Help with a serious loss of available physical memory

**Gemnigems** · 04-20-2008, 05:26 PM

I am assuming this is the cause of my computer moving at a snails pace.

I have run ad-aware, spy bot, hijack this, windows defender and antivir scans, all of which turned up something that I believe has now been corrected.

However, the system information still shows that only 60-100mb of available physical memory are left of my 512mb.

At this point I can hardly get online and certainly can't run any programs on my computer with any reasonable speed. I am wondering if there is a virus I have missed.

There are 40 processes running on my system when I am doing nothing, and it is all greek to me. I am afraid I have no computer skills to speak of.

I am hoping someone here takes pity and offers some help or instruction.

Thanks in advance,
Lisa

**cauzomb** · 04-20-2008, 09:02 PM

It's possible to reduce the amount of services and or applications that are running in the background, in order to reduce the amount of memory that the system uses. Most applications don't need to be running all the time but unfortunately, too many applications set themselfs to run at startup, which will consume a good junk of system memory.

Can you post some specifics regarding your system;
Motherboard make/model
Opperating system
Amount of free hard drive space on C:
And a hijackthis log, to reference what is currently running.

**Gemnigems** · 04-21-2008, 02:09 AM

Hello cauzomb, and thank you for your quick response. I believe I have found the additional information you have asked for, if I haven't, feel free to draw me a map in crayon. I appreciate your time,
Lisa

OS Name Microsoft Windows XP Home Edition
Version 5.1.2600 Service Pack 2 Build 2600
OS Manufacturer Microsoft Corporation
System Name GEMNI
System Manufacturer Hewlett-Packard
System Model Presario V3000 (RD153AV)
System Type X86-based PC
Processor x86 Family 15 Model 76 Stepping 2 AuthenticAMD ~1808 Mhz
BIOS Version/Date Phoenix F.13, 10/18/2006
SMBIOS Version 2.4
Windows Directory C:\WINDOWS
System Directory C:\WINDOWS\system32
Boot Device \Device\HarddiskVolume1
Locale United States
Hardware Abstraction Layer Version = "5.1.2600.2562 (xpsp.040919-1030)"
User Name GEMNI\Lisa
Time Zone Pacific Daylight Time
Total Physical Memory 512.00 MB
Available Physical Memory 34.59 MB
Total Virtual Memory 2.00 GB
Available Virtual Memory 1.96 GB
Page File Space 1.03 GB
Page File C:\pagefile.sys

I have the drive in two parts "C" and "D":
C: is 28.8gb with 12.5gb free
D: is 8.35gb with 5.35gb free

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:48:12 PM, on 4/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Lavasoft\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Avira\AntiVir PersonalEdition Classic\avguard.exe
D:\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\msco rsvw.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\Explorer.EXE
D:\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Defender\MSASCui.exe
D:\Program Files\Spybot - Search & Destroy\Spybot - Search & Destroy\TeaTimer.exe
D:\Program Files\KeirNet\K9\K9.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
D:\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avgnt] "D:\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Launch K9.lnk = D:\Program Files\KeirNet\K9\K9.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn...tDetection.cab
O16 - DPF: {8FD68625-2346-418A-8899-67CB36B1917F} (McciSM Class) - http://supportcenter.verizon.net/euserv/jsp/VOLAWeb.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/pla.../installer.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://games.pogo.com/online2/pogo/c...ploader_v6.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - D:\Program Files\Lavasoft\aawservice.exe
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - D:\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - D:\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762# # (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS. exe

--
End of file - 6612 bytes

**cauzomb** · 04-21-2008, 08:06 PM

Thanks for posting the additional info; I am going over the list of entries in the hijackthis log; I see some things that can be turned off, but I don't want to suggest something just yet, except maybe getting more physical memory, an additional 512 megs would help; windows uses alot of memory, there's enough drive space for the windows swap file, but the system ram is a bit low for xp. I've got a private message to some of the regulars and waiting on a review of the suggestions before posting. My personal preference would be to eliminate the bonjourno service, the google toolbar, and the hpshare to web thing.. But there may be other suggestions regarding your Anti-virus/anti-malware configuration that would reduce the amount of system resources being consumed, without removing the amount of system protection.

