# Magic disappearing memory



## TheMonkey (Aug 11, 2010)

This has been happening a lot lately, although seems to only occur in Win7.  My computer begins to slow and I wonder WTH is the problem.  Task manager tells me my total physical memory is 4094mb... with 261mb cached, 285mb available, and 25mb free.  Now I hate math but that just doesn't add up.  I have all of windows indexing services disabled, and my background process' are few.  Upon restart my memory has returned but will slowly drain itself to nothing in a matter of hours, is this just the worst memory leak known to man?  WTF is goin on?

Sorry if this is the wrong forum section, I put it in software assuming its a windows bug...


----------



## Bundy (Aug 11, 2010)

It sounds normal to me. Have a read about superfetchhere


----------



## TheMonkey (Aug 11, 2010)

Bundy said:


> It sounds normal to me. Have a read about superfetchhere



superfetch is considered an indexer... as I said indexing is disabled...

and when superfetch works you can watch the cached levels increase, this does not happen


----------



## Bundy (Aug 11, 2010)

Sorry, I misunderstood, I don't consider superfetch to be an indexer. Turning off indexing doesn't stop superfetch either. You have specifically shut down superfetch?


----------



## TheMonkey (Aug 11, 2010)

Bundy said:


> Sorry, I misunderstood, I don't consider superfetch to be an indexer. Turning off indexing doesn't stop superfetch either. You have specifically shut down superfetch?



Sorry for not being more specific...

Superfetch service is disabled.


----------



## streetfighter 2 (Aug 11, 2010)

I've noticed some virus scanners can steal huge amounts of memory and then not properly relinquish it when they're done (in Windows 7).  Perhaps the disturbingly useful Windows 7 Resource Monitor ("resmon.exe") can shed some light on it.  If you're still in the dark after checking the Resource Monitor and disabling anti-virus, I'd start disabling startup items, then services, then finally defenestrating the computer.

Best of luck!

PS. It could be a virus/trojan/malware (take your pick)...


----------



## NdMk2o1o (Aug 11, 2010)

maybe its just getting older, same shit happens to me, my memory gets worse by the day lol but yea Win 7 manages memory different than the likes of XP etc, I have 4GB and taskmgr tells me I have 35mb free lol, though my pc never slows down


----------



## 95Viper (Aug 12, 2010)

Why not use this and find the hog and get a real feel for where your memory is going.

How to Use the Resource Monitor in Windows 7
Take advantage of tools to monitor memory usage in Windows 7


----------



## TheMonkey (Aug 12, 2010)

streetfighter 2 said:


> I've noticed some virus scanners can steal huge amounts of memory and then not properly relinquish it when they're done (in Windows 7).  Perhaps the disturbingly useful Windows 7 Resource Monitor ("resmon.exe") can shed some light on it.  If you're still in the dark after checking the Resource Monitor and disabling anti-virus, I'd start disabling startup items, then services, then finally defenestrating the computer.
> 
> Best of luck!
> 
> PS. It could be a virus/trojan/malware (take your pick)...




According to the resource monitor 3771mb are "In Use" but looking at the active processes it is clear that less than 500mb of memory is actually allocated to background processes.  Disabling anti-virus has no effect on the issue, and my startup is nearly clear except a few important apps.  Kaspersky and MB scans report clean so its not a virus/malware issue.


----------



## TheMonkey (Aug 12, 2010)

95Viper said:


> Why not use this and find the hog and get a real feel for where your memory is going.
> 
> How to Use the Resource Monitor in Windows 7
> Take advantage of tools to monitor memory usage in Windows 7
> http://media.wiley.com/Lux/32/147732.image0.jpg





Please refer to my above reply, you misunderstood the issue.


----------



## 95Viper (Aug 12, 2010)

TheMonkey said:


> Please refer to my above reply, you misunderstood the issue.



Oh, OK, guess I did.

GoodLuck with your problem.


----------



## TheMonkey (Aug 12, 2010)

*screen*

Maybe a screenshot will help...


----------



## hellrazor (Aug 12, 2010)

Why do you have explorer.exe open like 6 times?

