Dying RAM? -Major Update-

[InfinateX]

Okay, so, just a little while ago, I had a huge issue with my RAM. I was sitting here just Playing Oracle of Ages on my computer when all of the sudden my computer just slowed right down. It took a bit of time, but I was able to minimize my emulator and check out the CPU and RAM usage meters I have on my desktop (the gadgets available with Windows 7 OS). To my surprise, my CPU was only being used to about 25% of it's capacity. The RAM however was near maxed out at 94%. This has NEVER happened before. Since the computer was being really slow this took some time, but I was able to figure out what was using so much of my RAM.

 

At first I just tried closing some of the processes that I didn't need running, but this wasn't helping at all. Finally I decided, "I can only see a small amount the processes, why not click the view all button?", and when I did, I found out exactly what the problem was. The Windows Task Host (svchost.exe) was ranging between 60,000 ~ 100,000 K of my RAM. At this point, I decided it was best to just restart my computer and hope it fixed itself. Well, it did. The problem is, it took somewhere between 15 ~ 30 minutes just to shut down. Normally it takes 1 minute at most.

 

During the shut down process, I started to think to myself (and this may or may not make sense), "K means kilobites, right? So isn't 100,000 K just a very small fraction of my RAM? I have 4 GB after all." So I decided to come here and ask if any of you might be able to help diagnose the issue. Even with all applications closed, I was still getting 94% usage of my RAM. I believe my system specs are as stated below;

 

OS: Microsoft Windows 7 Ultimate 64x

CPU: Amd Athlon x2 5000+ AM2

RAM: Kingston DDR2 @ 800Mhz 4GB

MB: ASUS M3A78 AM2+

HDD: Old WD Caviar SE 150GB

GPU: Nvidia 250GTS 512MB ( it was upgraded from an old 8500GT )

 

(I'd also supply a list of my drivers but I'm unsure as to where I can check them.)

 

So what do you guys think? Did some of my RAM die? Is there a software/firmware issue? I need help so I can prevent this from happening again.

 

-UPDATE-

Okay, so here's the issue now. Today (August 5th) I was playing Minecraft. Everything was fine, albeit, a tad bit slower than usual. Suddenly, as I tried to exit fullscreen, the game got much slower. In fact, the entire computer did. I was thinking it was svchost.exe again. It wasn't. This time the issue was Java. Java was using as much as 3,000,000 KB of RAM. If I'm correct, that's 3 GB. That 75% of my RAM. My computer, however, was not as slow as it was 2 days ago when I had a simlar problem. At the same time though, the highest amount of RAM being used by a single process besides Java was only around 2,000 KB, as apposed to 20,000 like it was the other day. I've run a virus scan and cleared up the issues. I've run Memtest and found no issues. Clearly, this is a software issue, and it's not a virus of any sort. Does anybody have any clue whatsoever of what this may be?

[mgsstar]

I would try running MemTest 86+ to see if your ram is defective. But I am pretty sure that it is a software issue. Try doing a full system scan to check if your computer has viruses using Malwarebytes/Superantispyware. Which application is using the most ram?

[Godlygamer23]

Sometimes misreadings happen for RAM usage. The Window Task Host may have been sucking down RAM while only giving you a reading of 100,000KB. It's happened before on my laptop. See if it occurs again.

Also wouldn't hurt to try what @mgsstar suggested.

[InfinateX]

I would try running MemTest 86+ to see if your ram is defective. But I am pretty sure that it is a software issue. Try doing a full system scan to check if your computer has viruses using Malwarebytes/Superantispyware. Which application is using the most ram?

I should  have mentioned, 64x OS. Will I need to use a MemTest 64x version? In the op I mentioned that it's svchost.exe using the most RAM, which is a vital part fo the Windows Operating System, so it's not something I can just close out. I will run a virus scan in the mean-time.

[mgsstar]

I should  have mentioned, 64x OS. Will I need to use a MemTest 64x version? In the op I mentioned that it's svchost.exe using the most RAM, which is a vital part fo the Windows Operating System, so it's not something I can just close out. I will run a virus scan in the mean-time.

