Defragging RAM

[Industrial One]

Is there any tangible solution to fixing application RAM buildup?
svchost.exe is now taking up over 400 megs and my comp has been on for
a couple days. Firefox does the same thing, but firefox I can
fortunately restart, svchost I can't without restarting the whole OS.

 

[Paul]

Is there any tangible solution to fixing application RAM buildup?
svchost.exe is now taking up over 400 megs and my comp has been on for
a couple days. Firefox does the same thing, but firefox I can
fortunately restart, svchost I can't without restarting the whole OS.

If your symptoms match this, for the time being, disable the
update function.

"Windows XP: High memory usage for svchost+wuauclt"
http://forums.cnet.com/5208-6142_102-0.html?threadID=408643

http://social.answers.microsoft.com/Forums/en/vistawu/thread/c41d2ef2-b755-41ec-8924-8ce618f3e939

"visit http://update.microsoft.com/microsoftupdate

click Change Settings on the left

Scroll down and DISABLE MICROSOFT UPDATE"

Perhaps that will help, until Microsoft issues a fix.

Paul

 

[Industrial One]

If your symptoms match this, for the time being, disable the
update function.

"Windows XP: High memory usage for svchost+wuauclt"http://forums.cnet.com/5208-6142_102-0.html?threadID=408643

http://social.answers.microsoft.com/Forums/en/vistawu/thread/c41d2ef2...

"visithttp://update.microsoft.com/microsoftupdate

click Change Settings on the left

Scroll down and DISABLE MICROSOFT UPDATE"

Perhaps that will help, until Microsoft issues a fix.

Paul

My Automatic updates are already turned off... I don't trust M$'s so-
called "security fixes."

 

[Paul]

My Automatic updates are already turned off... I don't trust M$'s so-
called "security fixes."

The only other thing I can suggest, if you have WinXP Pro, is
go to command prompt and do

tasklist /svc

which will list the contents of each service host. Maybe that
will tell you what the svchost is doing, which is using so much RAM.

These are my svchost entries:

svchost.exe 1228 DcomLaunch, TermService
svchost.exe 1316 RpcSs
svchost.exe 1440 AudioSrv, CryptSvc, Dhcp, dmserver, ERSvc,
EventSystem, FastUserSwitchingCompatibility,
helpsvc, Irmon, LanmanServer,
lanmanworkstation, Netman, Nla, RasMan,
Schedule, seclogon, SENS, SharedAccess,
ShellHWDetection, srservice, TapiSrv,
Themes, TrkWks, W32Time, winmgmt, wscsvc,
wuauserv, WZCSVC
svchost.exe 1540 Dnscache
svchost.exe 1652 Alerter, LmHosts, RemoteRegistry, SSDPSRV
svchost.exe 592 WebClient
svchost.exe 860 stisvc

My svchost PID 1440 is using 22MB of RAM, the others around 4MB or so each.

If you have WinXP Home, you can use Process Explorer to list the same
kind of info. In fact, with Process Explorer, you can at least get
a text string for each of those services, so you can get a better idea
as to what they are.

http://technet.microsoft.com/en-ca/sysinternals/bb896653.aspx

So far, I can't find a utility that will give a breakdown of the resources
used by each item inside a svchost. That would be useful info, as the
other debugging method (shutting down services one by one), is dangerous
and time consuming. Never shut down a service, without seeing what other
services depend on it first.

Paul

 

[Industrial One]

The only other thing I can suggest, if you have WinXP Pro, is
go to command prompt and do

    tasklist /svc

which will list the contents of each service host. Maybe that
will tell you what the svchost is doing, which is using so much RAM.