And WTF is Everything.exe?


----------



## TheMonkey (Aug 12, 2010)

hellrazor said:


> Why do you have explorer.exe open like 6 times?
> 
> And WTF is Everything.exe?



Everything.exe is a great search tool I use...


I don't know why explorer was open so many times... All but one shut down now didn't change the status of the resources..


----------



## 95Viper (Aug 12, 2010)

hellrazor said:


> Why do you have explorer.exe open like 6 times?
> 
> And WTF is Everything.exe?



That is an program indexing\caching he does not have. Or, virus...

___________________________________________________________

You have nothing unusual for all the junk you have running.
AND, you have a font cache running.

So, what is the problem.
Get rid of some of it.

As, far as the difference, in the total and installed you have a piece of hardware that is using some for it's own purpose (cache or working area).  Video\bios caching maybe.


----------



## twilyth (Aug 12, 2010)

hellrazor said:


> Why do you have explorer.exe open like 6 times?
> 
> And WTF is Everything.exe?



Nice catch - that looks bogus.  3771M in use?  So, an app that is trying to hide it's memory usage.  Might be time to break out the virus scanners.  Start with Malwarebytes and maybe MSE (Microsoft security essentials) - both free.


----------



## hellrazor (Aug 12, 2010)

Also, I'm no Winblows 7 expert, but Hard Faults (bottom right graph) don't sound all that appealing to me.

And Opera.exe seems to be feeding them.


----------



## TheMonkey (Aug 12, 2010)

95Viper said:


> That is an program indexing\caching he does not have. Or, virus...
> 
> ___________________________________________________________
> 
> ...



Everything doesn't work at all like superfetch and will never use up more than 40mb.  I have scanned with MSE, kaspersky, malwarebytes so far... all clean

I don't know what font cache is can u pls explain?

So are you saying a piece of my hardware is using over 3gb of my physical memory??


----------



## 95Viper (Aug 12, 2010)

hellrazor said:


> Also, I'm no Winblows 7 expert, but Hard Faults (bottom right graph) don't sound all that appealing to me.
> 
> And Opera.exe seems to be feeding them.



Hard faults are not a problem.  Just means that the pointer was not in the cache and the system had to look on the drive.

But that everything.exe and explorer would make me suspicious.

Everything exe, from voidtools, a search engine for Windows that replaces the normal Windows search with a much faster one. Unlike Windows search, Everything initially displays every file and folder on your computer. You can type in a search filter to limit what files and folders are displayed. Everything only uses file and folder names and generally takes a few seconds to build its database. 1,000,000 files will take about 1 minute.Version 1.1.4.301 adds -search command line option, improved status of servers under the tool menu, and other fixes.

Notice the Flags on the website.


----------



## TheMonkey (Aug 12, 2010)

95Viper said:


> Hard faults are not a problem.  Just means that the pointer was not in the cache and the system had to look on the drive.
> 
> But that everything.exe and explorer would make me suspicious.
> 
> ...



Don't like those countries? Damn communists and their dirty software..

Its a legit tool lol


This has happened several times on different copies of windows 7 and the explorer.exe running multiple times was not a factor.


----------



## hellrazor (Aug 12, 2010)

I'm looking for something that says "designed by Korean gangsters, made in China".

lol.


----------



## 95Viper (Aug 12, 2010)

TheMonkey said:


> Everything doesn't work at all like superfetch and will never use up more than 40mb.  I have scanned with MSE, kaspersky, malwarebytes so far... all clean
> 
> I don't know what font cache is can u pls explain?
> 
> So are you saying a piece of my hardware is using over 3gb of my physical memory??



Presentationfontcache.exe is a program that caches fonts for quick access by programs.
Useless really.

No, with all the stuff you have loaded it is using the memory and the hardware I was referring to was the difference between the installed memory and total memory.

Edit:
Those countries make some of the best firewalls and spyware.


----------



## TheMonkey (Aug 12, 2010)

95Viper said:


> Presentationfontcache.exe is a program that cache fonts for quick access by programs.
> Useless really.
> 
> No, with all the stuff you have loaded it is using the memory and the hardware I was referring to was the difference between the installed memory and total memory.




