like most google software it's annoying to remove, but it's also mostly harmless. I do not believe this to be directly related to your problem.

 

[EastCoasthandle]

Do you have memory remapping enabled from the motherboard's bios?

 

[TheMonkey]

"rainbow-pilot" is his username. I'm sorry TheMonkey, I beg your forgiveness but when I read your HJT log this caught me off guard as well. I nearly died laughing when I matched it to your avatar. No matter how long I've been doing this crap, nothing could have prepared me for that. Much love!

thats awesome... glad u made the connection

 

[TheMonkey]

Do you have memory remapping enabled from the motherboard's bios?

I will check ...

I don't see any memory remapping setting in my bios

 

[EastCoasthandle]

I will check ...

I don't see any memory remapping setting in my bios

What about Memory Hole Remapping? In any case check to see if you have the lastest bios from them. I35RD823 version did fix 64bit memory and 4GB memory issues (if that's the correct bios for your MB). However, there have been more recent bios updates then that.

Not sure if yours is the INF. BloodIron_P35-T2RL or INF. BloodIron_P35-T2L or some other board.

Sidenote:
If you do need to update the bios make sure that it's in stock, working settings.