These are my svchost entries:

svchost.exe                 1228 DcomLaunch, TermService
svchost.exe                 1316 RpcSs
svchost.exe                 1440 AudioSrv, CryptSvc, Dhcp, dmserver, ERSvc,
                                  EventSystem, FastUserSwitchingCompatibility,
                                  helpsvc, Irmon, LanmanServer,
                                  lanmanworkstation, Netman, Nla, RasMan,
                                  Schedule, seclogon, SENS, SharedAccess,
                                  ShellHWDetection, srservice, TapiSrv,
                                  Themes, TrkWks, W32Time, winmgmt, wscsvc,
                                  wuauserv, WZCSVC
svchost.exe                 1540 Dnscache
svchost.exe                 1652 Alerter, LmHosts, RemoteRegistry, SSDPSRV
svchost.exe                  592 WebClient
svchost.exe                  860 stisvc

My svchost PID 1440 is using 22MB of RAM, the others around 4MB or so each.

If you have WinXP Home, you can use Process Explorer to list the same
kind of info. In fact, with Process Explorer, you can at least get
a text string for each of those services, so you can get a better idea
as to what they are.

http://technet.microsoft.com/en-ca/sysinternals/bb896653.aspx

So far, I can't find a utility that will give a breakdown of the resources
used by each item inside a svchost. That would be useful info, as the
other debugging method (shutting down services one by one), is dangerous
and time consuming. Never shut down a service, without seeing what other
services depend on it first.

    Paul

How exactly will this tell me who the memory-hungry ****er is? Here's
a list of services run by svchost, not that it will tell anyone
anything:


I:\WINDDWS\system32\svchost.exe
Services:
Automatic Updates [wuauserv]
Background Intelligent Transfer Service [BITS]
CDM+ Event System [EventSystem]
Computer Browser [Browser]
Cryptographic Services [CryptSvc]
DHCP Client [Dhcp]
Distributed Link Tracking Client [TrkWks]
Fast User Switching Compatibility [FastUserSwitchingCompatibiIity]
Help and Support [helpsvc]
HID Input Service [HidServ]
Logical Disk Manager [dmserver]
Network Connections [Netman]
Network Location Awareness [NI..A] [Nla]
Flemote Access Connection Manager [FIasMan]
Secondary Logon [seclogon]
Security Center [wscsvc]
Server [Ianmanserver]
Shell Hardware Detection [SheIIHWDetection]
System Event Notification [SENS]
System Flestore Service [srservice]
Task Scheduler [Schedule]
Telephony [TapiSrv]
Themes [Themes]
Windows Audio [AudioSrv]
Windows FirewaII.··'Internet Connection Sharing [ICS] [SharedAccess]
Windows Management Instrumentation [winmgmt]
Windows Time [w32time]
Wireless Zero Configuration [WZCS\·"C]
Workstation [Ianmanworkstation]

Excuse the spelling errors, ProcessXP produced that as a picture, so I
used OCR. Btw, I disabled automatic updates in the services right
after seeing that there, and svchost.exe is still growing, so you can
be assured it's not the culprit.

 

[Paul]

The only other thing I can suggest, if you have WinXP Pro, is
go to command prompt and do

tasklist /svc

which will list the contents of each service host. Maybe that
will tell you what the svchost is doing, which is using so much RAM.

These are my svchost entries:

svchost.exe 1228 DcomLaunch, TermService
svchost.exe 1316 RpcSs
svchost.exe 1440 AudioSrv, CryptSvc, Dhcp, dmserver, ERSvc,
EventSystem, FastUserSwitchingCompatibility,
helpsvc, Irmon, LanmanServer,
lanmanworkstation, Netman, Nla, RasMan,
Schedule, seclogon, SENS, SharedAccess,
ShellHWDetection, srservice, TapiSrv,
Themes, TrkWks, W32Time, winmgmt, wscsvc,
wuauserv, WZCSVC
svchost.exe 1540 Dnscache
svchost.exe 1652 Alerter, LmHosts, RemoteRegistry, SSDPSRV
svchost.exe 592 WebClient
svchost.exe 860 stisvc

My svchost PID 1440 is using 22MB of RAM, the others around 4MB or so each.