Any clue what is actually using the resources?


----------



## hellrazor (Aug 12, 2010)

Aside from something made by 2 of the best countries to get spyware from? No clue.


----------



## TheMonkey (Aug 12, 2010)

hellrazor said:


> Aside from something made by 2 of the best countries to get spyware from? No clue.



With responses like that I'm surprised your not banned yet..

I made it clear that I have run several scans... with MSE/kaspersky/malwarbytes.. no results


----------



## twilyth (Aug 12, 2010)

hellrazor said:


> Aside from something made by 2 of the best countries to get spyware from? No clue.



How do you send samples to AV companies?  This voidtools site looks like it could a treasure trove for them.


----------



## TheMonkey (Aug 12, 2010)

twilyth said:


> How do you send samples to AV companies?  This voidtools site looks like it could a treasure trove for them.



lol I hope u guys are joking....


http://download.cnet.com/Everything/3000-2379_4-10890746.html

Its on freakin CNET

Even with a nice little tested spyware free message!


----------



## 95Viper (Aug 12, 2010)

TheMonkey said:


> lol I hope u guys are joking....
> 
> 
> http://download.cnet.com/Everything/3000-2379_4-10890746.html
> ...



You can never be sure.  Remember, Sony wouldn't install a rootkit... would they.

Also, the only spyware\virus that will be caught are the ones that are known...

___________________________________________________________________________

Do this:
Open taskmanager, find presentationfontcache.exe, right click and choose "end process tree" and see if that clears up some.  Then try it with everything.exe. and, so on. Just don't end any windows processes or system processes.


----------



## erocker (Aug 12, 2010)

I suggest doing a reinstall, and not installing all of these "Windows replacement apps" and see how it looks then. If things look good, go ahead and start installing your apps and check your task manager after each install.


----------



## TheMonkey (Aug 12, 2010)

95Viper said:


> You can never be sure.  Remember, Sony wouldn't install a rootkit... would they.
> 
> Also, the only spyware\virus that will be caught are the ones that are known...
> 
> ...




I restarted since then to make sure explorer only starts once... atm not having the resource issue.. As it only happens after the machine has been running for awhile.

I also want to point out that this problem does not present itself consistently... Sometimes I may have to wait 3 hours for the issue to present itself, while other times I will not happen for weeks on end.  This is why I don't believe it has anything to do with Everything (which is my only replacement app) which is always running on startup and always has been.  I have also used this application on many other win 7 machines and many of my friends use it as well and report no issues.


----------



## twilyth (Aug 12, 2010)

95Viper said:


> You can never be sure.  Remember, Sony wouldn't install a rootkit... would they.
> 
> Also, the only spyware\virus that will be caught are the ones that are known...


Some programs use heuristics - Avira and Sophos.  Avira will give you 60 days free.


----------



## twilyth (Aug 12, 2010)

TheMonkey said:


> I restarted since then to make sure explorer only starts once... atm not having the resource issue.. As it only happens after the machine has been running for awhile.
> 
> I also want to point out that this problem does not present itself consistently... Sometimes I may have to wait 3 hours for the issue to present itself, while other times I will not happen for weeks on end.  This is why I don't believe it has anything to do with Everything (which is my only replacement app) which is always running on startup and always has been.  I have also used this application on many other win 7 machines and many of my friends use it as well and report no issues.


Does it do auto updates?  Maybe it's not a virus and just a bad build that wasn't properly tested.  IDK.


----------



## TheMonkey (Aug 12, 2010)

erocker said:


> I suggest doing a reinstall, and not installing all of these "Windows replacement apps" and see how it looks then. If things look good, go ahead and start installing your apps and check your task manager after each install.



I would prefer not to do a complete win reinstall and even if I did it would be very hard to see which installed app was presenting the problem...  the problem doesn't present itself consistently.  The problem will at times take weeks to present itself (I rarely turn off my PC), but sometimes I will experience it within a couple hours of boot up.

If there are no other leads I will try reinstalling... just don't wanna f-up my bootloader again and have to BCDEDIT all over again.


