Memory problem

[bonbonboy]

Hi ,

I have a problem with RAM or something similar.
In past few days I installed AVG, used torrent to dl as usual, and past 2 days I had a problem with "Insuficient system resource to complete requested task".
I tought it could be becasue of AVG, as he uses a lot of CPU, as I could see.

I removed AVG, put PC TOOLS antivirus but my probelm is geting worse.
Fan is working all the time, temp of CPU is about 61 and curent usage of memory is minimum 440MB which is I presume too high.

Do I have a virus or rogue software or something?
I am just user so any advicein simple view would be helpful.


here is log file from hijack this if this helps:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:41:46, on 10.11.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\NMSAccessU.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\PC Tools\PC Tools Security\pctsAuxs.exe
C:\Program Files\PC Tools\PC Tools Security\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\PC Tools\PC Tools Security\pctsGui.exe
C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\daniel\Local Settings\Application Data\Akamai\netsession_win.exe
C:\Documents and Settings\daniel\Local Settings\Application Data\Akamai\netsession_win.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://media.warrock.net/inGameAds/index.html
R3 - URLSearchHook: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\4.7\pdfforgeToolbarIE.dll
R3 - URLSearchHook: YouTube Downloader Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\4.7\youtubedownloaderToolbarIE.dll
R3 - URLSearchHook: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll
R3 - URLSearchHook: PC Tools Browser Defender - {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Program Files\Arquivos comuns\InstallShield\Nero\nerocheck.exe,
O2 - BHO: WeFiBar - {0b876028-b388-4f6d-922f-f52faec8535f} - C:\Program Files\WeFiBar\prxtbWeF2.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O2 - BHO: Softonic-Eng7 - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\prxtbSof2.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\4.7\pdfforgeToolbarIE.dll
O2 - BHO: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: YouTube Downloader Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\4.7\youtubedownloaderToolbarIE.dll
O3 - Toolbar: WeFiBar Toolbar - {0b876028-b388-4f6d-922f-f52faec8535f} - C:\Program Files\WeFiBar\prxtbWeF2.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Softonic-Eng7 Toolbar - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\prxtbSof2.dll
O3 - Toolbar: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O3 - Toolbar: YouTube Downloader Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\4.7\youtubedownloaderToolbarIE.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\4.7\pdfforgeToolbarIE.dll
O3 - Toolbar: PC Tools Browser Defender - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\PC Tools\PC Tools Security\pctsGui.exe" /hideGUI
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Akamai NetSession Interface] C:\Documents and Settings\daniel\Local Settings\Application Data\Akamai\netsession_win.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O20 - Winlogon Notify: TPSvc - TPSvc.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Browser Defender Update Service - Unknown owner - C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\Common Files\NMSAccessU.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\PC Tools\PC Tools Security\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\PC Tools\PC Tools Security\pctsSvc.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe

--

 

[Motorheader]

How much physical ram do you have in your system? Is it 2gb or above? Since you are using the Intel onboard graphics and XP is this a laptop or desktop? I would look at removing or disabling some of the software utilities on your system to help with system resources at system boot. My system resources are pretty light at boot but it is in the 300mb range before starting any web browser.

Looking at the list you provided there doesn't appear to be any type of malware/virus related activity but that doesn't completely rule them out. If you are torrenting there is always a possibility of a rogue file no matter how good the AV product since the best AV is between your ears - smart computing. Why did you torrent the AVG product since there is a direct link on the website? Have you downloaded and used any type of keygen program?

Since you already have Malwarebytes installed have you updated it and run a thorough system scan? How about installing SuperAntiSpyware, updating it, and running a complete system scan as well. I would also look at either of the online scanners from Panda or Trendmicro.

 

[bonbonboy]

I ussualy download movies , AVG was taken legit from site and purchased.
But when I opened task manager, there were many AVG .exe files running, so I presumed it takes a lot of RAM.
I have 1 GB , using on my laptop.
I have Malwarebytes and spybot besides usual AV software.
I used them regularly , both in safe or "normal" mode, but nothing.

I would gladly remove some of those proccesses, but I can't determine which ?
On of biggest is called SYSTEM , it takes 124 MB..
firefox uses 100+ when in use,
how to choose which

 

[Motorheader]

Well 1gb memory is bare minimum and your total system heap is likely maxed when you start doing some other things. What is the make/model of your laptop?

 

[bonbonboy]

its HP 510 working on 2,26 Mhz

he was fast enough ,but I probably did something to the system so he is now working as a slave.

I used CCleaner and cleaned registry,but still there is a significant slow flow..