If you have WinXP Home, you can use Process Explorer to list the same
kind of info. In fact, with Process Explorer, you can at least get
a text string for each of those services, so you can get a better idea
as to what they are.

http://technet.microsoft.com/en-ca/sysinternals/bb896653.aspx

So far, I can't find a utility that will give a breakdown of the resources
used by each item inside a svchost. That would be useful info, as the
other debugging method (shutting down services one by one), is dangerous
and time consuming. Never shut down a service, without seeing what other
services depend on it first.

Paul

How exactly will this tell me who the memory-hungry ****er is? Here's
a list of services run by svchost, not that it will tell anyone
anything:


I:\WINDDWS\system32\svchost.exe
Services:
Automatic Updates [wuauserv]
Background Intelligent Transfer Service [BITS]
CDM+ Event System [EventSystem]
Computer Browser [Browser]
Cryptographic Services [CryptSvc]
DHCP Client [Dhcp]
Distributed Link Tracking Client [TrkWks]
Fast User Switching Compatibility [FastUserSwitchingCompatibiIity]
Help and Support [helpsvc]
HID Input Service [HidServ]
Logical Disk Manager [dmserver]
Network Connections [Netman]
Network Location Awareness [NI..A] [Nla]
Flemote Access Connection Manager [FIasMan]
Secondary Logon [seclogon]
Security Center [wscsvc]
Server [Ianmanserver]
Shell Hardware Detection [SheIIHWDetection]
System Event Notification [SENS]
System Flestore Service [srservice]
Task Scheduler [Schedule]
Telephony [TapiSrv]
Themes [Themes]
Windows Audio [AudioSrv]
Windows FirewaII.··'Internet Connection Sharing [ICS] [SharedAccess]
Windows Management Instrumentation [winmgmt]
Windows Time [w32time]
Wireless Zero Configuration [WZCS\·"C]
Workstation [Ianmanworkstation]

Excuse the spelling errors, ProcessXP produced that as a picture, so I
used OCR. Btw, I disabled automatic updates in the services right
after seeing that there, and svchost.exe is still growing, so you can
be assured it's not the culprit.

The only technique I've been able to find so far, is to look at
the svchost with the "appetite" for RAM, look at the list of
services it hosts, and disable the services one at a time. I
can't find any mention of a tool that can view heap, stack,
memory allocations or anything else, for the services inside
a svchost. There must be a way to do that, and yet I can't find
any evidence the information exists. Maybe one of the
fancy debuggers makes the information available. If anyone possesses
the skills to make this possible, it would be the guy at Sysinternals,
who does more to make capabilities available to end users, than anyone
else at Microsoft.

I just tried this one, and while I was able to tell it to display
info for my PID 1440 svchost, there still seems to be no way to
connect "private data" consumption, to the associated DLL. You
can see where the actual DLL image is stored, but that isn't going
to help you.

"VMMap v2.62"
http://technet.microsoft.com/en-ca/sysinternals/dd535533.aspx

The only "fun" function the tool has, is in the Edit menu. There
is an option to run "strings" and look for printable strings
within the object you select from the table. Only a few memory
areas so far, have had printable contents. Right now, that's the
only thing of value I see there.

I have a copy of windbg here, but I still can't get it to do anything.
I guess it needs to be "attached" to some process, in order to work.

Paul

 

[Daave]

My Automatic updates are already turned off... I don't trust M$'s so-
called "security fixes."

If your XP system (which has so many security holes) is not patched,
then the most probable cause of your svchost problem is malware. What is
the malware status of your PC?

If you have no malware, you can always configure a Clean Boot and then
methodically re-enable the different programs/processes you disabled
until you discover the one causing the issue. See:

http://support.microsoft.com/kb/310353

 

[Daave]

Here's a list of services run by svchost, not that it will tell anyone
anything:

Automatic Updates [wuauserv]

So, in fact, it was not turned off. ;-)

Btw, I disabled automatic updates in the services right
after seeing that there, and svchost.exe is still growing,
so you can be assured it's not the culprit.

I'm not convinced it's fully turned off. I still would follow the advice
Paul gave you to opt out of Microsoft Update (reverting to the default
Windows Update does infact resolve the problem Paul mentioned).