----------



## TheMonkey (Aug 12, 2010)

twilyth said:


> Does it do auto updates?  Maybe it's not a virus and just a bad build that wasn't properly tested.  IDK.



It does not auto-update... I will get the latest build and see what happens.

EDIT: checked I have the latest


----------



## 3volvedcombat (Aug 12, 2010)

Sounds like what erocker said is the best option.

You sir have alot of 40mb using programs add up 20+ and a hole line of processes and your not doing any good, its freaky and funny at the same time.

Reinstall your windows- 

And check your task manager as you install other things.

4gigs should be at least 50% free on desktop.

even with norton.


----------



## 95Viper (Aug 12, 2010)

Try this:
Using MSCONFIG to troubleshoot conflicts in Windows Vista and Windows 7
Using Windows 7 System Configuration Utility (Msconfig)

Just some FYI, this is a great little program for messing with the boot loader.
"EasyBCD is NeoSmart Technologies' multiple award-winning answer to taking control of your bootloader. EasyBCD extends and revamps the Windows Vista/Windows 7 BCD bootloader, and with EasyBCD, almost anything is possible. Setting up and configuring a dual-boot between Windows 7, Windows Vista, older versions of Windows such as XP & 2003, Linux, Ubuntu, BSD, and Mac OS X is a breeze. You just point & click and EasyBCD does the rest."

Edit: Oh, and, Free.


----------



## TheMonkey (Aug 12, 2010)

3volvedcombat said:


> You sir have alot of 40mb using programs add up 20+ and a hole line of processes and your not doing any good, its freaky and funny at the same time.
> 
> Reinstall your windows-
> 
> ...


a hole line of processes and your not doing any good?  You mean the processes aren't doing any good?  Nearly all of them are system processes!  Besides the explorer repeat process that is cleared up and ATI catalyst/AV/Soundcardapp/VCDsoftware there is nothing else running.  I have over 3.5gigs of "In Use" memory but only 500mb or so allocated to programs so sayeth the Performance Manager..


----------



## DannibusX (Aug 12, 2010)

When was the last time you reinstalled Windows?


----------



## TheMonkey (Aug 12, 2010)

95Viper said:


> Try this:
> Using MSCONFIG to troubleshoot conflicts in Windows Vista and Windows 7
> Using Windows 7 System Configuration Utility (Msconfig)
> 
> ...



I am more than familiar with MSCONFIG.. and I have EasyBCD installed just as of late... Actually just used it to change the name of bootload options and hadn't used it before then but it looks like it would be quite easy...compared to BCDEDIT


----------



## TheMonkey (Aug 12, 2010)

DannibusX said:


> When was the last time you reinstalled Windows?



The copy discussed here probably 2 years... My other copy of Win7 Ult probably 4 months, my other copy has shown the same problem..

Oh i forgot my newer copy doesn't have everything installed... so it can't be the issue........ UNLESS... its infecting its way into my other OS!!!! /sarcasm


----------



## DannibusX (Aug 12, 2010)

Do you have all of the same apps installed on the PC with the fresher copy?

Reinstall Windows on one of your PCs and monitor the memory usage.  Windows should be reinstalled every so often, I usually do mine every six months just to keep things fresh.


----------



## TheMonkey (Aug 12, 2010)

DannibusX said:


> Do you have all of the same apps installed on the PC with the fresher copy?
> 
> Reinstall Windows on one of your PCs and monitor the memory usage.  Windows should be reinstalled every so often, I usually do mine every six months just to keep things fresh.



I saw your post as mine appear... lol ... everything by voidtools is not installed on the fresher copy.


----------



## DannibusX (Aug 12, 2010)

You said you shut down the indexing programs in Windows.  Can you double check and make sure Superfetch is off?  It needs to be shut down seperately from the othe indexing options.