I think there is only one version: http://www.memtest.org/#downiso

Check what programs rely on svchost using process explorer: http://technet.microsoft.com/en-ca/sysinternals/bb896653.aspx

[InfinateX]

I think there is only one version: http://www.memtest.org/#downiso

Check what programs rely on svchost using process explorer: http://technet.microsoft.com/en-ca/sysinternals/bb896653.aspx

Alright. Currently running a whole computer scan through AVG. I've downloaded both the bootable ISO version of memtest, and the process explorer. I'll run each of them after my scan.

[InfinateX]

AVG so far found 4 threats.I'm pretty sure 3 were in the process, but it could have been all 4 in the registry. I've got about another 40% to scan.

[InfinateX]

7 threats have been found in the file system. Kinda uneasy about that.

 

Overall, 9 Trojan Horses (mostly generic). All 11 viruses were contained and correct.

AVG reports the viruses as;

• "";"Found Luhe.Boxed.AM, C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe (3624)";"Secured"
• "";"Found registry key with reference to infected file C:\Users\Josh and Jess\AppData\Roaming\Microsoft\Windows\Templates\spsreng.exe, HKU\S-1-5-21-2004390726-3051720703-1647596313-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Activex Application Updater";"Reboot is required to finish the action"
• "";"Trojan horse Agent3.CKCK, C:\Users\Josh and Jess\AppData\Roaming\Microsoft\Windows\Templates\spsreng.exe (2848)";"Reboot is required to finish the action"
• "";"Trojan horse Agent3.CKCK, C:\Users\Josh and Jess\AppData\Roaming\Microsoft\Windows\Templates\spsreng.exe";"Reboot is required to finish the action"
• "";"Trojan horse BackDoor.Generic_c.FHP, C:\Users\Josh and Jess\AppData\Local\Temp\PromoEngineInstaller\NETWrapper.dll";"Secured"
• "";"Trojan horse Delf.ALGE, C:\Users\Josh and Jess\AppData\Roaming\BCWorker.exe";"Secured"
• "";"Trojan horse Generic30.WWB, C:\Users\Josh and Jess\AppData\Local\Temp\Software\Demonbuddy.exe";"Secured"
• "";"Trojan horse Generic30.WWB, C:\Users\Josh and Jess\AppData\Local\Temp\dmview.exe";"Reboot is required to finish the action"
• "";"Trojan horse Generic30.WWB, C:\Users\Josh and Jess\AppData\Local\Temp\dmview.exe (2896)";"Reboot is required to finish the action"
• "";"Trojan horse Generic7_c.CEGX, C:\Program Files (x86)\Age of Empires II HD\steam_api.dll";"Secured"
• "";"Trojan horse PSW.Generic8.CLGB, C:\Users\Josh and Jess\Documents\Josh's Stuff\Games\Diablo 2 + Lord of Destruction\Diablo 2 CD Key Generator.exe";"Secured"

 

I'm going to restart my computer and then run memtest.

By the way, I noticed myself that one of the Trojan Horses was with a program called Demonbuddy. I tried removing that months ago after I realised it was a Diablo 3 bot, but it didn't fully unistall for some reason, and now a Demonbuddy.exe process appears, an it was using about 8,000 K of my RAM when I was having the issue earlier. When I try to close the process it says access denied. Anybody know a way around this? My user account is set as an administrator, and I'm almost certain my controls are as high as they can be. Anybody know how to fix that as well?

Edited August 3, 2013 by InfinateX

[Godlygamer23]

Can you attempt to remove them? Also, they may be false positives.

[InfinateX]

Can you attempt to remove them? Also, they may be false positives.

I assume a few of them are definately false positives. (Mainly the last two) I've never had issues with games or some programs, but do get positives a lot on them. They could have been infected though. By the way, I updated my last post while you were posting yours. You may want to check it out.

[Godlygamer23]

To fully remove the bot, try booting into Safe Mode.

[mgsstar]

7 threats have been found in the file system. Kinda uneasy about that.