But as I stated in my other post, if this is not your issue, the most
probable cause is malware, and you must rule that out first. Also, if
you choose not to run Automatic Updates, you should regularly go the
Windows Update website and download and install all the security patches
(not the other updates, which have been known to cause problems!).
Current malware is making its way into systems these days primarily
through XP's security holes.

 

[Industrial One]

If your XP system (which has so many security holes) is not patched,
then the most probable cause of your svchost problem is malware. What is
the malware status of your PC?

My PC is clean.

If you have no malware, you can always configure a Clean Boot and then
methodically re-enable the different programs/processes you disabled
until you discover the one causing the issue. See:

http://support.microsoft.com/kb/310353

That link assumes user has SP3, I have SP2.

My Automatic updates are already turned off...

Here's a list of services run by svchost, not that it will tell anyone
anything:
Automatic Updates [wuauserv]

So, in fact, it was not turned off. ;-)

.... It was turned off in the control panel, but still enabled in
services. Personally I don't know the difference. I turned it off
there too, so should be good. If not, let me hear the 47 other places
I forgot to turn it off in.

I'm not convinced it's fully turned off. I still would follow the advice
Paul gave you to opt out of Microsoft Update (reverting to the default
Windows Update does infact resolve the problem Paul mentioned).

Problem with that link is that it requests I use Internet Explorer,
which I'd rather stick a cactus up my ass than use that unreliable
piece of shit. Furthermore, I got confused the first time I looked at
it because it was giving me instructions to turn auto updates ON.

Thank you for your interest in obtaining updates from our site.

To use this site, you must be running Microsoft Internet Explorer 5 or
later.

To upgrade to the latest version of the browser, go to the Internet
Explorer Downloads website.

If you prefer to use a different web browser, you can obtain updates
from the Microsoft Download Center or you can stay up to date with the
latest critical and security updates by using Automatic Updates. To
turn on Automatic Updates:

1. Click Start, and then click Control Panel.
2. Depending on which Control Panel view you use, Classic or
Category, do one of the following:
* Click System, and then click the Automatic Updates tab.
* Click Performance and Maintenance, click System, and then
click the Automatic Updates tab.
3. Click the option that you want. Make sure Automatic Updates is
not turned off.

But as I stated in my other post, if this is not your issue, the most
probable cause is malware, and you must rule that out first. Also, if
you choose not to run Automatic Updates, you should regularly go the
Windows Update website and download and install all the security patches
(not the other updates, which have been known to cause problems!).
Current malware is making its way into systems these days primarily
through XP's security holes.

The only security holes I'm aware of is the easy spoofing of the admin
account and thus getting control of the entire machine. Sadly I don't
have all the l33t tools I used to have back in the day where I'd
virtually barracade my computer inside out, but I think I'm good.

Whatever, I'll go download the security fixes.

 

[Industrial One]

Whatever, I'll go download the security fixes.

Wow, Microsoft is still not letting me browse their site with Firefox.
Can someone provide a mirror link for the security patch?

 

[Ken Blake, MVP]

Is there any tangible solution to fixing application RAM buildup?

Sorry, but this is very confusing. Your subject line says "defragging
RAM," but the above sentence takes about reducing RAM buildup.
Defragging RAM and reducing RAM usage are two entirely different,
completely unrelated things. Defragging doesn't reduce usage, it
rearranges the usage.

Moreover, there's no such thing as defragging RAM, because random
access to RAM happens at electronic speed, not mechanical speed as in
a disk drive. It's because of that relatively slow mechanical speed of
a disk drive that we defrag--to put related disk clusters next to each
other so the heads don't have to move a greater distanced and take
longer to do it. But with RAM there's no such issue, so there's no
such thing as defragging RAM.

 

[Greg Russell]

In

My PC is clean.

The owner of every PC that is infected with malware feels exactly the same
as you do.

If you can't state what steps you've taken to be able to make such a
statement, then your machine is almost certainly infected.