----------



## IINexusII (Aug 12, 2010)

i dont think you should be messing with things like superfetch, its part of windows 7 and youre not letting the os work the way it wants by disabling it

but yeah you got some virus sucking up the memory so id say reinstall windows


----------



## TheMonkey (Aug 12, 2010)

IINexusII said:


> i dont think you should be messing with things like superfetch, its part of windows 7 and youre not letting the os work the way it wants by disabling it
> 
> but yeah you got some virus sucking up the memory so id say reinstall windows



no its not a virus... and windows should always be messed with... Have u ever heard of UAC... its part of win7 and the OS wants it...


----------



## TheMonkey (Aug 12, 2010)

DannibusX said:


> You said you shut down the indexing programs in Windows.  Can you double check and make sure Superfetch is off?  It needs to be shut down seperately from the othe indexing options.



Superfetch was disabled via services.msc .... checked again, for sure disabled.  Remember when superfetch is enabled the cache is slowly filled and can be observed in task manager.  In my case the memory just seemed to disappear it didn't end up in a windows cache.

I disable UAC and superfetch off the bat when I install


----------



## streetfighter 2 (Aug 12, 2010)

TheMonkey said:


> Superfetch was disabled via services.msc .... checked again, for sure disabled.
> 
> I disable UAC and superfetch off the bat when I install



I'd leave superfetch on to be honest.  It can really help with boot times.  Enable it, download tweakprefetch then set superfetch to "Boot Only" (leave prefetch setting at "Applications & Boot").

Can you just post an HJT log?  I think it'd be a lot easier to sort out if we knew what you were running.

Also I thoroughly disagree with anyone advocating reinstalling Windows 7, especially at regular intervals.  Unless you did something irreversibly incorrect during install or have screwed up the system so bad that the repair time approaches infinity then there is no reason to reinstall.  What I would do, which isn't necessarily the fastest fix but certifiably a way to determine the source of the problem, is to disable crap one by one until it stops happening.  I'd start with stuff that runs at startup, then having killed all of them, move on to services and finally defenestrate my computer or reformat.  Defenestrating is much more fun, but awkward afterwards.


----------



## TheMonkey (Aug 12, 2010)

streetfighter 2 said:


> I'd leave superfetch on to be honest.  It can really help with boot times.  Enable it, download tweakprefetch then set superfetch to "Boot Only" (leave prefetch setting at "Applications & Boot").
> 
> Can you just post an HJT log?  I think it'd be a lot easier to sort out if we knew what you were running.
> 
> Also I thoroughly disagree with anyone advocating reinstalling Windows 7, especially at regular intervals.  Unless you did something irreversibly incorrect during install or have screwed up the system so bad that the repair time approaches infinity then there is no reason to reinstall.  What I would do, which isn't necessarily the fastest fix but certifiably a way to determine the source of the problem, is to disable crap one by one until it stops happening.  I'd start with stuff that runs at startup, then having killed all of them, move on to services and finally defenestrate my computer or reformat.  Defenestrating is much more fun, but awkward afterwards.



Its not really an option to disable things one by one and check. It can take hours to weeks for the issue to replicate itself, waiting that long between program installs would be a bit exhausting..

HJT log attached ... it is the full log... the screenshot cuts off the "End of file"


----------



## streetfighter 2 (Aug 12, 2010)

TheMonkey said:


> Its not really an option to disable things one by one and check. It can take hours to weeks for the issue to replicate itself, waiting that long between program installs would be a bit exhausting..
> 
> HJT log attached ... it is the full log... the screenshot cuts off the "End of file"



I'm looking at the log now.

It's a very slow leak if it takes weeks to manifest itself in a noticeable form.  As such, I guess it would not make sense to disable programs and services.  Hopefully something stands out in your HJT log.

EDIT:
What the hell is that nasty looking BHO with the CLSID?  That doesn't show up on your virus scanners?  (I'm googling it now.)


----------



## 3volvedcombat (Aug 12, 2010)

Now thats my destop with some things opened

Now in your case- I see processes- running and not just 1 of every process- but more like 5 of every process in different usages from 10mb to 60mb like SVxxxxx.exe 

Actually makes me shout virus because thats rediculas for all that local network.exe  . 

and explorer.exe .

CATCH IS.

only 2gb of memory on this system.

