Virtual Memory Error

[Dan S]

I remove Viruses and spyware for a living and have used
many programs. I think MS AntiSpy is great. The guy who
says 'It is ineffective' is saying it needs to be
absolutely perfect and hueristic in removing spyware.
Can't happen. I feel it's as effective as any spyware
remover I've found. I admit you'll still need other
tools. But what the heck. ANYWAY . . .
On one particular PC I've been cleaning out I have tried
to run MSAntispy and everytime it freezes and says that I
have run out of virtual memory . . . even after setting
the virtual memory up to using the balance of the HD!!!
What the ??? Any advice?

 

[JohnF.]

Seems to me I remember early in this beta that a bad install would cause a
log file to form that grew until it consumed the entire hard disk if allowed
to run. You might want to uninstall, delete the folder it creates if still
there and try a reinstall.

JohnF.

 

[Bill Sanderson]

This is what is happening, I suspect. You've got a piece of spyware in
place which changes the permission on its registry key so that the current
user doesn't have permissions. This causes the freeze you are seeing, and
also the memory leak--apparently there's a loop.

The solution is to note registry key in question, and use the registry
editor to navigate to it, right click on it, and take ownership of the key
and any subkeys.

In XP Home, I believe you must restart in safe mode and sign in as
administrator to do this.

Once that's done, Microsoft antispyware should be able to complete the scan,
and clean properly.

 

[JohnF.]

Ah, the old change the permissions trick - I'll have to write that one down.
Makes sense - Dan let us know if Bill's suggestion does th trick.

Thanks,

JohnF.

 

[Bill Sanderson]

I'm going to have to ask somebody in some more private forum how this trick
is pulled off.

 

[Dan S]

OK . . . here's what happened . . . I ran a scan in Safe
Mode and it completed. It found 38 software inst. removed
them. Rebooted. Before I got to the desktop, virtual
memory issue again. rebooted. Ran another scan. failed
due to virtual mem. Uninstalled MSAnti. Deleted any
related folders and their content. reinstalled ran a
scan. LOCKED due to virt mem. Blasted thing. What now?

 

[Dan S]

I did find the Registry key.
Local_Mach/Software/Microsoft/Windows/Curent_Version/unins
tall/wintools
I started in safe mode and tried to delete it. No go. Any
suggestions?

 

[Bill Sanderson]

Rather than attempting to delete it, you need to take ownership.

Navigate to the key, right click it, and choose permissions.

If you are running Windows XP Home edition, you need to be in safe mode,
signed in as "administrator."

Click on the advanced button

Click on the Owner tab.

Check the box which says" Replace owner on subcontainers and objects"
Click one of the available choices under Change owner to: and hit apply.

At this point, I believe Microsoft Antispyware should be able to handle it,
although you could choose to first export, and then delete, the key
yourself.

 

[abhi]

Same problem here. What version of windows was it. Mine is
2000. Is there any way to stop it in the middle and remove
the spyware it has detected?Have you tried scanning
specific folders instead of the whole computer?

 

[JohnF.]

Do you know how to read the event logs?

Right-click My Computer and select MANAGE
Click on Event Viewer and expand.
Look in the System Log and tell me what errors you have, source and error
number.

Meanwhile, here is a link to help you look over your pagefile to make sure
it isn't set wrong or corrupted.

http://www.theeldergeek.com/paging_file.htm


JohnF.

 

[Dan S]

Actually I do know how to read them. But I have to admit
I really didn't make a connection to that. I was blaming
the AntiSpyware software for wnat was going on.
Now I did something REALLY revealing. I ran the
AntiSpyware while the Task Manager was open. It started
just scanning along and as would be expected CPU usage
and Page file usage crept slowly up until the scanning
hit the WinTools files. BOOM! the page file use jumped
from 27MB to 1.4GB! The graphics driver shut down and the
display reset to it's lowest res.
Last night I tried to delete the wintools file in safe
mode but it wouldn't let me. how do I get rid of this
thing?!?!?

 

[Dan S]

I would like to see them allow that same thing myself. I
have Spysweeper on my own computer and have found it's
operational setup a little nicer. You can stop the scan
and remove whatever you have found up to that point.
Overall though, Spysweeper isn't that great at getting
everything out.
This is all taking place on a clients PC and I'll tell
you what . . . it's frustrating!
By the way it's XP Home.

 

[Bob Dietz]

http://www.google.com/search?q=WinTools+"safe+mode"

 

[Dan S]

I can take ownership of the key but not the subcontainers
and objects. In otherwords when I check that box it
denies a change of ownership. When it is unchecked I can.
And I tried just changing ownership which had the same
results during the scan. Lock up. Also, I am unable to
export or delete the key.
Sorry 'bout that. Stupid thing! Any other ideas?

 

[Dan S]

that page would be helpful IF I could delete the REg key
like it says. Unfortunately you can't. Access denied.
Change of permissions denied. Change of ownership denied.
It is UNTOUCHABLE. It's a bummer!>-----Original Message---
--

 

[Bill Sanderson]

Are you logged in as "administrator" in safe mode, when you try these
operations?

 

[JohnF.]

Have you tried the Windows Installer Cleanup Tool?

http://support.microsoft.com/default.aspx?scid=kb;en-us;290301

JohnF.

 

[Dan S]

Yup.
One thing that has to be realized is that this isn't in
the area of the registry that everyone keeps talking
about. local-
mach/software/microsoft/windows/currentversion/ and this
is the biggee . . . /uninstall

 

[Bill Sanderson]

Dan - do you have a name for this piece of spyware?

If you run a Symantec or Panda online scan, does it spot the critter and
give you a name?

If you can get that detail, and maybe even if you can't, I'm inclined to
have you try Microsoft PSS's support for virus issues or problems with
security patches.

This really isn't either one of those, but something this hard to remove is
close enough to a virus that perhaps they will be willing to take it on.

If you are in the US or Canada, call 1-866-pcsafety. In other parts of the
world, call your local Microsoft subsidiary or support number. The phone
call may not be free, but the support will be for any issue relating to
virus or trojan removal or infection, or problems with security patches.

This number will not provide support for Microsoft Antispyware--so don't ask
for help getting the program not to freeze, etc--just talk about the
particular piece of spyware you need to remove and get help with that
operation. They may well ask you to use Microsoft Antispyware to do the
job, and then you can launch into your tale.

So--give that a try--and let me know what happens--how they get this taken
care of--that'll help us help others here.

 

[denise]

I am having the same problem on my home pc....anyone out
there that can help me??