 

[Industrial One]

Sorry, but this is very confusing. Your subject line says "defragging
RAM," but the above sentence takes about reducing RAM buildup.
Defragging RAM and reducing RAM usage are two entirely different,
completely unrelated things. Defragging doesn't reduce usage, it
rearranges the usage.

Moreover, there's no such thing as defragging RAM, because random
access to RAM happens at electronic speed, not mechanical speed as in
a disk drive. It's because of that relatively slow mechanical speed of
a disk drive that we defrag--to put related disk clusters next to each
other so the heads don't have to move a greater distanced and take
longer to do it. But with RAM there's no such issue, so there's no
such thing as defragging RAM.

The memory optimizer in iolo SM defrags and recovers RAM.

Memory Mechanic Introduction
The Memory Mechanic tool reclaims improperly allocated memory and
combats the problems associated with memory leaks. Memory
defragmentation and recovery results in:

Increase in the performance of most applications

Reduction in application errors

Improved system stability

All computer programs need memory to operate properly. Random Access
Memory (RAM) is built-in volatile memory that allows programs to load
data, functions, and files without committing information to a hard
drive. RAM acts as an system scratch pad, where information is
temporarily stored and accessed in memory rather than the hard drive.
When you turn your PC off, all information stored in RAM is
automatically discarded.

When a program is launched, it contains instructions on how much RAM
it needs to function properly, whether all-at-once, or gradually as
the application is used. The program works with Windows to allocate,
or reserve, part of the computer memory. Frequently, applications
reserve much more memory than initially required, ensuring that memory
is readily available, when and if more memory is needed.

The application is responsible to periodically release any non-
required RAM so other programs may use and/or allocate it. When an
application closes, it is important that it releases all its allocated
memory so the previously allocated RAM is available for other tasks.
If a program fails to release its RAM periodically during execution or
entirely when closed, problems may occur: Other programs opened
attempt to reserve memory. Because the earlier amount is still
reserved, another program may not open or operate properly, or may run
slower because it uses the swap file.

When software does not release memory properly, it is called a memory
leak. The many potential causes include improper software operation,
system corruption, inefficient or sloppy architecture, application
errors or crashes, and even resident operating system bugs.

In


The owner of every PC that is infected with malware feels exactly the same
as you do.

If you can't state what steps you've taken to be able to make such a
statement, then your machine is almost certainly infected.

Let's see... a reliable firewall and iolo SystemGuard with a fine-
tuned configuration which keeps track and alerts me of applications
that request special privileges, disk access, internet access,
modifying COM interface etc.

A tracks eraser and iolo System Mechanic which keeps my system
optimized and clean. PeerBlock to keep the FBI out Avast! Antivirus
and Ad-Aware which I ran recently and removed a couple false-
positives.

Any more questions?

 

[Ken Blake, MVP]

The memory optimizer in iolo SM defrags and recovers RAM.

Memory Mechanic Introduction
The Memory Mechanic tool reclaims improperly allocated memory and
combats the problems associated with memory leaks. Memory
defragmentation and recovery results in:

Programs like this are all snake oil, as far as I'm concerned. They
are more likely to hurt you than help you. I strongly recommend
staying far away from them.

 

[John John]

The memory optimizer in iolo SM defrags and recovers RAM.

Memory Mechanic Introduction
The Memory Mechanic tool reclaims improperly allocated memory and
combats the problems associated with memory leaks.

Complete and utterly useless snake oil! You don't understand how these
snake oil programs work and how the Windows memory manager trims working
sets to meet memory requests. The claim that these 'Memory Optimizers'
can reclaim "leaked memory" is patently absurd.

John

 

[Greg Russell]

In

A tracks eraser and iolo System Mechanic which keeps my system
optimized and clean. PeerBlock to keep the FBI out Avast! Antivirus
and Ad-Aware which I ran recently and removed a couple false-
positives.

Any more questions?

A previous poster's comment of "Snake oil" is correct. You've got more than
one such 3rd-party software and it's possibly those that are consuming the
memory.

