Losing Memory

[Schwo5]

Two days ago, I deleted an "anonymous user" account from my computer (do not know how it got there and it is separate from my daughter's user account). After that, I had about 9gb of free memory. Today, I'm at 45mb. We didn't download anything or install a new program. We haven't been able to connect to the internet or do much of anything. When I run my Norton and SpyDoctor scans, it does not detect any viruses.
A month ago, I deleted my daughter's user account and had no problems. She re-opened her account and the memory issue started again. Could it be some type of setting on the other user accounts?
Any help is greatly appreciated.
Andrea

 

[richc46]

Welcome
This is what we do
Download and run a full scan with Malwarebytes. Make sure it is updated and you make the full scan.
If negative test your memory.
Guide to using Memtest86+ - Geeks to Go Forums
If those tests are negative, right click on the bottom task bar. Bring up task manager go to process tab and then click on memory to bring up to the top the heavy users, now give us a screen shot.

 

[townsbg]

Memory or hard drive space?

 

[MilesAhead]

I used to have an m8000n. According to my search it's 8 GB max memory can be installed on that machine. Also it would be helpful to fill in all the specs. When I bought m8000n it came with XP SP2 installed, not Vista. So obviously we can't just go by the standard HP specs.

Other than that I would follow Richc's advice. Malwarebytes often catches stuff that regular av misses.

 

[whs]

I think by now you realize that you mean disk space and not memory (which is RAM). Here is a program that will tell you exactly what is on the disk/partition: http://windirstat.info/

Post a picture of the results and we'll take it from there.

Used space that will not show is the shadowstorage. But you can find out with this command:

vssadmin list shadowstorage

Open an elevated command prompt and run this command. The number after Allocated is the space used.

 

[MilesAhead]

I use WinDirStat myself, but if I'm not mistaken, on 64 bit systems it will be subject to directory redirection. Just thought I'd mention it. I used it on my 64 bit system too. But for diagnostic it may be better to use a native 64 bit utility.

 

[whs]

I use WinDirStat myself, but if I'm not mistaken, on 64 bit systems it will be subject to directory redirection. Just thought I'd mention it. I used it on my 64 bit system too. But for diagnostic it may be better to use a native 64 bit utility.

WinDirStat runs perfectly in my 64bit Windows7 - no idea though regarding a 64bit Vista. I never had one of those.

 

[MilesAhead]

It runs "perfectly" but since it was written in 2007 I don't think they made the API calls to disable folder redirection. Otherwise if it's a 32 bit app, the SysWow64 is going to redirect accesses to some system folders. For example C:\Windows\System32 accesses are redirected to C:\Windows\SysWow64. It doesn't matter really for normal use to see which folders you left too many videos in. But if the malware by chance is 64 bit then it might be overloading the System32 folder. You won't know that if you measure the size with a 32 bit app since you'll be actually measuring the file usage in SysWow64.

Maybe a bit unlikely, but for diagnostic purposes I think it's safer to use a native 64 bit utility to actually see what's what.

Also I'd advise using some malware scan from a boot CD. Running something from inside the account that works might not detect the malware that seems to be in the kid's account. Makes sense as kids are usually less cautious about surfing. Better to scan the whole drive from an isolated boot CD OS. For m8000n the vanilla Sata disk drivers on a boot CD should be fine.

 

[Cytherian]

Also I'd advise using some malware scan from a boot CD. Running something from inside the account that works might not detect the malware that seems to be in the kid's account. Makes sense as kids are usually less cautious about surfing. Better to scan the whole drive from an isolated boot CD OS. For m8000n the vanilla Sata disk drivers on a boot CD should be fine.

Excellent suggestion. It's the only surefire way to be certain that the malware isn't running upon boot up.