**cauzomb** · 04-21-2008, 08:08 PM

on a side note, did any of your scans turn up possible infections? If so, we may need to take a trip to the spyware help section to ensure that they system is squeeky clean.

**Gemnigems** · 04-21-2008, 10:18 PM

Hi cauzomb,

Avira antivir turned up 3 issues, the only one I can remember the name of seemed to be heuro(or something close) and was defined as malware by Avira. I opted for the remove of all and assumed it was taken care of. The others all turned up a number of items but they all seemed to be tracking cookies.

I may indeed need to make sure it is clean.

I browsed the forums further last night and found some tips to increase speed. I removed all items from my desktop that weren't shortcuts and moved them to more appropriate locations. The computer feels only mildly faster, but I now show 92mb available ram with two windows open.

I also had a windows install shield that wouldn't install or go away. After 3 hours of research and reading with Microsoft, it turned out I had to remove the net frame and start over. It then pulled up a dozen update downloads that I needed, so I got those and they all installed with no trouble, including the one that wouldn't the first time.

I also slow down even more when the spybot teatimer is working, but for some reason that is not showing as active in my task bar.

I appreciate your help and guidance and will await further instructions.

Thanks again,
Lisa

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8

20 PM, on 4/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Lavasoft\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
D:\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Defender\MSASCui.exe
D:\Program Files\Spybot - Search & Destroy\Spybot - Search & Destroy\TeaTimer.exe
D:\Program Files\KeirNet\K9\K9.exe
D:\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://google.icq.com/search/search_frame.php
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -

C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} -

D:\PROGRA~1\SPYBOT~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avgnt] "D:\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe"

-hide
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search &

Destroy\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Launch K9.lnk = D:\Program Files\KeirNet\K9\K9.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}

- C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program

Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} -

C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program

Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7}

- C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1

\SPYBOT~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8

-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-

f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-

00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) -

http://a1540.g.akamai.net/7/1540/52/...activex/qtplug

in.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) -

http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) -

http://h20270.www2.hp.com/ediags/gmn...tDetection.cab
O16 - DPF: {8FD68625-2346-418A-8899-67CB36B1917F} (McciSM Class) -

http://supportcenter.verizon.net/euserv/jsp/VOLAWeb.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) -

http://3dlifeplayer.dl.3dvia.com/pla.../installer.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) -

http://games.pogo.com/online2/pogo/c...ploader_v6.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - D:\Program

Files\Lavasoft\aawservice.exe
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program

Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira

GmbH - D:\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH -

D:\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762# # (Bonjour Service) -

Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program

Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program

Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program

Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation -

C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) -

Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -

C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common

Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. -

**cauzomb** · 04-21-2008, 11:04 PM

Teatimer does consume quite a bit of resources and may conflict with other applications. In attempts to protect the system, Teatimer may block tasks that genuine applications need to perform in order to instal, run etc.. Anti-virus programs also intercept execution of applications and perform work/scans etc but teatimer "STOPS" the registry changes before they take place. It's normal opperation is to provide a prompt with the option to allow or deny the chnage, if you asked it to prompt you. In order for that to be usefull, a person would have to know the good changes from the bad changes. Besides that, some versions of Search and destroy's teatimer has a known memory leak that will fill up important ram space until teatimer crashes. To disable TeaTimer, Load Spybot Search and Destroy, at the top of the S&D window there's a tool bar that lists FILE, MODE, etc.. Click on MODE, then switch Search and destroy's mode to "ADVANCED" Click on the TOOLS menu, then RESIDENT, to disable teatimer, uncheck the box next to "RESIDENT" Teatimer.. The general concensus is to disable it if you are running a good enough anti-virus application. It also needs to be disabled for other anti-virus/malware applicaitons to make any changes in the registry. I am not well versed in this area of tuning, other than disabling everything that I do not use, hoping that it still works.. I've had to re-install windows after a failed attempt to "TUNE" services and items in the registry, based on a couple online guides, so I tend to ask for second/third opinions on what is needed or not. When fooling with the registry I start by making a backup of the registry, then change one thing at a time to test which worked or which failed. Here's what I wrote up earlier and asked for a review via the local mod/admins, but haven't gotten any feedback.. So this is pretty much, do at your own risk.