You should burn and run a copy of http://memtest86.org to check the physical
memory for defects.

 

[Daave]

My PC is clean.

That may be true. Then again, it may also be true you have malware you
are unaware of. I have seen a number of PCs that were running AVG or
Norton and wound up getting hit with malware. If the malware is good at
what it does, once it's in, it hides and eludes detection. Like I said
earlier, unpatched systems are *far* more likely to be hit. This
includes systems that have older versions of Java and Adobe Reader. And
once the malware strikes, it is too late to patch the system.

That link assumes user has SP3, I have SP2.

No, that link assumes you have Windows XP at any SP level (just scroll
down to the bottom where it says "Applies To")

SP2 has been retired. You may only receive updates from this point
forward if you have SP3 installed (that's what the message was about).

I noticed from your other posts that you are running useless programs
(like Memory Mechanic... a program like that is totally unnecessary with
an OS like XP). Ironically, those programs might be the ones responsible
for your performance problems!

If you do not have any malware (a big if!), configuring a Clean Boot is
an effective method to determine the memory-hogging culprit.

You would be wise to install SP3 (even if you wind up having to perform
a Clean Install). If you do, post back; there are certain precautions
you need to take first.

 

[Paul]

Industrial One wrote:
Industrial One wrote:
Is there any tangible solution to fixing application RAM buildup?
svchost.exe is now taking up over 400 megs and my comp has been on
for
a couple days. Firefox does the same thing, but firefox I can
fortunately restart, svchost I can't without restarting the whole OS.
If your symptoms match this, for the time being, disable the
update function.
"Windows XP: High memory usage for
svchost+wuauclt"http://forums.cnet.com/5208-6142_102-0.html?threadID=408643

http://social.answers.microsoft.com/Forums/en/vistawu/thread/c41d2ef2...

"visithttp://update.microsoft.com/microsoftupdate
click Change Settings on the left
Scroll down and DISABLE MICROSOFT UPDATE"
Perhaps that will help, until Microsoft issues a fix.
Paul
My Automatic updates are already turned off... I don't trust M$'s so-
called "security fixes."
The only other thing I can suggest, if you have WinXP Pro, is
go to command prompt and do

tasklist /svc

which will list the contents of each service host. Maybe that
will tell you what the svchost is doing, which is using so much RAM.

These are my svchost entries:

svchost.exe 1228 DcomLaunch, TermService
svchost.exe 1316 RpcSs
svchost.exe 1440 AudioSrv, CryptSvc, Dhcp, dmserver,
ERSvc,
EventSystem,
FastUserSwitchingCompatibility,
helpsvc, Irmon, LanmanServer,
lanmanworkstation, Netman, Nla,
RasMan,
Schedule, seclogon, SENS,
SharedAccess,
ShellHWDetection, srservice, TapiSrv,
Themes, TrkWks, W32Time, winmgmt,
wscsvc,
wuauserv, WZCSVC
svchost.exe 1540 Dnscache
svchost.exe 1652 Alerter, LmHosts, RemoteRegistry,
SSDPSRV
svchost.exe 592 WebClient
svchost.exe 860 stisvc

My svchost PID 1440 is using 22MB of RAM, the others around 4MB or so
each.

If you have WinXP Home, you can use Process Explorer to list the same
kind of info. In fact, with Process Explorer, you can at least get
a text string for each of those services, so you can get a better idea
as to what they are.

http://technet.microsoft.com/en-ca/sysinternals/bb896653.aspx

So far, I can't find a utility that will give a breakdown of the
resources
used by each item inside a svchost. That would be useful info, as the
other debugging method (shutting down services one by one), is dangerous
and time consuming. Never shut down a service, without seeing what other
services depend on it first.

