Member Avatar for Tcll

this problem occured shortly after I fixed the explorer.exe issue, which ended up being a rootkit.
I'd figured my .NET packages were corrupted so I just reinstalled them recently.

37% is the lowest it's ever happened to me, but normally my RAM is over 50% when it happens...
I'll just get actions like:
- clicking a shortcut does nothing
- opening a new window or program fails
- dialogs refuse to open
- context menus don't fully display
at worst:
- programs report errors and/or crash when running
- programs (such as Winamp) hang when starting

these are all signs of low memory, but my ram isn't even above 70%
what's happening here??

EDIT: I have 4GB of RAM

Edited by Tcll
  • 2 Contributors
  • 2 Replies
  • 231 Views
  • 23 Hours Discussion Span
  • Latest Post Latest Post by Tcll

Dani AI

Generated

Short diagnostic-and-repair plan for the situation reported by (possible persistent rootkit + battered system files). A full reinstall (as suggested by ) will work, but a staged recovery can save time and preserve data if the problem is removable: first image the drive, then run offline/rootkit-capable scanners, repair the file store, and only reinstall if corruption or kernel-level infection persists.

Recommended sequence (perform in this order):

  1. Create a full disk image to external media (image/clone before doing repairs or chkdsk).

  2. Run an offline rescue scan from bootable media (Microsoft Defender Offline or a reputable rescue ISO such as Kaspersky Rescue Disk) to remove hidden/rootkit components that survive normal boot. (learn.microsoft.com)

  3. If the offline scan finds/removes malware, boot Windows Recovery and run disk and system-repair tools in this order: 

    chkdsk C: /f /r
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

    CHKDSK should be used to handle unreadable-file/disk errors; DISM + SFC is the supported sequence to repair missing or corrupted system files. (learn.microsoft.com)

  4. If problems remain (GUI actions still fail or programs crash while overall RAM looks modest), investigate kernel/pool and handle exhaustion: use Process Explorer for live process/handle inspection and PoolMon (or WDK tools) to find nonpaged/paged pool leaks associated with drivers. A leaking kernel pool or a misbehaving driver can block window creation even when user-mode memory appears available. (learn.microsoft.com)

If the rescue media + DISM/SFC/CHKDSK pass but instability continues, a clean OS reinstall after restoring user data from the image is the most reliable final step. Preserve the disk image and any forensic logs (rescue-scan logs, PoolMon/Process Explorer dumps) if vendor/antivirus support is needed.

Recommended Answers

All 2 Replies

Member Avatar for rubberman

Perhaps your system is still pwnd and/or corrupted? Have you tried re-installing Windows from scratch (from DVD)? Also, did you scan your boot sector and recovery partition for infections. I have seen a number of instances where they contained malware so when you reboot or try to recover your system, it will become re-infected.

Member Avatar for Tcll

well crap >_<

I was trying to avoid that, but it looks like I may have to.

however, I've just recently installed Avast and it's already found alot that not even TDSS Killer can find, though it's also reporting alot of TIF and MID files as infected. :P
(methinks it just does a simple find/compair on files and just happend to find a match with the data arrangement in those files)
^ I know they're not infected

I do intend to install Kaspersky along with Avast just for added support...

hopefully one of these will be able to fix my system.
(I'm most likely gonna have to reinstall updates again... heh)

for more news, programs are reportng .NET 4.0 is missing when I just ran 3 installers and repaired it...
not to mention things like sndvol32.exe and disk defragmentor are apparently missing.

I've found sndvol32.exe because after the "not found" error, it starts up...
when I try to copy it directlry, I get an error saying it can't be read from the disk.

what makes things even more funny, is it'll compress to a zip, but when you try to move the zip, you'll get the same error.
you can still extract sndvol32.exe from the zip to another location, and you can delete the zip.
(boom, copied)

I'm hoping I can recover from whatever this is...
I'm gonna take a few more chances, but if I can't get anywhere, I'm reinstalling. >_<

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.