So im telling you- once again- You need to reinstall your OS because something got jacked when installing a conflicting program or something.


----------



## streetfighter 2 (Aug 12, 2010)

I'm not happy with whatever the BHO with only a CLSID is in your HJT log.  I looked on google for that CLSID and it appears to be associated with nothing good.  That by itself doesn't mean it's a virus but it is a reason for concern.  Backup your log, fix the BHO then restart.  If the BHO is still there I'd be even more concerned.

The BHO entry in HJT for reference:
BHO: (no name) - {C7BA40A1-74F2-52BD-F411-04B15A2C8953}  - (no file)

If you're up to the task, I'd recommend running combofix just to be safe.

You can try disabling the following startup programs and services (skip any that you use regularly).  *DO NOT USE HJT TO REMOVE THEM!*:
-googleupdateservice.exe
-adobe gamma loader.exe
-Service: Adobe LM Server (just set it to manual)
-Service: Install Driver Table Manager
-Service: Windows Media Player Network Sharing Service
You run a clean system and it was a pleasure to read your HJT log!  

Out of the few non-critical programs/services you have I believe the above are most likely to cause memory leaks and disabling them should have no adverse effect on your computer usage.

Unfortunately HJT does not show everything, especially in Windows 7, so there may still be an issue.  My greatest concern is that strange BHO.


----------



## TheMonkey (Aug 12, 2010)

3volvedcombat said:


> http://img.techpowerup.org/100811/Capture091874.jpg
> 
> Now thats my destop with some things opened
> 
> ...



As I said the explorer.exe was a one time thing, and multiple instances of SVChost.exe is completely normal ask any comp guru. When I close chrome I see 37 processes running in task manager.. looks like i'm running a little slimmer than you... 

In all seriousness this isn't a virus that has already been determined.


----------



## TheMonkey (Aug 12, 2010)

streetfighter 2 said:


> I'm not happy with whatever the BHO with only a CLSID is in your HJT log.  I looked on google for that CLSID and it appears to be associated with nothing good.  That by itself doesn't mean it's a virus but it is a reason for concern.  Backup your log, fix the BHO then restart.  If the BHO is still there I'd be even more concerned.
> 
> The BHO entry in HJT for reference:
> BHO: (no name) - {C7BA40A1-74F2-52BD-F411-04B15A2C8953}  - (no file)
> ...



Checking into that entry now..

Removed the entry, it was listed as (no file).  I disabled WMP network sharing service, changed adobe LM to manual, and left the other 2 on manual (default).

After restart the BHO entry is gone... will wait to see if this makes a difference


----------



## streetfighter 2 (Aug 12, 2010)

TheMonkey said:


> Checking into that entry now..
> 
> Removed the entry, it was listed as (no file).  I disabled WMP network sharing service, changed adobe LM to manual, and left the other 2 on manual (default).
> 
> After restart the BHO entry is gone... will wait to see if this makes a difference



I'm assuming that BHO isn't a part of your problem because it didn't put up a fight.  (You can search your registry with that CLSID if you're really curious.)  Hopefully those few modifications fixes your problem.  Seems unlikely though . . .


----------



## TheMonkey (Aug 12, 2010)

streetfighter 2 said:


> I'm assuming that BHO isn't a part of your problem because it didn't put up a fight.  (You can search your registry with that CLSID if you're really curious.)  Hopefully those few modifications fixes your problem.  Seems unlikely though . . .



Only time will tell... thanks for your efforts


----------



## TheMonkey (Aug 30, 2010)

*No Luck*

The problem has manifested itself again, I took a new screenshot..


----------



## streetfighter 2 (Aug 31, 2010)

I hate to say it but, aside from reformatting, it looks like you're up a particularly unpleasant creek.  You could also try disabling Windows Defender but I doubt that'll do much good.


----------



## twilyth (Aug 31, 2010)

I don't feel like going through the thread, but have you tried process explorer?  That should be able to ferret out any hidden processes and give you and idea of who is gobbling memory.


----------



## TheMonkey (Aug 31, 2010)

twilyth said:


> I don't feel like going through the thread, but have you tried process explorer?  That should be able to ferret out any hidden processes and give you and idea of who is gobbling memory.