 

Overall, 9 Trojan Horses (mostly generic). All 11 viruses were contained and correct.

AVG reports the viruses as;

• "";"Found Luhe.Boxed.AM, C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe (3624)";"Secured"
•  
• "";"Found registry key with reference to infected file C:\Users\Josh and Jess\AppData\Roaming\Microsoft\Windows\Templates\spsreng.exe, HKU\S-1-5-21-2004390726-3051720703-1647596313-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Activex Application Updater";"Reboot is required to finish the action"
•  
• "";"Trojan horse Agent3.CKCK, C:\Users\Josh and Jess\AppData\Roaming\Microsoft\Windows\Templates\spsreng.exe (2848)";"Reboot is required to finish the action"
•  
• "";"Trojan horse Agent3.CKCK, C:\Users\Josh and Jess\AppData\Roaming\Microsoft\Windows\Templates\spsreng.exe";"Reboot is required to finish the action"
•  
• "";"Trojan horse BackDoor.Generic_c.FHP, C:\Users\Josh and Jess\AppData\Local\Temp\PromoEngineInstaller\NETWrapper.dll";"Secured"
•  
• "";"Trojan horse Delf.ALGE, C:\Users\Josh and Jess\AppData\Roaming\BCWorker.exe";"Secured"
•  
• "";"Trojan horse Generic30.WWB, C:\Users\Josh and Jess\AppData\Local\Temp\Software\Demonbuddy.exe";"Secured"
•  
• "";"Trojan horse Generic30.WWB, C:\Users\Josh and Jess\AppData\Local\Temp\dmview.exe";"Reboot is required to finish the action"
•  
• "";"Trojan horse Generic30.WWB, C:\Users\Josh and Jess\AppData\Local\Temp\dmview.exe (2896)";"Reboot is required to finish the action"
•  
• "";"Trojan horse Generic7_c.CEGX, C:\Program Files (x86)\Age of Empires II HD\steam_api.dll";"Secured"
•  
• "";"Trojan horse PSW.Generic8.CLGB, C:\Users\Josh and Jess\Documents\Josh's Stuff\Games\Diablo 2 + Lord of Destruction\Diablo 2 CD Key Generator.exe";"Secured"
•  

 

I'm going to restart my computer and then run memtest.

By the way, I noticed myself that one of the Trojan Horses was with a program called Demonbuddy. I tried removing that months ago after I realised it was a Diablo 3 bot, but it didn't fully unistall for some reason, and now a Demonbuddy.exe process appears, an it was using about 8,000 K of my RAM when I was having the issue earlier. When I try to close the process it says access denied. Anybody know a way around this? My user account is set as an administrator, and I'm almost certain my controls are as high as they can be. Anybody know how to fix that as well?

Use fileassassin in order to delete it if you cannot delete it but make sure that no program is using this file: http://www.malwarebytes.org/products/fileassassin/ or go to safe mode to try to delete it. Let AVG restart and remove the threats first to see if you can terminate/delete the process in safe mode. It might be also a permission problem causing you to be unable to close it. Here is a shortcut in taking ownership of a file: http://www.sevenforums.com/tutorials/1911-take-ownership-shortcut.html

[InfinateX]

Use fileassassin in order to delete it if you cannot delete it but make sure that no program is using this file: http://www.malwarebytes.org/products/fileassassin/ or go to safe mode to try to delete it. Let AVG restart and remove the threats first to see if you can terminate/delete the process in safe mode. It might be also a permission problem causing you to be unable to close it. Here is a shortcut in taking ownership of a file: http://www.sevenforums.com/tutorials/1911-take-ownership-shortcut.html

Quick question. I decided to use the USB version of the Memtest. Do I simply copy the .exe into a USB, or do I have to run the .exe to generate files then put those on the USB?

[InfinateX]

My computer crashed (no bsod) and then failed to boot, so I'm currently running system repair. I think I'll end up going to bed before it finishes, so ill update later.

System repair is complete. It detected no problems.

