Vista - Vista 64 booting with only 254mb memory!

Hey all,

I'm Alex and I'm new. I work in a third level support Microsoft / Citrix based platform team, so do lots of high end support and development / arcitectural work... Just signed up here after having a really odd problem with Vista and its high time I embraced the Vista forums anyway, as they've been a great help to me in the past

OK, I booted Vista yesterday and it was really really slow. To the point that it spent over 5 minutes on the loading 'welcome' screen, before rebooting, and if left would rinse, repeat the process etc...

System essentials; Q6600, 4gb RAM, Abit IP35-Pro, Vista Ultimate 64

After getting on in safe mode, I can see that;

• the system is only using 254mb of physical memory! That is all it shows as available in task manager
• I can see from the performance charts that the memory is maxed out at around 98% all the time. Even trying to run AV in safe mode is painfully slow
• I cannot even get into my event logs to see if there are any errors.
• Start > right click 'Computer' > Properties shows that my CPU and Memory specs are 'unavailable', which googling suggests WMI errors but I cannot check my logs!

I tripple boot between Vista Ultimate x64, my old 32bit standard Vista and also Windows 7

• I can boot into both Vista 32bit and Windows 7 without problem
• I have booted into both of the above in Safe mode to check that neither also restrict the physical memory in safe mode to 254mb which they do not (and had never assumed they would)

I have run HJT and can see some odd services I cannot remove. However, full AV scans and Malware scans do not yeild anything of any use (cookies, no critical items).

I feel I have been infected by something quite nasty, and am happy to post in the correct thread for support, but I wondered if anyone else has seen anything like this before or can explain if something else could potentially cause the memory problem?? My AV and Malware definitions are up to date and I was surprised that I didn't catch anything in them.

AV;

• Avast Home
• AVG

Malware;

• Lavasoft's AdAware 2008 for Malware.

Any help would be greatly appreciated

Regards

Alex

hi alex, i have not experienced the problem you have and basically it is way over my head but you seem adament it could be malware. i recently picked up a badly infected computer i first installed and scanned with avast which found a trojan and 2 items of malware then i used spybot which found 1 item of spyware i then scanned with super anti spyware which didnt find anything. for the next week i scanned every day with all scanners and was convinced the computer was clean during this time i read a lot of reviews on malwarebytes, low and behold it found 2 more trojans and 1 item of malware the others had missed. i then run it on my laptop which which i am very vigilant with security and it found malware in the registry so if you think your problem is malware related mabee malwarebytes would be worth a try. the stand alone scanner is freeware and very easy to use. all the best and hope i was of some help

oh sorry me again i sat back down and forgot to mention i assume you know but just in case you dont running avast and avg resident shields at the same time will cause majour problems!

Thanks mitchell, much appreciate your responses

Yup, I wouldn't run two at the same time, I've been there in the past and it has caused problems like deleting incorrect reg keys when one finds a problem just before the other one does but deletes it after the second AV has picked it up lol

I believe it may well be malware, I have done a quick scan with malwarebytes, great piece of kit. It picked up only the hijack.displayproperties thing which people have listed as OK to white list... I will do a deeper scan. There are also some online scanners that I will use. I think I may post this issue up on a professional dedicated spyware / malware removal site as well... and I'll keep this thread updated in case anyone else gets something similar.

Really odd how the OS can only see and address 254mb of physical memory... it has crippled vista something chronic and I've only been able to get in at all under safe mode meaning that the problem is probably loaded into a local machine key but definately sounds registry related.

I'll get back once I know more, again thanks for your response

Alex

I suspect you have Windows/Program corruption usually due to either Registry cleaners/Optimizers, Malware, or User error. run a sfc /scannow integrity check, and Checkdisk.



Vista uses prefetching to fill the RAM, I for example have 4GB, and only 65MB is free (see attached image at bottom). If your total RAM is less than say 3325, I suggest running a Memory diagnostic:
Memory Diagnostics Tool

As for Trend's Hijack this, It is not x64 compatable and will result in error showing "missing". Do not use it in 64-bit Vista. A better diagnostic that is color coded is SysInspector and is a free standalone app. [green is good/red is bad].
This app will give a self diagnostic of all files/apps/processes and registry entries on the pc.
http://www.eset.com/download/sysinspector.php

AVG is not a good antivirus (only recieved standard certification in recent AV-Comparative testing [Feb 2009/Nov 2008]), Avast! is better, but Eset NOD32 is the best.






I would scan for and clean any polymorphic malware, run the diagnostic, and then check and fix any system file integrity violations and and corrupted/system file errors and bad sectors on the HDD.

See post #3 here:
RE: How do you remove Trojan Virus? My McAfee program can't seem to ge

and these:
System Files - SFC Command
How To Make Vista more responsive and faster

For further info on Antivirus and Vista tweaking see post #272 and those that follow:
Whats the Best Antivirus/ Security Suite??

rive0108, thanks for that great post. I will look at this when I am at home this evening. I will have to consider NOD32 then. I use Avast Home edition (free) but maybe its time I paid for something different

I'll let you know how I get on. Cheers

Alex

I have only the memory test to complete now. Nothing else has found any problems at all. Everything you have suggested has checked out.

I am going to test some other memory in the PC as well, although I'm not sure its memory related as Vista 32bit and Windows 7 64bit both can see and use the 4gb I have without trouble. I'll let you know the memory test results.

Cheers

Alex

Memory test came back clean. I have also tried using the boot discs repair facility to check/fix boot up problems, but it was also clean.

I cannot boot into safe mode now, but I can get into safe mode using the 'last known good config'...

I am going to borrow ESET off a friend and remotely scan the disk from within Windows 7. Failing that I will swap the RAM out.

On getting in with 'last known...' I managed to access the event logs. There are some WMI errors, but I can also now see that the system reports 4Gb or RAM if I check the computers properties page, but task manager is still only reporting 254 and is showing that I'm using 98% of that space... I hate the prospect of reformatting without finding what it is... its not a major loss though as all my media and software are stored on DVD's and external storage...

I cannot think what this would be... I don't use the PC for anything stupid, its just general use, some gaming and video encoding / decoding of family vids, or using it as a media hub for the Xbox.

I'll report back after testing ESET and also swapping out with some older memory

Thanks again

Alex

I have scanned using Avast again and this time it did pick some Adware up, something called poinstall.exe, see here

Has been deleted but didn't make a difference. You can see what I mean about the physical memory below... Windows 7 and Vista 32bit can both see 4gb in task manager whilst in safe mode (this pick was taken in safe mode).




I'm prepared to format this disk. Can you suggest anything else? I will try swapping the memory out later and see if that makes any difference, it's my last ditch attempt I guess.

Cheers

Alex

how come you only have 22 running processes?? what have you "tweaked"?

It all seems a bit odd for a Vista install