 

[Motorheader]

Well you could try using autoruns and going to the second tab (logon) to disable certain things at system boot to pinpoint what software (if any) could be at the root of the problem.

I still think that 1gb is bare minimum and it appears that the HP 510 only has 1 slot for memory and it doesn't support 2gb memory modules.

 

[bonbonboy]

ok, how can I do that?

I would also like to show you task manager list , but how?
now it using 776 MB, and dont understand why, as only big software is firefox with 123 MB... all others are for me unknown.

for example I have 2 files with same name
netsession_win.exe 11 MB
netsession_win.exe 25 MB

What to do? how to identify which is ok or not?

 

[fralexandr]

are you sure you have enough hard drive space? heh

spybot also uses quite a lot of resources
i would recommend windows defender as it's significantly lighter, but it never seems to catch anything :S (i don't think i get much spyware n stuff, though spybot's paranoid mode is pretty awesome)

for the task manager, you could probably take a few screenshots and post them although i'm not sure it'd be that helpful if hijackthis didn't get anything
if you seriously think it's malware, you could just reformat/reinstall windows

that netsession thing's been showing up lately... and it seems suspicious
i'd just remove it unless it's required for something

 

[bonbonboy]

sorry, but the list on task manager was too long to be taken in one shot.

I have 36 GB on C and aditional 2 TB on my external HD.
I download directly tomy external HD, so I dont use any space on laptop.


that netsession_win.exe is from some thingk calleD akamai,suposedly comes with ADOBE . aparently helps to download smoothly..., but it bothers me that I have 2 same files, one working uder SYSTEM and another under my name, both using about 50 MB at same time.

 

[Motorheader]

Netsession appears to be something from Netflix streaming. There is no need to have Malwarebytes or utorrent autostarting either.

Unless you use Windows Live and need it at startup you could disable both WLIDSvcM.exe and WLIDSVC.EXE.

For making print screens you can press the alt key and the print screen key to make the print screen and shift key and insert key to save it in your favorite document/image editing program for upload to your favorite image sharing service.

 

[bonbonboy]

whats a netflix? all I can see is that this AKAMAI is connected to that?do i need this akamai?
how do I disable those files from windows live?
i can stop it in task manager, but they came back every time i restart my pc.

 

[Motorheader]

With the autoruns app that I noted a few posts back. It is a handy utility to easily enable/disable items at startup for troubleshooting. Usually the second tab - logon - is where you want to look.

http://technet.microsoft.com/en-us/sysinternals/bb963902

You may also want to consider a different AV/Malware package than the one you are currently using - PCTools. From the screenshot provided there a quite a few processes that are automatically starting up that are just eating away at your limited memory heap. When I last used it I found AVG to not be any better either with regards to system resource usage. I believe someone in a previous post suggested Microsoft Security Essentials which I have found to be resource and user friendly.

 

[bonbonboy]

ok, does autorun advice which software should be disabled? as I don't want to disable any significant software.

 

[Motorheader]

No - much of can be done via common sense and your favorite search engine. The path for each program is listed to the right in the autoruns dialog box.

 

[bonbonboy]

well i used autorun , disabled windows life and some other software, but still average usage is over 500 MB, even if I don't use any software.


Probably I will have to reinstall windows, crap

p.s. update, Ijust removed PC TOOLS AV and restarted sistem...and its low on 225 MB, and fast---so nice, but I will try Microsoft Security Essentials

 

[bonbonboy]

well,

I installed avira AV and my pc is working fine, it droped to 340MB of used RAM, everything is running smooth for now.
I will keep you posted

 

[fralexandr]

kind of astonishing how crappy and bloated some of the paid for antiviruses are right? hah

 

[bonbonboy]

ok.
here is short review:
1. start up is really faster (usually I waited to see blue screen of windows about 1,5-2 minutes, now its 30secs)
2. usage of RAM dropped to 340 MB
3. I removed SPYBOT, desabled Malwarebytes
4.AVIRA works fast and easy
5. only this AKAMAI is giving me trouble with asking for tcp connection at start
(does anyone had this software installed? I didn't ask for him, can I remove it and still have working computer?)
6. I can hear fan working a bit stronger, and lavalys senzor states my CPU is on average 62*C...

p.s. Thank you very much for listening and helping.

 

[Ketchup]

In your hijackthis log I see a lot of toolbars. These usually try to update every time you start your computer. I would remove them via "ad/remove" or "programs and features" and restart.

Akami is not something you installed independently. It was part of something else you have installed, but it legit, most likely.