That looks ok, I'm not sure if your anti-virus programs are playing along, but there's lots of stuff running in the background. 512 megs of ram really isn't enough for windows xp, you might try to get an additional 512 megs of ram.

The things that stand out the most are the K9.exe entry, do you know what this is?

And the bonjour service.. I have heard that the apple computer inc. bonjour service causes some problems and is not needed. From the discription of what it does, it may be a security/privacy risk in that it "broadcasts" and "listens" to the network.
Here is a quote from http://arai.wordpress.com, regarding removing the bonjour service.

Originally Posted by G.sender

For everyone out there, who is still struggling to remove this service, here is the fix:

http://www.x64bit.net/site/board/ind...aded&pid=47407

I have tried it and it works. The only thing I did differently, I deleted the Bonjour folder in ‘Safe Mode’, because it wouldn’t let me do it any other way. From my experience I am concluding, that the application ‘LSPFix’, which I downloaded before I made changes, is the actual remedy to the problem. It repairs Winsock 2 by removing the LSP module ‘mdnsNSP.dll from Winsock 2.

Once you have done this all, go into the registry - if you are comfortable with it - and clean out all traces of ‘Bonjour’. You will be surprised how many there are.

Good luck!

I don't recommend romoving entries from the registry, unless you have done it before and are familiar with regedit.
It's a simple process, but you can mess up the registry and cause the opperating system to stop working

I'm still looking through the list of things that can be turned off at startup, there are only two or three that are resource hogs but it depends on the things you do on your system. I.E. the applications that you work with most often.. Most applications will start the services that they need when the application is run from the start menu, rather than automatically each time windows loads. It's benificial to not allow them to startup with windows, it can conserve quite a bit of available system memory that you may need for regular browsing, etc...

You may want to go into each of your applications "options" and look for anything that says start application when windows loads, then decide if you want that application running all the time in the background or not.

If you are not sure of this process, try this.. Look at the ICON's that reside in the CLOCK box, AKA system tray. hold your mouse pointer over each one, note the application it is associated with, printer, soundcard, videocard etc.. Most of these little icons can be turned off untill you need them. They are generally only going to free up a few megs of ram, but every little bit helps. If you can post a list of the applications that show up in your system tray, we can look into how to prevent them from starting up when windows loads.

Originally Posted by google.com

The Google Updater Service is a Windows service that updates Google software that users have chosen to install. It ensures users have the most current software available. It is being distributed to ensure users' Google Toolbar search bars are Vista compatible.

you can turn this off, and if you think you need to update your google toolbar, there should be an option to check for updates .. I don't use google toolbar, if you find that it's not that usefull while you are online, ie, you don't use it often or at all, you can completely uninstall google toolbar. If you can't live without it, try using version 3 from here or somewhere else, as there are some reports of the newest updated versions causing problems with internet explorer, possibly due to them sending an update designed for windows vista, rather than windows xp.

Some people are mentioning how the toolbar is some kind of spyware, but i can't confirm this. They do mention that it tries to phone home for updates each time windows starts.. This can take away from the system's available resorces and increase the amount of time windows takes to start up.

These changes should be made in "SAFE-MODE"
to access safe mode, press the f8 key while your PC is starting up, you may have to tap it a number of times between powering on your PC, and the the time it takes to show the windows loading screen, in order for the command to be recognized. You will get a list of options, select "SAFE MODE"
after windows loads, run hijackthis and possibly do the following.

Google toolbar updater service.

If you don't want the google toolbar update service running,

Check the box next to:
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

HP drivers... If you know that you don't use HP share to web, check

Check the box next to:
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

**jholland1964** · 04-22-2008, 12:09 AM

If I can jump in here...Here is one problem right here;
in Running Processes;
C:\WINDOWS\system32\cidaemon.exe

If you are using a Windows XP-based computer, the computer may run slowly. Additionally, you may see the following symptoms in Windows Task Manager:
• The current CPU utilization is high.
• The size of the pagefile may be as large as 1.2 GB or more.
• The Cidaemon.exe process uses lots of pagefile space and lots of CPU time.

This issue can occur if the Indexing service is running on the computer. The Indexing service uses the Cidaemon.exe process to index files. The Cidaemon.exe process builds and updates the Index catalog. Additionally, the Cidaemon.exe process typically uses lots of pagefile space and lots of CPU time.

