no pagefile problem

[senderj]

I am using win7 sp3 x64 for quite a while and everything works fine until yesterday. All of a sudden after I logon, a msg poped-up saying my pagefile config has problem and windows created a temp file for me. A performance window also poped-up to prompt me to set up page file while the current setting showing no pagefile. I remember it should be automatic before the problem. SInce I use windows auto updates, I didn't really pay attention to what had been updated lately. But it seems IE was recently upgraded to IE11 but not sure when. Others updates were Nvidia GF Experience within Dec.

Here are what I tried to fix the problem but failed:
1. I tried to set pagefile to other 3 options: auto, system managed, custom. But none of them survive a reboot. I looked at the C:\ right after a reboot and found that the pagefile was actually appeared and then disappear shortly. These appear and disappear repeated many times and then the pagefile totally lost.
2. I searched the web for a solution and found some discussion on disabling a AFS service, but I don't have this service in my system.
3. I searched again and found some suggestion on sfc scan. I did it and a cbs.log file created. But when I open it using an id that belongs to the administrators group, it said access denied.

Appreciate any help or info on this.

 

[Golden]

I am using win7 sp3 x64 for quite a while

No such thing.....do you mean XP SP3? If so, do you mean x86?

Post full system specs:
http://www.sevenforums.com/tutorials/180324-system-info-see-your-system-specs.html

 

[Brink]

Hello Senderj,

How much free space do you have on your C: drive?

If you are running low on space, then this could be part of the issue. If you have another hard drive, you can have the page file on it instead to have enough space for it, and to leave enough free space on C: for Windows.

If you have not already, see if turning off the page file and restart the PC to clear and reset it, then turn the page file back on with it set to be managed by the system and restart.

Hope this may help for now,
Shawn

 

[senderj]

@Golden, here is a snip of my computer property and the result of running system info.

My other PC also has auto updating but it is still SP1. Does it means somebody has modified my win7?
@Brink, my HD still has a few hundreds GB. I tried the off and on, but I cannot turn the page file on, it keep on turning back to no page file.

any idea what had happened?

 

[senderj]

Sorry, the screen captures are here
https://www.facebook.com/photo.php?fbid=194126440789467&l=d1bdf9054b
https://www.facebook.com/photo.php?fbid=194126444122800&l=dcac1fd520

 

[Slartybart]

Hmmmm... what did you download recently?

What are teh dates of your restore points?

 

[logicearth]

Clearly a modified image of something. There is no Service Pack 3 for Windows 7. Where did you get this copy of Windows 7?

 

[Britton30]

Clearly a modified image of something. There is no Service Pack 3 for Windows 7. Where did you get this copy of Windows 7?

Agreed, thus far w7 has had only 1 Service Pack.

 

[Golden]

2nd one we have seen here in 2 days.......best to clean install.

 

[Slartybart]

Ad sponsored site strikes again. Softonic in this case.
There is no Win7 SP3, not even a Win7 SP2
windows 7 service pack 3 free download
windows 7 service pack 3 iso file free download

Don't be fooled!!!
Do NOT be fooled!!!​

 

[Golden]

Appears links have been removed

 

[Britton30]

Softonic has been seen in other scams too.

 

[Golden]

Note : MGADIAG from another SP3 issue. Installation does NOT appear to be counterfeit.

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-CRJWY-4VKBY-DRPDQ
Windows Product Key Hash: I4OtA6g1oxH6n5Ijec+vjJDAWh0=
Windows Product ID: 00359-OEM-8802145-58989
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010300.[B][COLOR="Red"]3[/COLOR][/B].0.003

OS Name:                   Microsoft Windows 7 Home Premium 
OS Version:                6.1.7601 [B][COLOR="red"]Service Pack 3[/COLOR][/B] Build 7601
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Workstation
OS Build Type:             Multiprocessor Free

 

[Britton30]

The build number is 7601 as mine is for SP1.

 

[senderj]

My win7 was installed >2 years ago. It never has pagefile problem until now. The recent recovery point is the nvidia experience update on 24 Dec.

With the SP3 thing, I scan my whole system with AVG and found that there is IRP hooks in ...system32\drivers\viaide.sys. AVG is not able to remove it. I checked the file with dir but it was not found. I checked again with attrib and found that the file has hidden and system attrib set, which is different from my other health win7 SP1. Further check other files in the folder, there are 2 more files with same attrib: cmdide.sys and auudaeam.sys. I am not able to replace them even using safe mode, it always said file not found. So I use win7 installation DVD's repair command prompt and successfully replace viaide.sys and cmdide.sys with the ones from health system. But auudaeam.sys is not in my health system so I just rename it to something else.

With these I am able to get my pagefile back. But still my system is "SP3". How can I get rid of this "SP3" thing and what is auudaeam.sys? Please help.

 

[Golden]

Upload auudaeam.sys to these two sites for scanning, then post back the reports please:

https://www.metascan-online.com/
https://www.virustotal.com/

Once you have done the above, I would suggest running this rootkit scanner (IRP hooks are usually associated with rootkit activity):

http://www.bleepingcomputer.com/download/tdsskiller/

 

[AddRAM]

If you have a valid Windows 7 activation key, I would download the proper iso for your key, and re install windows.

As everyone has stated, there is no such thing as Windows 7 with service pack 3.

And please fill in your system specs.

 

[senderj]

Thank you for all the replies.

@Golden, I've uploaded auudaeam.sys and other .sys to the two sites and scanned without any findings. tdsskiller didn't find anything also. But this is after my replacement fix.

My pagefile is back and I can use my system as usual now. But then I found that there are some other .sys file became "hidden" and "system". This time it is atapi.sys and dgacblxd.sys. I repeated what I had done before, replace atapi.sys from health system. But I couldn't find dgacblxd.sys. Renaming it causing system unable to reboot. Finally I have to boot my expired win8 vhd to rename it back (luckly it won't take an hour). So my problem is still there. I found a rootkit scanner called GMER. I scan my health system without any finding as expected. I then scan my problem system which has the atapi.sys replaced with the one from health system. Surprisingly, it alerted at atapi.sys with IRP! So I don't know what I can do next. Please help.

@Britten30, on the "SP3", I didn't download anything from Softonic or other unofficial sites. If I did, I should have a file in my download folder as I always did for tracing. But anyway, I was hit and I still didn't find any info regarding its removal.

@AddRAM, don't understand why an iso with the activation code would help.

One more question, I assume the sysinfo software in #2 can upload my sys info to this site. But it said SP3 when I run it. So if I upload now, will it says SP3 instead of SP1?

 

[Layback Bear]

My thoughts.
I don't want to see downloads from Facebook. Any thing can be altered.
I know this would work better.
By Brink?

http://www.sevenforums.com/windows-...ne-activation-issue-posting-instructions.html

Anything that could change SP-1 to SP-3 could of changed anything in the MGADiag report or any place else in the system.

ADDRAM suggestion in post # 17 is a excellent idea and then another MGADiag report.

The first report would give are experts a chance to maybe learn what is going on and the second report would let senderj know that their is a nice new clean and legal system to work with.

 

[senderj]

I've run the MGADIAG and the report is pretty much same as #13, with the "3". So even MS software couldn't tell the SP3 problem. What can I do about it? Is it the cause of the modified sys files of my system?

Regarding #17, I am not sure if I should disclose my activation key. Is it supposed to be kept confidential? I have the dvd and the key, so I don't need another one for re-installation. I know re-installing can eliminate the problem, but thinking of re-installing all the software I would put it as last resort, unless you tell me that I am hopeless now and re-installing is the only way. Otherwise I would continue to hunt for removal of the rootkit. Thanks.