1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Memory leak in system32 folder

Discussion in 'Malware and Virus Removal Archive' started by polarBody, 2008/12/20.

  1. 2008/12/20
    polarBody

    polarBody Inactive Thread Starter

    Joined:
    2008/12/20
    Messages:
    3
    Likes Received:
    0
    I discovered this morning that the memory on my hard drive is steadily disappearing at about 1 MB every 5 minutes. I have isolated the memory leak to a folder in the system32 folder called "upserser," which contains almost 200 .IPM files. Every 10 minutes or so a new .ipm file is created, which can be anywhere from a few KB to a few MB in size. The upserser folder itself is currently 526 MB and rising. There's also a file in the upserser folder called keyatart.ocx that windows explorer tells me is an ActiveX controller. The keyatart.ocx file is 69.6 KB, in case that helps.

    I ran a virus scan on the folder and nothing came up, so I have no idea how to deal with this problem. Any suggestions would be much appreciated. Thanks for your time!
     
  2. 2008/12/20
    wildfire

    wildfire Getting Old

    Joined:
    2008/04/21
    Messages:
    4,649
    Likes Received:
    124
    Can you verify your spelling...

    I cant find any relevant information for keyatart.ocx nor upserser.

    The only information I can find regarding .ipm files relates to Image Pro Plus Macros, this doesn't seem relevant either.

    If you're sure about spelling and you don't use Image Pro Plus then I'd suggest you read this and post on the Malware and Virus Removal Forum.

    Quote or link to this thread if you do so.
     

  3. to hide this advert.

  4. 2008/12/20
    polarBody

    polarBody Inactive Thread Starter

    Joined:
    2008/12/20
    Messages:
    3
    Likes Received:
    0
    Thanks for the info.

    The spelling is correct, and I've never heard of image pro plus, so that's probably not it.

    I tried most of the external links in the two pages that you linked, and I couldn't connect to any of the pages. I would post a thread on the forum you suggested, but I can't even download RSIT.exe or any other virus program because I can't connect to the pages. Here's a list of the links I tried that failed:

    http://images.malwareremoval.com/random/RSIT.exe
    http://free.grisoft.com/doc/2/lng/us/tpl/v5
    http://www.avast.com/eng/download-avast-home.html
    http://www.personalfirewall.comodo.com/overview.html?currency=USD&region=North America&country=US
    http://www.malwarebytes.org/mbam.php
    etc.

    Is this just a problem on my end, or are all these links broken? My connection is otherwise okay.

    Also, if this conserser folder is malware, is it safe to just delete the folder?
    Thanks again.

    By the way, the keyatart.ocx file is now at 169 KB and still growing, for what it's worth.
     
  5. 2008/12/21
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    If you are unable to connect to any of those links - which are all related to antimalware it suggests to me that your computer is infected.

    Can you download them on another computer and transfer across?
     
  6. 2008/12/22
    polarBody

    polarBody Inactive Thread Starter

    Joined:
    2008/12/20
    Messages:
    3
    Likes Received:
    0
    Now I have a serious problem. Every time I try to turn on my computer, it freezes after roughly 3 minutes, as it is still loading. I can't get on the computer long enough to do anything. There are a lot of important files on that computer that are not backed up (insert slap in the face), so what are my options for retrieving those files and/or fixing the computer? Thanks for your help!
     
  7. 2008/12/22
    wildfire

    wildfire Getting Old

    Joined:
    2008/04/21
    Messages:
    4,649
    Likes Received:
    124
    As Pete requested regarding the anti malware tools

    In the mean time I'd leave that system off until one of the experts has time to help you.
     
  8. 2008/12/30
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Best bet is to hitch the drive up as slave in another computer and copy the files off.
     

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.