Serious memory leak, explorer/system

[clutchsins]

So I use an old Dell GX270 SF desktop as a web, file, email and stream server. It has been running a couple months now no issue, then I got a virus a couple days ago. I fully removed it (Malware Bytes, AVG, spybot,  HJT, etc.) but now at 6:30AM every morning it starts beeping. When I look at the screen it says virtual memory running low and is using about 1.2GB of RAM, it usually idles around 300 tops with only 512MB installed. Explorer uses about 130MB and System about 20MB. I have scheduled tasks that run on certain intervals for backups and reboots but nothing that early in the morning, so I'm lost. It's bizarre that it's happened twice the same morning too. Help?

[Broni]

Read here: http://www.computerhope.com/forum/index.php/topic,46313.0.html
Start new topic here: http://www.computerhope.com/forum/index.php/board,7.0.html
Do NOT post any logs in THIS thread.

[clutchsins]

I think it's just a coincidence that it happened after a virus attack. Especially since I've never heard of a virus going specifically after explorer.exe, which seems buggy now too. Should I just grab a copy of it from one of my extra comps to try to fix the memory leak? Which only happens at 6:30AM for some reason...

[Broni]

I've never heard of a virus going specifically after explorer.exe

Well, since your experience says "Expert", you should have.

[clutchsins]

Hasn't been modified since it was created and put into windows OS. No go on that, and I've checked related registry settings so I have no idea. System and explorer.exe are both consuming a lot of memory and you and your ego are not helping this situation. Run mbam, spybot, AVG free, Avast!, and clamwin. I've checked HJT logs and removed the necessary old stuff. It's beyond virus right now.

[Broni]

Please, post some computer info:
- processor type, amount of RAM (hold Windows logo key, hit Pause/Break key)
- hard drive size/free space (open "My Computer", right click on hard drive letter, click "Properties")


Download Process Explorer: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
Unzip ProcessExplorer.zip, and double click on procexp.exe to run the program.
Click on View > Select Colunms.
In addition to already pre-selected options, make sure, the Command Line is selected, and press OK.
Go File>Save As, and save the report as Procexp.txt.
Attach the file to your next reply.

[clutchsins]

Dell GX270. P4 @ 2.4GHz, 512MB DDR RAM. 320 GB drive, NTFS, 266/298 used. Windows XP Pro SP2, no updates.

I've dug around in process explorer as well, nothing seems out of the ordinary. This is a web host and file server among others, but is mostly secure.

[attachment deleted by admin]

[Broni]

Process Explorer log looks almost normal with System Idle at 84.62%.
I said "almost normal", because I can see Deferred Procedure Calls at 4.62%, and explorer.exe at 3.08%.
Normally, those processes shouldn't be using any CPU cycles.
So, I'll still insist on double check at malware forum.

Then, you have 512MB of RAM. Your computer would be much more happy with 1GB.
Now, what is the page file set to? ...or is it managed by Windows?
I assume, you have a lot of space on that 320GB hard drive?

[clutchsins]

Page file is what windows set's it too, and I've been looking into upgrading to 1Gb. And you point at explorer too, I have been having issues with thumbnails loading for video files, tends to cause it to crash and restart.

EDIT: Just copied over a new copy of explorer.exe, we'll see if this helps.

[Broni]

Set page file manually to 768MB (min, and max)

Yes, I point to explorer.exe, and one of the reasons (not the only reason) of it using CPU abnormally is an infection.
I don't think replacing the file will help.
If explorer.exe was even slightly corrupted, you'd see a lot of mess on your computer.
With your amount of RAM, you better disable thumbnails.

[clutchsins]

Think an overhaul is in order?

[JJ 3000]

Run AVG free, Avast!,

Are you running both of those programs?

[Broni]

Not yet, at least until we really know what's going on.
RAM upgrade will definitely help.
For now you should go ahead with page file, and thumbnail view adjustments.

Please, download DDS from one of the 2 mirrors and save it to your desktop.

Mirror 1
Mirror 2

* Disable any script blocking protection (if present)
* Double click the dds icon to run the tool.
* When done, DDS will open two logs:
         1. DDS.txt
         2. Attach.txt
* Save both reports to your desktop by clicking File>Save As in each log.

Include the contents of both logs in your new topic. The scan will instruct you to post Attach.txt as an attachment. No need for that though ..... just post it's contents as you would any other log.

[Broni]

Are you running both of those programs?

Good eye
We'll see in a moment.

[clutchsins]

Are you running both of those programs?

Only installed/ran Avast! to double check everything, uninstalled after running it. Page file increased, thumbnails changed.

[attachment deleted by admin]