To resolve the issue, turn off the Indexing service. To turn off the Indexing service, follow these steps:
1. Double-click My Computer, point to Explorer Bar on the View menu, and then click Search.
2. Click Change preferences, and then click Without Indexing Service.
3. Click No, do not enable Indexing Service, and then click OK.

Now, in addition to cauzomb's suggestions about TeaTimer...right on by the way. TURN IT OFF
I would also suggest that you UNINSTALL AdAware 2007.
It runs all the time as a service for one thing so it is using up valuable memory. I personally don't care for this new edition. I just don't feel it is as good as AdAwareSE.
For additional protection I recommend you use the FREE program, SpywareBlaster from Javacool. It DOESN'T run in the background but offers superb protection against ActiveX-based spyware, adware, browser hijackers, dialers and also offers a Restricted Site protection for IE.
Here are auto starts and an explanation of what they are, that you can safely turn off, all will run manually if needed;
NvCplDaemon>>>This program is not required to start automatically as you can run it when you need to. It is advised that you disable this program so that it does not take up necessary resources.
nwiz>>>This program is not required to start automatically as you can run it when you need to. It is advised that you disable this program so that it does not take up necessary resources.
mDNSResponder.exe>>>> The Bonjour Service is typically installed with the iTunes software. Apple's site describes: "Bonjour, also known as zero-configuration networking.
This program is not required to start automatically as you can run it when you need to. It is advised that you disable this program so that it does not take up necessary resources.
IDriverT.exe>>> Program associated with InstallShield. This startup should only be created when a software that uses installshield is being installed. If you are not in the middle of installing a program, you can disable this entry.
An easy way to turn all of these off is to use Mike Lin's Start Up Control Panel

I would also suggest that you go to Crucial
and do a quick scan of your computer and see how much RAM you can add. I would recommend adding another 512MB. RAM is cheap and crucial is a good place to buy it. Just plug it in and you are good to go.
I would suggest doing all of the steps recommended by cauzomb, and disabling those unnecessary starts. Plus, REBOOT the computer because this should release some of that memory back.
Judy

**cauzomb** · 04-22-2008, 02:15 AM

Oh yeah, definately disable indexing. There are more ways to turn off indexing, and some recommendations to prevent system corruption in the event of a power failure, drive write cache can be disabled, as well as indexing service.

other ways to turn off indexing

In "my computer" you should have a list of local drives, right click and select PROPERTIES and uncheck the box that says "indexing" in the line of text next to it for each hard disk.. After unchecking, it prompts something, click OK, then it starts uncataloging all the indexed files and may give you a prompt that says something about cannot remove etc etc, because they are system files or something like that, click on the "IGNORE ALL"

You can also boot into safe mode, log in as administrator and open the control panel, open administrator tools, open "SERVICES" and scroll down the list of services to "INDEXING" right click on it and select properties, set it to DISABLED, then click the "STOP" button if available, then OK, close everything, restart.

To disable write caching to prevent data corruption, Right click on "MY COMPUTER" from the desktop, select properties, then select the hardware tab, then device manager, them find the "DRIVES" section in the device manager, click the little plus sign next to drives, there you will see a list of hard drives, right click on a hard drive, start with the first one, click on the policies tab, then uncheck the enable write caching box, then click OK.. Do this for each drive to keep changed/modified files from being held in memory.

**knight0334** · 04-22-2008, 05:08 PM

512mb is rather low for XP and today's usages. Another 512mb or more would help speed things up.

From the list provided - there really isn't alot running to eat ram. Some things can be cropped from boot up. Also, XP can be tweaked to use less ram as well.

One thing that hasn't been mentioned that XP does have fault with is - harddrive detection ATA setback. If a HDD has detection problems, XP sets the transfer rate back 1 setting for X number of bad detections. Slowly it will work its way back to PIO mode 1 at 8mbps and will tie up the PCI bus - thus the entire system. Its fairly easy to check in the device manager under the IDE ATA/ATAPI Controller. If its in the PIO modes, it will take a registry adjustment to fix.

Thread: Help with a serious loss of available physical memory

Thread Tools

Display

Help with a serious loss of available physical memory

Additional Information As Requested

Possible Infections and updated HJT log

Thread Information

Users Browsing this Thread

Posting Permissions