Physical ram drops to less than 8mb within minutes of starting system, Virtual ram remains constant at 208mb

That was quick, CrazyOne :-)

Thanks Crazyone for responding.

I have not scanned for spyware on this particular machine, normally I would use spybot but this is a business machine and I have not noticed any of the usual spyware. Lately, this has become a daily support issue for me with my non-business clients. I will however try this anyway, it can't hurt.

I have swapped out the ram for known good ones, ones out of one of my own systems. I also am a computer dealer/consultant and have access to parts to swap in & out.

I haven't checked CPU Usage, just resource usage. I will try this as well. I will post the results to-morrow getting late now, tired.

Thanks

>>>That was quick, CrazyOne :-)

:)

>>>I haven't checked CPU Usage,

It may give a clue to which proccesses that may be the culprit.

I forgot one other thing I did, ran msconfig and unchecked all startup items, rebooted and re-selected each one at a time and rebooted each time to see if I could eliminate or find the problem that way.

No luck.

The closest solution I have found is that with just plain vga driver loaded, and 128 MB of ram installed the physical ram stayed around 45 - 50MB.

The video card was made by giga-byte, powered by ATI. I have tried both Giga-byte drivers and reference drivers from ATI.

I might end up swapping out the video card.

Just ran spybot with latest detection rules, found 27 components, all were tracking cookies.

Logfile of HijackThis v1.97.3
Scan saved at 12:16:47 AM, on 11/1/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRAM FILES\AHEAD\INCD\INCD.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\TYPE32.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
C:\WINDOWS\RunDLL.exe
C:\PVSW\BIN\BTRBOX95.EXE
C:\PROGRAM FILES\ANALOGX\MAXMEM\MAXMEM.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\BB\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NORTON~1\vptray.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\NORTON~1\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\NORTON~1\defwatch.exe
O4 - HKLM\..\RunServices: [ATIPOLL] ati2evxx.exe
O4 - HKLM\..\RunServices: [ATISmart] C:\WINDOWS\SYSTEM\ati2s9ag.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: Btrbox95.lnk = C:\PVSW\Bin\BTRBOX95.EXE
O4 - Startup: Outlook Backup Batch File.pif = C:\OUTLOOK.BAT
O4 - Startup: MaxMem.lnk = C:\Program Files\AnalogX\MaxMem\maxmem.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37599.5166203704
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4301/mcfscan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 207.236.176.9,198.235.216.111

I am running behind a hardware firewall with a static Private IP address.

I like the ideas though, keep them coming.

Boycer

Hmmm I like your idea of the video. Does it use System RAM or VRAM?

32 MB VRAM

I have tested the video ram using PC-Check and everything passed. Also ran motherboard, processor and ram tests - burn in tests.

I think I will try swapping out the video card in the morning. I am sitting here right now and the ram has dropped to 127MB free and I have only IE open and windows explorer open.

I justed did an aggressive free up of memory and am back at 269MB free now.

getting late time for sleep :-)

I will let you know regarding the video card. just a note though, this is one of two identical systems. Same motherboard, same video card, same processor, same OS etc..

I will re-post results in the morning.

Thanks to CrazyOne and BillDL for the feedback.

Boycer

Thanks for the list.  The only thing I can see that would have any consequence is the Norton AntiVirus Definition Update monitoring file DEFWATCH.EXE, but that certainly wouldn't be chewing up resources to any noticeable extent.

Incidentally, while I was checking Symantec's site for possible conflicts with this file, I found the following extremely annoying script on their page:

http://service1.symantec.com/SUPPORT/ent-security.nsf/pfdocs/2000051209340948?OpenDocument&ExpandSection=4

Place in "Head" tag.

<script language="JavaScript" type="text/javascript">
<!--
<!--
function printPage() {

var da = (document.all) ? 1 : 0;
var pr = (window.print) ? 1 : 0;
var mac = (navigator.userAgent.indexOf("Mac") != -1);

 if (pr) { window.print(); }  // NS4, IE5
 else if (da && !mac) {vbPrintPage();}  // IE4 (Windows)
 else {  } // other browsers

 
if (da && !pr && !mac) with (document) {
  writeln('<OBJECT ID="WB" WIDTH="0" HEIGHT="0" CLASSID="clsid:8856F961-340A-11D0-A96B-00C04FD705A2"></OBJECT>');
  writeln('<' + 'SCRIPT LANGUAGE="VBScript">');
  writeln('Sub window_onunload');
  writeln('  On Error Resume Next');
  writeln('  Set WB = nothing');
  writeln('End Sub');
  writeln('Sub vbPrintPage');
  writeln('  OLECMDID_PRINT = 6');
  writeln('  OLECMDEXECOPT_DONTPROMPTUSER = 2');
  writeln('  OLECMDEXECOPT_PROMPTUSER = 1');
  writeln('  On Error Resume Next');
  writeln('  WB.ExecWB OLECMDID_PRINT, OLECMDEXECOPT_DONTPROMPTUSER');
  writeln('End Sub');
  writeln('<' + '/SCRIPT>');
}

}
//-->
// -->
</script>

The damned page fires up your printer without prompting you.  The swines, that's verging on malicious intrusion !!

I agree,  it is presumptious of them to assume we would want to print the page without prompting us. Talk about
taking control of a situation eh!

Oh by the way I am canadian eh!

I think I narrowed the problem down to either faulty video ram or buggy drivers, or a combination of both. I suspect the ram, myself, as I have heard nothing but fairly good things regarding ATI Catalyst Ref Drivers. Also,
I tried Giga-bytes ATI Drivers and V-tuner program with the same results.

I swapped out the Radeon Ve card for an old ATI Rage IIC AGP card, loaded the drivers and was able to run
Microsoft Word, Excel, Windows Explorer, Internet Explorer and play a Daredevil DVD using PowerDVD and still had almost 200MB of physical ram free and it did not drop below this.

So, I'am going to run with that as the solution.

Thank you, Boycer