I will try this app and see if I can find any "hidden" processes...


----------



## TheMonkey (Aug 31, 2010)

streetfighter 2 said:


> I hate to say it but, aside from reformatting, it looks like you're up a particularly unpleasant creek.  You could also try disabling Windows Defender but I doubt that'll do much good.



Defender was already disabled, thanks for all the help offered.  I am probably not going to format seeing as all I have to do is restart and I am usually good for hours to weeks.  I am more interested in eventually figuring out the issue than removing it.


----------



## RejZoR (Aug 31, 2010)

Unless you're experiencing problems, i wouldn't really bother with it. The thing is, ppl used to have all their RAM as empty as possible. Latest Windows do the opposite. Use as much as possible and free it as needed. So what Task Manager says is rather menaingless these days as OS caches stuff on its own.


----------



## TheMonkey (Aug 31, 2010)

RejZoR said:


> Unless you're experiencing problems, i wouldn't really bother with it. The thing is, ppl used to have all their RAM as empty as possible. Latest Windows do the opposite. Use as much as possible and free it as needed. So what Task Manager says is rather menaingless these days as OS caches stuff on its own.



I understand, and this has already been mentioned.  If you notice in the screenshot the amount of cached memory is 664mb.  The allocated memory is over 3,000mb this is the problem.  It is, according to windows, not allocated to cache but allocated to active processes which cannot be determined.  All memory allocated to cache is label with cache/standby not "in use".


----------



## TheMonkey (Aug 31, 2010)

twilyth said:


> I don't feel like going through the thread, but have you tried process explorer?  That should be able to ferret out any hidden processes and give you and idea of who is gobbling memory.



Here is a screenshot of process explorer running.   I didn't noticed anything that looked suspicious but ill let you guys take a peek.

I am adding another pic, perhaps this is caused by this write caching feature on the HDD's?  I cannot disable it on all my HDD's, it tells me that the feature cannot be disabled on certain drives.  I have disabled it on all that allow me to do so, I am going to restart and report back if the problem presents itself again.


----------



## EastCoasthandle (Aug 31, 2010)

End these processes and see what happens to your memory usage using just task manager:
dllhost.exe
MSMpEng.exe
everything.exe
rundll32.exe (all of them)


----------



## TheMonkey (Aug 31, 2010)

EastCoasthandle said:


> End these processes and see what happens to your memory usage using just task manager:
> dllhost.exe
> MSMpEng.exe
> everything.exe
> rundll32.exe (all of them)



I killed all but dllhost which did not appear in taskmanager.. no changes


----------



## EastCoasthandle (Aug 31, 2010)

Use AutoRuns and look at your startup processes.  If you already deleted some of those processes then reboot 1st before using autoruns.


----------



## TheMonkey (Aug 31, 2010)

EastCoasthandle said:


> Use AutoRuns and look at your startup processes.  If you already deleted some of those processes then reboot 1st before using autoruns.



Autoruns attached


----------



## mordant80 (Aug 31, 2010)

Is your windows media player network sharing service disabled by chance?  If not it has caused me strange cpu usage and memory usage issues that forced me to reboot like you..  i'd make sure it's disabled if you're not using it.  just a thought.

Edit: Nevermind, I see that you have


----------



## EastCoasthandle (Aug 31, 2010)

Other then making sure that both MSE and Malwarebytes don't "auto run" the only other thing that stands out is that:Google Installer"	"Google Inc."	"c:\users\rainbow-pilot\appdata\local\google\update\googleupdate.exe".  I can't seem to find anything about what that is.  Specially the rainbow-pilot subdirectory it creates in the user directory.  Do you know what that is?

Run Hijackthis and see what comes up.

Edit: I recall something similar on some one else's computer in which Chrome was uninstalled leaving that.  If that's the case try and uninstal/remove that if you don't need it.