Paul

How exactly will this tell me who the memory-hungry ****er is? Here's
a list of services run by svchost, not that it will tell anyone
anything:


I:\WINDDWS\system32\svchost.exe
Services:
Automatic Updates [wuauserv]
Background Intelligent Transfer Service [BITS]
CDM+ Event System [EventSystem]
Computer Browser [Browser]
Cryptographic Services [CryptSvc]
DHCP Client [Dhcp]
Distributed Link Tracking Client [TrkWks]
Fast User Switching Compatibility [FastUserSwitchingCompatibiIity]
Help and Support [helpsvc]
HID Input Service [HidServ]
Logical Disk Manager [dmserver]
Network Connections [Netman]
Network Location Awareness [NI..A] [Nla]
Flemote Access Connection Manager [FIasMan]
Secondary Logon [seclogon]
Security Center [wscsvc]
Server [Ianmanserver]
Shell Hardware Detection [SheIIHWDetection]
System Event Notification [SENS]
System Flestore Service [srservice]
Task Scheduler [Schedule]
Telephony [TapiSrv]
Themes [Themes]
Windows Audio [AudioSrv]
Windows FirewaII.··'Internet Connection Sharing [ICS] [SharedAccess]
Windows Management Instrumentation [winmgmt]
Windows Time [w32time]
Wireless Zero Configuration [WZCS\·"C]
Workstation [Ianmanworkstation]

Excuse the spelling errors, ProcessXP produced that as a picture, so I
used OCR. Btw, I disabled automatic updates in the services right
after seeing that there, and svchost.exe is still growing, so you can
be assured it's not the culprit.

In Process Explorer (Sysinternals), if you right click on a SVCHOST entry,
then select properties, a separate window pops up. Select the "Threads" tab
in that window.

http://technet.microsoft.com/en-ca/sysinternals/bb896653.aspx

The CSwitchDelta column, shows activity when the thread is active. Perhaps
you can get a name, based on something in there having excessive
CSwitchDelta.

I still haven't found anything to display memory consumption of the threads.
Using CSwitchDelta, you may at least be able to see a thread which is
abnormally active, inside a SVCHOST process.

I did manage to use LiveKD (kernel dump) from Sysinternals, and convinced
it to dump a 2GB .dmp file, which should be a copy of the entire computer
memory. I've tried to feed that to windbg, but the learning curve for
that program is pretty bad.

Paul

 

[Henry]

Daave wrote:

You would be wise to install SP3 (even if you wind up having to perform
a Clean Install). If you do, post back; there are certain precautions
you need to take first.

What precautions please? I'm still running SP2 and have heard nothing but
horror stories about installing SP3.

Thanks

Henry

 

[Daave]

Daave wrote:


What precautions please? I'm still running SP2 and have heard
nothing but horror stories about installing SP3.

Thanks

You're playing with fire, Harry!

Fortunately, the horror stories (yes, I am familiar with them, too!) are
rare, relatively speaking.

First, you need to determine if you're running a specific type of HP
computer. This is one of the two main causes of horror stories. HPs that
came with both AMD processors *and* a factory-installed image with wrong
files (assuming that the processor is an Intel!) had problems. If this
is the case, there is a tweak that can be made to correct the HP
mistake.

Second (to deal with the other main cause of the horror stories), you
just need to make sure that security programs aren't running because a
number of them interfere with the installation of SP3 (and also IE7 and
IE8, I'm pretty sure). Some people install SP3 in Safe Mode. I prefer to
configure a Clean Boot:

http://support.microsoft.com/kb/310353

That ensures that no unwanted programs run.

Also, it is advised *not* to use Automatic Updates for SP3 (I'm not even
sure it's possible anymore to do this). You can either download the .exe
file or download the .iso file and burn an SP3 CD. This way you can
install SP3 while not connected to the Internet (which is good since
your security programs would be turned off).

..exe file:
http://www.microsoft.com/downloads/...a8-5e76-401f-be08-1e1555d4f3d4&displaylang=en


ISO-9660 CD Image file:
http://www.microsoft.com/downloads/...CE-B5FB-4488-8C50-FE22559D164E&displaylang=en

Full Information: to successfully install SP3:
http://msmvps.com/blogs/harrywaldro...requisites-for-a-successful-installation.aspx

(You will see that it is preferred to have IE at the IE6 level.)