Page File

[Seekermeister]

I'm in the process of trying to cleanup a mess caused by a rogue program, and despite the fact that I have reinstalled everything that I can think of that might be associated, the problem still returns on occassion. This got me to thinking about the page file, because it stores data in a fashion that is not accessible by any means that I'm aware of. If I disable the page file, will that data actually be removed, so that when reenabled, it is rebuilt anew?

 

[mechBgon]

Tangentially, John has a malware-removal guide that would take care of most rogues of the SpyAxe sort, if that's what you're up against. http://www.elitekiller.com/malware.htm

If the rogue got on there by user unawareness or a browser/media-player exploit, then Limited user accounts are worth a look.

 

[Seekermeister]

I guess that I used the word "rogue" rather loosely, because it is not spyware, just a program that caused havoc on my system. Without rehashing it here, it is covered in:

http://forums.anandtech.com/messageview...atid=34&threadid=1989515&enterthread=y

 

[Nothinman]

The pagefile's data is discarded on every reboot so removing and recreating it isn't necessary but you can do it if you want. There's also a policy setting to zero the pagefile on shutdown if you'd like, but it'll slow your shutdown times a good bit.

 

[Seekermeister]

If the page file is discarded on reboot, then there would be no point in zeroing it on shutdown. The thing that sticks in my mind, is that I have read alot about the page file becoming fragmented, and suggestions of using a procedure like I described to rebuild it. If the page file is automatically discarded on reboot anyway, then I don't understand why it is suggested to disable it first.

 

[Nothinman]

The option to zero the pagefile on shutdown is to satisfy some paranoid people, it's possible that passwords and such could end up in the pagefile and if someone steals your hard disk they can read the pagefile.

I said the pagefile's data is discarded, not the pagefile itself. The data currently in there is just overwritten as necessary so the file itself says wherever it was. I've only heard of one instance where recreating the pagefile in a less fragmented manner was a provable fix for something and I really doubt you're in a similar situation. But if you want to recreate yours it won't hurt anything so go ahead, put a pagefile on another drive and disable the one on the OS drive then reboot and do the opposite to put them back.