System cache issue!

**jstut** · October 24th, 2005, 01:39 PM

On my performance tab, I get a constant slow building of usage. This weekend, I set the kid up with his own login, but have deleted. I ran HJT, and deleted anything looking odd. Got a couple of random shut downs, and am wondering what the tie in is. Ran AVG, PANDA, ADaware, still getting a build up. Sys Cache rising, Available falling, K mem Paged rising!
Processor running 0-2%. Got any ideas on where I'm bugged?
Thanks!

**NooNoo** · October 24th, 2005, 02:12 PM

That's called a memory leak...
One of your programs is not returning memory to the pool when it's closed.

Usual suspects are "free games" and Word 97.. so what do you start on a regular basis?

**jstut** · October 24th, 2005, 04:01 PM

My boy has been pulling down free games from the net. I think I may have killed w/hjt. Not sure NooNoo. How do I confirm? Let me recheck and get back to you! Think you nailed it though!!!!!!!!
Thanks.

**jstut** · October 24th, 2005, 04:03 PM

Nope, still have the leak!!!!

**jstut** · October 24th, 2005, 04:31 PM

How do I find the leak? (I put my tower in a tub of water, but didn't see any bubbles.)

**NooNoo** · October 24th, 2005, 04:36 PM

hmm, if the bath tub method didn't work then you will have to do it the hardway.

Using msconfig first of all, uncheck everything from starting up. Does it still leak? If so, it's not one of those... then you start uninstalling things or disabling them until you find it....sorry, it's a long boring process.

**thirdfey** · October 24th, 2005, 11:11 PM

You've got a paged pool memory leak, congrats. What Noo is recommending will work fine. Another thing to do is to just bring up the windows task manager (ctrl-shift-esc), go to the processes tab, select view, columns and check paged pool. When the system is eating up paged pool memory you can look and see which process is using up the most. Although that may not definitively point out the culprit.

**jstut** · October 25th, 2005, 11:05 AM

I did find a program, FOX Movies. Will not allow me to remove through Control Panel.

**NooNoo** · October 25th, 2005, 12:54 PM

Take a look in program files for the executable - often you will find the uninstaller there - may be called unwise.exe.

**jstut** · October 25th, 2005, 05:45 PM

Not there, but did find a couple of references in regedit. Can I delete ther to kill?

**jstut** · October 26th, 2005, 10:18 AM

Fox is gone.....deleting applications/programs, still have leak. Could this be another issue? Auto update for example?

**NooNoo** · October 26th, 2005, 12:22 PM

never seen autoupdate leak ...

time for a hijack this log I think...

**jstut** · October 26th, 2005, 05:23 PM

Thank you!!
If you ever make it to FLA, I will do a tour of Disney you won't believe!!!!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Panda Software\Panda Platinum Internet Security\APVXDWIN.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Panda Software\Panda Platinum Internet Security\passrv.exe
C:\Program Files\Panda Software\Panda Platinum Internet Security\Firewall\PavFires.exe
C:\Program Files\Panda Software\Panda Platinum Internet Security\SRVLOAD.EXE
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Platinum Internet Security\pavsrv51.exe
C:\Program Files\Panda Software\Panda Platinum Internet Security\psimsvc.exe
C:\Program Files\Panda Software\Panda Platinum Internet Security\AVENGINE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Panda Software\Panda Platinum Internet Security\WebProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\discutil\hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Platinum Internet Security\Inicio.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Platinum Internet Security\APVXDWIN.EXE" /s
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Panda Antispam Service (PASSRV) - Unknown owner - C:\Program Files\Panda Software\Panda Platinum Internet Security\passrv.exe
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Platinum Internet Security\Firewall\PavFires.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Platinum Internet Security\pavsrv51.exe
O23 - Service: Panda Imanager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Platinum Internet Security\psimsvc.exe

**NooNoo** · October 27th, 2005, 03:04 AM

Err why are you running both Panda and AVG?
support.lexmark.com see if there are any newer drivers/utils for your printer.

As for spyware guard and spybot. These should be tested by turning them off and checking the memory pool.

If you took this log when the leak is occurring, then it has to be one of the above... or the nero process.

PS Been there, done that, going back

- Where were you when I was there?!