Help to free up RAM

Hi, I've just installed extra RAM to make 384Mb but when I run Everest it's telling me it's all used even when I only have 2 or 3 progs open.

I've downloaded startuplist and here are what it says - which of these could I do without?

Thank you.
*********************************************************

StartupList report, 05/06/2004, 13:05:30
StartupList version: 1.52
Started from : C:\UNZIPPED\STARTUPLIST[1]\STARTUPLIST.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PQSC\PROGRAM\SCTRAY.EXE
C:\WINDOWS\PCTVOICE.EXE
C:\WINDOWS\SYSTEM\DSLAGENT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\SYSTEM32\DRIVERS\DCFSSVC.EXE
C:\WINDOWS\SYSTEM\LXSUPMON.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\PROGRAM FILES\WINAMP\WINAMP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\UNZIPPED\STARTUPLIST[1]\STARTUPLIST.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
PCHealth = C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SecondChance = C:\PQSC\PROGRAM\SCTRAY.EXE
CountrySelection = pctptt.exe
PCTVOICE = pctvoice.exe
GSICONEXE = gsicon.exe
DSLAGENTEXE = dslagent.exe USB
AVG_CC = C:\PROGRAM FILES\GRISOFT\AVG6\avgcc32.exe /startup
Dcfssvc = C:\WINDOWS\System32\Drivers\dcfssvc.exe
LXSUPMON = C:\WINDOWS\SYSTEM\LXSUPMON.EXE RUN
Zone Labs Client = "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
SSDPSRV = C:\WINDOWS\SYSTEM\ssdpsrv.exe
*StateMgr = C:\WINDOWS\System\Restore\StateMgr.exe
TrueVector = C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
Avgserv9.exe = C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 4/6/2004, 18:18:58)

[rename]
NUL=C:\WINDOWS\TEMP\GLB1A2B.EXE
NUL=C:\PROGRA~1\UKPOKE~1\\UNWISE.EXE

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET Path=C:\WINDOWS;C:\WINDOWS\COMMAND;C:\WINDOWS\SYSTEM;
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP

--------------------------------------------------


Enumerating Task Scheduler jobs:

Tune-up Application Start.job
PCHealth Scheduler for Data Collection.job
Ad-aware 6.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38054.3778935185

[RealArcadeRdxIE Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\REALARCADERDXIE.DLL
CODEBASE = http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab

[CRAVOnline Object]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\RAVONLINE.DLL
CODEBASE = http://www.ravantivirus.com/scan/ravonline.cab

[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\XSCAN53.OCX
CODEBASE = http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
UPnPMonitor: C:\WINDOWS\SYSTEM\UPNPUI.DLL
AUHook: C:\WINDOWS\SYSTEM\AUHOOK.DLL

--------------------------------------------------
End of report, 5,392 bytes
Report generated in 0.609 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

 

Hi Howard,

I want to address two things in your log.

1. NUL=C:\WINDOWS\TEMP\GLB1A2B.EXE
I did some searching on this executable, and here are a couple of the links I found.

http://forums.zonelabs.com/zonelabs/board/message?board.id=security&message.id=3590

http://forum.aumha.org/viewtopic.php?t=4935 Scroll down to post by U N Owen near the bottom.


As you see from the first, looks scary, but there was no response either. The second seems to take a different stance on it. I also found a couple of others that suggested running updated Ad-aware and Spybot several times, rebooting after each run would remove it. I think we need to see a HijackThis log, before and after running them, as well as a new startup log.

2. NUL=C:\PROGRA~1\UKPOKE~1\\UNWISE.EXE
Do you know what this UKPOKE~1 program is? Can you look inside the folder if not? What is the full name of the folder?

 

Hi Howard,

Some programs that will list the memory usage of individual programs are SiSoftware Sandra under Processes Information and Norton Utilities under System Information.

Matt

 

Howard,
How's the PC running? It should feel a bit faster with the extra RAM.
If it does then I would say that Everest may be mis-reporting.

I can't remember if ME has a system monitor installed by default. 9x doesnt. You can check for memory usage with the system monitor. You should be able to install it from Add/Remove components by inserting the install CD?

Failing a spyware or Viri problem you may have a recalcitrant programme running and hogging the memory?

Or as Matt suggests try another diagnostic programme.

 

Thanks guys, I run adaware daily and the UKPOKE thing is an online poker site but when I try and open it, it says folder not vald.

Now with just this site open and nothing else, I'm using 203Mb of RAM according to Everest. The reason I put in more RAM was so I could listen to MP3's whilst surfing etc, but they just keep stuttering?

Thanks,
HB.

 

I still feel you should post a HJT log, but......

in msconfig, uncheck DCFSSVC.EXE and reboot. Info below.

Download and install Process explorer.

Check the CPU usage of WINMGMT.EXE as well as all other processes. Info on Winmgmt below.

http://www.jsiinc.com/SUBP/tip7500/rh7577.htm

 

NUL=C:\WINDOWS\TEMP\GLB1A2B.EXE
NUL=C:\PROGRA~1\UKPOKE~1\\UNWISE.EXE

About the above, it is not uncommon for the Wise Installer to create a GLBxxx.Exe file.

 

Looks like you have nearly 30 background programs running. I have nearly as many, but am using less than 100mb.

Suggest you get SiSoft Sandra and find out the amount of memory each program is consuming. If they are not a neccessary program, go into the host program and disable them, eg, to disable the Lexmark startup program, open your Lexmark utilities, find "Options" and disable it at startup. You can always run those from Start > Programs if you need help from the utilities. Disable Winamp if it runs at startup, etc.