Edited August 3, 2013 by InfinateX

[Keystone Nyan Cat]

If your RAM is clear of problems and if you still get errors, I recommend just nuking the HDD [http://lifehacker.com/5090567/dariks-boot-and-nuke-is-the-nuclear-option-of-secure-data-shredding] or format it and reinstall windows. Try burning Ubuntu from a seperate computer, booting into the Ubuntu ecosystem from the CD and copying all your important files to a pendrive if you have any critical data before this though.

[Frix]

Nothing I could suggest but I know how you feel, I'm currently only using 4gb ram and that gets into the 90% usage when in games.

[MG2R]

Firstly, use an AVG rescue disc to scan for virusses, it can clean way more than the in-system-AVG.

Secondly, it sometimes happens that Windows update is responsible (through svchost) for a freaking high amount of RAM consumption.

The reason your PC became so slow is because, when you run out of RAM, windows starts to swap out a lot to your HDD.

[InfinateX]

Thanks for the help. I'm busy today so I won't be able to troubleshoot my PC until tomorrow, or later tonight at the earliest.

[mgsstar]

Quick question. I decided to use the USB version of the Memtest. Do I simply copy the .exe into a USB, or do I have to run the .exe to generate files then put those on the USB?

Run the EXE in Windows and select your USB drive and it will help you install Memtest86 on your usb.

[InfinateX]

Run the EXE in Windows and select your USB drive and it will help you install Memtest86 on your usb.

Thank you. I'm home now so I'll get that done shortly.

 

I just used Process Explorer, and, as I expected, svchost.exe is used for various functions of the Windows Operating System. According to the program there are quite a few instances of the application that do their own things.

Edited August 4, 2013 by InfinateX

[InfinateX]

Ran Memtest earlier. It reported no problems with my RAM. It must have been a software issue. Hopefully it's already been resolved.

[InfinateX]

Major Update!!! See the OP for full detail.

 

TL:DR; Java was using 3 gigs of RAM.

[colonel_mortis]

Major Update!!! See the OP for full detail.

 

TL:DR; Java was using 3 gigs of RAM.

So there's a major memory leak with one of your pieces of software, possibly the JVM (java). Could you try reinstalling java? One of the advantages of Java is that it has built in memory management (you don't have to tell it to free up the memory you've allocated), so if you have a leak, it's an issue with the JVM rather than the software you're running.

[MG2R]

So there's a major memory leak with one of your pieces of software, possibly the JVM (java). Could you try reinstalling java? One of the advantages of Java is that it has built in memory management (you don't have to tell it to free up the memory you've allocated), so if you have a leak, it's an issue with the JVM rather than the software you're running.

A leak could be due to software as well. If your program creates a new creates a new Object everytime a section of code is run, but you don't remove all links to the previous Object, you have a memory like. I have done something ike that before, although it was whilst coding object oriented in C.

 

In response to your update: Minecraft is noturious for swallowing up RAM, so I guess it could just be because you were playing in a big world. It might help to reduce your render distance. The best would be to spend twenty bucks and get yourself an extra stick of RAM.

Edited August 5, 2013 by MG2R

[InfinateX]

So there's a major memory leak with one of your pieces of software, possibly the JVM (java). Could you try reinstalling java? One of the advantages of Java is that it has built in memory management (you don't have to tell it to free up the memory you've allocated), so if you have a leak, it's an issue with the JVM rather than the software you're running.

I might try that if the problem persists. I've never had an issue with Java before, so I'm thinking there might be a different issue.

 

A leak could be due to software as well. If your program creates a new creates a new Object everytime a section of code is run, but you don't remove all links to the previous Object, you have a memory like. I have done something ike that before, although it was whilst coding object oriented in C.

 

In response to your update: Minecraft is noturious for swallowing up RAM, so I guess it could just be because you were playing in a big world. It might help to reduce your render distance. The best would be to spend twenty bucks and get yourself an extra stick of RAM.

I've played Minecraft plenty of times with full graphics settings on large worlds and experienced no issues. This is especially true when I'm using OptiFine, which I am. I'll keep that in mind though.