----------



## TheMonkey (Aug 31, 2010)

EastCoasthandle said:


> Other then making sure that both MSE and Malwarebytes don't "auto run" the only other thing that stands out is that:Google Installer"	"Google Inc."	"c:\users\rainbow-pilot\appdata\local\google\update\googleupdate.exe".  I can't seem to find anything about what that is.  Specially the rainbow-pilot subdirectory it creates in the user directory.  Do you know what that is?
> 
> Run Hijackthis and see what comes up.
> 
> Edit: I recall something similar on some one else's computer in which Chrome was uninstalled leaving that.  If that's the case try and uninstal/remove that if you don't need it.



I assume googleupdate came with chrome... I have deleted the update dir, I'm sure if chrome needs it it will recreate the folder.  The google users dir contains the folders Chrome/Crashreports/Update.


----------



## streetfighter 2 (Sep 1, 2010)

EastCoasthandle said:


> I can't seem to find anything about what that is.  Specially the rainbow-pilot subdirectory it creates in the user directory.  Do you know what that is?
> 
> Run Hijackthis and see what comes up.
> 
> Edit: I recall something similar on some one else's computer in which Chrome was uninstalled leaving that.  If that's the case try and uninstal/remove that if you don't need it.



  "rainbow-pilot" is his username.  I'm sorry TheMonkey, I beg your forgiveness but when I read your HJT log this caught me off guard as well.  I nearly died laughing when I matched it to your avatar.  No matter how long I've been doing this crap, nothing could have prepared me for that.  Much love! 

EastCoastHandler- We've been down that path (regarding HJT logs) and although I was unable to shed light on the problem, perhaps you could (link).



TheMonkey said:


> I assume googleupdate came with chrome... I have deleted the update dir, I'm sure if chrome needs it it will recreate the folder.  The google users dir contains the folders Chrome/Crashreports/Update.



I've explored it briefly and the directory (%localappdata%\google\update) and executable appear to check out.  Like most google software it's annoying to remove, but it's also mostly harmless.  I do not believe this to be directly related to your problem.


----------



## EastCoasthandle (Sep 1, 2010)

Do you have memory remapping enabled from the motherboard's bios?


----------



## TheMonkey (Sep 1, 2010)

streetfighter 2 said:


> "rainbow-pilot" is his username.  I'm sorry TheMonkey, I beg your forgiveness but when I read your HJT log this caught me off guard as well.  I nearly died laughing when I matched it to your avatar.  No matter how long I've been doing this crap, nothing could have prepared me for that.  Much love!



 thats awesome... glad u made the connection


----------



## TheMonkey (Sep 1, 2010)

EastCoasthandle said:


> Do you have memory remapping enabled from the motherboard's bios?


 I will check ...

I don't see any memory remapping setting in my bios


----------



## EastCoasthandle (Sep 1, 2010)

TheMonkey said:


> I will check ...
> 
> I don't see any memory remapping setting in my bios



What about Memory Hole Remapping?  In any case check to see if you have the lastest bios from them.  I35RD823 version did fix 64bit memory and 4GB memory issues (if that's the correct bios for your MB).  However, there have been more recent bios updates then that.

Not sure if yours is the INF. BloodIron_P35-T2RL or INF. BloodIron_P35-T2L or some other board.  

Sidenote:
If you do need to update the bios make sure that it's in stock, working settings.


----------



## TheMonkey (Sep 1, 2010)

EastCoasthandle said:


> What about Memory Hole Remapping?  In any case check to see if you have the lastest bios from them.  I35RD823 version did fix 64bit memory and 4GB memory issues (if that's the correct bios for your MB).  However, there have been more recent bios updates then that.
> 
> Not sure if yours is the INF. BloodIron_P35-T2RL or INF. BloodIron_P35-T2L or some other board.
> 
> ...



I have the T2RL... I updated the bios to the newest revision a long time ago when I upgraded to my 45nm wolfdale, seems to still be the most recent revision.  I will check that other bios option and report back.


----------



## TheMonkey (Sep 22, 2010)

I have been busy moving into a new home and didn't have more time to mess around with it anymore.  Since relocating I have solved my problem in a round about way.  "CachemanXP" has solved all my problems, I could care less what the real problem was.  Up and running at full speed again... finally.


----------