You can find information on the program (those listed "Running Processes ") by typing them into Start > Find (Files and Folders). Right-click on the .exe file and select Properties > Version (tab), look through the information there. If they were made by Microsoft they should be OK, but it should give you a hint as to what the program is doing. If they don't have any information then GET RID OF THEM...at least by disabling them in MSCONFIG > Startup (tab) or disabling in the mother program or finding out what they and how to remove them (don't just delete them, which may cause more havoc on your system, but I'd say you already know this). Get rid of internet junk, eg mmtask is Music Match from "Real ".

Some may run from the registry. Post a Hijack This "log" here if you need help with those.

There is a database of progams here:
http://www.kephyr.com/filedb/index.php
(some of your programs look unneccessary).

Matt

 

How do I do that?

I've got rid of quite alot of programs from startup but even now with just this open I'm using 271Mbs.

It's as if it's not clearing the memory. When I do a reboot and go straight to Everest I'll be using about 120 but the longer I'm using the PC the more it uses even after I've closed other programs.

Thanks,
Howard.

 

Download HijackThis from the CWShredder link in my signature. Place it in a permanent folder (I create a new folder in C:\ named HJT). Open and hit scan, then save log. Once it is saved it will open in notepad. Select all from the edit button, copy and paste the results here. Don't fix anything with it yet! I also suggest before doing the scan, uncheck anything on the startup tab of msconfig and reboot.

Did you install process explorer? After you've done some normal computing for a bit, open it up and click file, create log (I think?? You'll see how). Open the log with notepad and copy/paste it here also. May need to do it in a separate post from the HJT log.

 

This seems to me just normal windows operation. I think you do not know about the Virtual Cache, a part of windows that uses memory, and it grows with every program you open. Close a program, and the Vcache does not always shrink. It will shrink when existing running programs or a newly opened one needs memory.
The Vcache allows the system to run more efficiently, reopen a closed program and it will open slightly faster [may not be noticeable], as some of it's code is in the Vcache.
The more memory you have installed, the more of it that windows will use.
I have this system that had 128 mb installed, upon bootup usually 70 to 80 was used. I increased the RAM to 256 mb, and now typically have 140 mb in use at bootup. No new hardware, or anything added to the startup, the added RAM was the only difference.

 

I've just got back from work and done the hijack, this will be after it's been on all day(the missus has been on it)

I'm using 351mb. I'll do a reboot now and do it again OK. Thanks.
Howard.

Logfile of HijackThis v1.97.7
Scan saved at 20:52:02, on 08/06/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\DSLAGENT.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\MY DOCUMENTS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.anglersnet.co.uk/cgi-bin/ubb/ultimatebb.cgi?
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRAM FILES\GRISOFT\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\LimeShop\System\Temp\limeshop_script0.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O12 - Plugin for .bcf: C:\PROGRA~1\INTERN~1\Plugins\NPBelv32.dll
O12 - Plugin for .mpeg: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38054.3778935185
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab

 

I'm now using 176mb after the reboot. Sorry I did it the wrong way around, but I won't be using the computer tonight as I'm off out.


Logfile of HijackThis v1.97.7
Scan saved at 20:59:44, on 08/06/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\DSLAGENT.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\MY DOCUMENTS\HIJACKTHIS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.anglersnet.co.uk/cgi-bin/ubb/ultimatebb.cgi?
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRAM FILES\GRISOFT\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\LimeShop\System\Temp\limeshop_script0.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O12 - Plugin for .bcf: C:\PROGRA~1\INTERN~1\Plugins\NPBelv32.dll
O12 - Plugin for .mpeg: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38054.3778935185
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab

Mark - it makes sense what you say, and you're right I didn't know about VC.
It's just been making me wonder how I ever managed to do anything with 128.
Cheers,
Howard.

 

Well you can rule out any nasties. Other than using more ram than you think it should, how is performance?

 

Cleanest HJT log I have seen posted here in a while. Nothing extra or unneeded loading.
Windows 98 and ME does a fine job of handling memory, glad to see you have no "memory managers" or "free up memory programs" loading.
The best thing to keep in mind is that unused RAM is wasted RAM.

 

Howard, you've trimmed down those startup programs well!

As the guys say, if it going well don't fuss too much.

Found some info on memory leaks:
http://support.microsoft.com/default.aspx?scid=kb;en-us;259161&Product=winme

and a specific Windows program that has a memory leak:
http://support.microsoft.com/default.aspx?scid=kb;en-us;278368&Product=winme (I have a program called Process View that lists what other files the program uses... may be useful in case you think this may be a cause).

Have you done the Windows Updates?

I am not a supporter of Real. If you don't use their "Real Arcarde" then axe it. Same with that mmtask.tsk in startup. If you don't know how to, first try emailing Real (an email that I would send would not be very pleasant, so don't ask me what to write )

Matt

 

Mstask.Exe is the Task Scheduler, not needed unless you have something scheduled.
Mmtask.Tsk is a legitimate windows file, it is the Windows Multimedia Background Task Support Module that handles multimedia services, needed.

 

Must be mmtask.exe that is Music Match (mmm... coinsidence?). Thanks markp62.

Matt
Edit: mmtask.tsk...Yes needed, but needed to run at startup? It is on my Win98se system, but not in startup.

 

Thanks everyone, just taken off mstask.exe but can't even see mmtask.tsk in the startup list.

Anyway good news that there is nothing at startup that shouldn't be there. I'm happier now knowing that all's as it should be. I'll stick at this. Ty.

Probably another situation altogether, but my PC never boots up first time in the mornings after being off all night, you have to press the little reboot button 2 or 3 times. However if I go to shutdown now and select restart, 9 times out of ten it's OK. Any idea what could be causing this?

Thanks guys for your help.

Atb,
Howard.

 

Power Supply is not picking up the turn on signal well. Try holding the power button for a 1/2 second longer.