Something is using a whole lot of memory after virus deletion

[Paul in San Diego]

I caught a virus last week which did not much more than introduce a lot of
spyware on my PC. Most of the spyware was easy to remove, and Norton AV
2004 got rid of the virus. It still shows a couple of instances of
'MALWARE' on the computer that it cannot delete.

Adaware 6.0 finds nothing. Spybot S&D is installed, as is 'HIJACK THIS'
which I had kill processes that I couldn't verify with google.

Bottom line is that now the machine is showing memory usage of 600-800 megs
of RAM with no programs running. Number of processes (including Norton) is
normal, about 35. None of the processes that I see are out of the ordinary
(I'm not new to this stuff and I normally know very well what's happening on
my PC)

If I use MSIE for net browsing, I get constant popups, and my popup blocker
is working hard. I now use Firefox to get rid of that problem. Bottom line
is that the PC is still not healthy, because the popups are a byproduct of
whatever malware I can't remove. How do I find out what is using all this
memory and the popups?

OS is XP Pro sp1 but the browser has had it's latest shots from Microsoft.
PC is 3.3G intel with 512Megs of RAM. Normal memory usage with no programs
running has always been about 200-250MB.

Suggestions appreciated!

 

[doberek]

try using spysubtract (www.intermute.com)

its a great utility.

 

[Enkidu]

I caught a virus last week which did not much more than introduce a lot of
spyware on my PC. Most of the spyware was easy to remove, and Norton AV
2004 got rid of the virus. It still shows a couple of instances of
'MALWARE' on the computer that it cannot delete.

Adaware 6.0 finds nothing. Spybot S&D is installed, as is 'HIJACK THIS'
which I had kill processes that I couldn't verify with google.

Bottom line is that now the machine is showing memory usage of 600-800 megs
of RAM with no programs running. Number of processes (including Norton) is
normal, about 35. None of the processes that I see are out of the ordinary
(I'm not new to this stuff and I normally know very well what's happening on
my PC)

If I use MSIE for net browsing, I get constant popups, and my popup blocker
is working hard. I now use Firefox to get rid of that problem. Bottom line
is that the PC is still not healthy, because the popups are a byproduct of
whatever malware I can't remove. How do I find out what is using all this
memory and the popups?

OS is XP Pro sp1 but the browser has had it's latest shots from Microsoft.
PC is 3.3G intel with 512Megs of RAM. Normal memory usage with no programs
running has always been about 200-250MB.

Suggestions appreciated!

Hi Paul, you seem to have done a lot to remove this stuff and it is
now time to re-install. Most professionalls re-install on the first
sign of a virus, but that is no good for home users, is it? However,
you have probably reached the end of the road. Of course, it's up to
you, and you may feel competent enough to continue. If you are I'm
sure that people here will help you.

I'd review where you are and see if you want to take it further.
There's no doubt that you will learn a LOT about your systems if you
do continue!

Cheers,

Cliff

 

[Guest]

200mb still seems like a lot for a system running no programs. You probably
have programs running in the background. These are the processes that all 9
of my computer use when they aren't running any programs. I've also included
the RAM usage that my current system indicates in Task Manager. You might
want to compare them. Also, you can try using Advanced Startup Manager
(http://www.softpedia.com/get/System/System-Miscellaneous/Advanced-StartUp-Manager.shtml)
to disable programs that may be starting up with Windows. You may want to
try WinTasks
(http://www.softpedia.com/get/System/System-Miscellaneous/WinTasks-Professional.shtml)
as it will report processes that sometimes hide themselves from Task Manager.
The only downside with WinTasks is many spyware developers know its power
and try to terminate it when it starts. I recently found some spyware on my
system that neither AdAware nor Spybot detected. It was running under the
process name WinServAd and WinServSuit. These were using up a bit of RAM and
caused popups. I removed them by doing a search through the registry for
"WinServAd" and deleted all associated keys. I then used Your Uninstaller to
remove that piece of donkey fodder.

Good Luck

 

[Guest]

Sorry, I don't know what I was thinking, here's the list of processes:
alg.exe - 3,284k
crss.exe - 3,248k
ctfmon.exe - 3,760k
explorer.exe - 14,996k
lsass.exe - 1,012k
services.exe - 3,824k
smss.exe - 372k
svchost.exe (5 instances) - 28,450k
System - 212k
System Idle Process - 16k
winlogon.exe (I think this can be terminated) - 928k

 

[Paul in San Diego]

Thank you. I certainly am confident in reinstalling - I built the computer
to begin with! Ya know, it's just the 'do I need to' thing ... I've got a
CD burner and can easily backup my data...but then again if I do the
FDISK/Format, Reinstall, then update, it's a day's work to install a hundred
pieces of software on the PC. And that throws away the day's work that I've
already got tied up in this stooopid virus removal!