Solved Windows uses full RAM without process

[tibo88]

Hi,


About 9 minutes after startup of windows 7, the RAM usage increases linearly to reach max. And then my PC is stuck. I don't find any process using all this RAM even using RAMMAP. (it is always 9 minutes)

I also don't manage to restore old point. I lost the windows search service and I don't manage to restore the service.



Is someone knows where is the problem?

 

[ThrashZone]

Hi and welcome to SevenForums,
You have an astounding 9082 processes running :shock:
I'd try clean boot and run some free scanners,
Use Clean boot,
http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html
Click Start and type in the search box,
msconfig
Click on the suggestion on top or hit the Enter key,
Go to the Startup section and take some screen shots for a complete list,
Go to the Services section and on the bottom left Check the box to Hide All Microsoft services,
Repeat the screen shots,
See the links above my signature on how to take and upload screen shots here,

Review Jacee’s instructions to run Adwcleaner here post #7,
Ignore the title of the thread,
http://www.sevenforums.com/system-security/316404-instant-savings-app.html
On the BleepingComputer site use the button that looks like this,

Manually Update them before running full scans,
Try not to use your computer while the scans are running, (one at a time of course).
See this tutorial on how to download and run Malwarebytes,
http://www.sevenforums.com/tutorials/338716-malwarebytes-anti-malware-free.html
Also be sure to scan for rootkits in the custom scan/ Configure scan options


Also use the Custom scan option not the Threat scan,
Malwarebytes | Malwarebytes Anti-Malware Premium
SAS is safe to remove anything it finds
SUPERAntiSpyware | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

 

[Callender]

RE: RAMMap. Forget processes. Try "File Summary" tab then sort by "Active" - high to low.

Post a screenshot if anything shows up with high "Active" RAM usage.

 

[tibo88]

Thank you for your help.

I switched in clean mode (I have to use safe mode for long scan because whan the RAM usage increases the scan becomes very slow).

-Adwcleaner (see report below)
- Malwarebytes found nothing
- SAS found 4 tracking cookies

I don't see high active process in "File summary".

The problem is the same: the number of process is around 60 (in clean mode) and increase to 9000 when the RAM increases.

# AdwCleaner v5.201 - Rapport créé le 25/07/2016 à 23:33:59
# Mis à jour le 30/06/2016 par ToolsLib
# Base de données : 2016-07-25.1 [Serveur]
# Système d'exploitation : Windows 7 Professional Service Pack 1 (X64)
# Nom d'utilisateur : xxxxx.xxxx - xxxxxxxx
# Exécuté depuis : C:\Users\xxxxx.xxxxxx\Downloads\AdwCleaner.exe
# Option : Scanner
# Support : https://toolslib.net/forum

***** [ Services ] *****


***** [ Dossiers ] *****

Dossier trouvé : C:\Users\xxxx\AppData\Local\FileViewPro
Dossier trouvé : C:\Program Files\FileViewPro

***** [ Fichiers ] *****

Fichier trouvé : C:\Windows\SysWOW64\lavasofttcpservice.dll
Fichier trouvé : C:\Windows\SysWOW64\LavasoftTcpServiceOff.ini
Fichier trouvé : C:\Users\xxxxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\5xn2s8fs.default\searchplugins\bing-lavasoft.xml
Fichier trouvé : C:\Windows\SysNative\LavasoftTcpService64.dll
Fichier trouvé : C:\Windows\SysNative\LavasoftTcpServiceOff.ini

***** [ DLL ] *****


***** [ WMI ] *****


***** [ Raccourcis ] *****


***** [ Tâches planifiées ] *****


***** [ Registre ] *****

Clé trouvée : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
Clé trouvée : HKLM\SOFTWARE\Classes\TypeLib\{ED62BC6E-64F1-46BE-866F-4C8DC0DF7057}
Clé trouvée : HKLM\SOFTWARE\Lavasoft\Web Companion

***** [ Navigateurs ] *****

[C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\5xn2s8fs.default\prefs.js] trouvée : user_pref("browser.newtabpage.url", "hxxp://www.bing.com/?pc=COSP&ptag=D060716-A295234DE60&form=CONMHP&conlogo=CT3334485");
[C:\Users\xxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\5xn2s8fs.default\prefs.js] trouvée : user_pref("browser.search.defaultenginename", "Yahoo! Powered");
[C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\5xn2s8fs.default\prefs.js] trouvée : user_pref("browser.search.selectedEngine", "Yahoo! Powered");
[C:\Users\xxxxx\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] trouvé : search.avira.com
[C:\Users\xxxxx\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] trouvée : fcfenmboojpjinhpgggodefccipikbpd

*************************

C:\AdwCleaner\AdwCleaner[S1].txt - [2013 octets] - [25/07/2016 23:21:53]
C:\AdwCleaner\AdwCleaner[S2].txt - [2527 octets] - [25/07/2016 23:26:55]
C:\AdwCleaner\AdwCleaner[S3].txt - [2601 octets] - [25/07/2016 23:30:47]
C:\AdwCleaner\AdwCleaner[S4].txt - [2521 octets] - [25/07/2016 23:33:59]

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [2595 octets] ##########


# AdwCleaner v5.201 - Rapport créé le 25/07/2016 à 23:35:40
# Mis à jour le 30/06/2016 par ToolsLib
# Base de données : 2016-07-25.1 [Serveur]
# Système d'exploitation : Windows 7 Professional Service Pack 1 (X64)
# Nom d'utilisateur : xxxxxx - xxxxx
# Exécuté depuis : C:\Users\xxxxx\Downloads\AdwCleaner.exe
# Option : Nettoyer
# Support : https://toolslib.net/forum

***** [ Services ] *****


***** [ Dossiers ] *****

[-] Dossier supprimé : C:\Users\xxxxxx\AppData\Local\FileViewPro
[-] Dossier supprimé : C:\Program Files\FileViewPro

***** [ Fichiers ] *****

[-] Fichier supprimé : C:\Windows\SysWOW64\lavasofttcpservice.dll
[-] Fichier supprimé : C:\Windows\SysWOW64\LavasoftTcpServiceOff.ini
[-] Fichier supprimé : C:\Users\xxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\5xn2s8fs.default\searchplugins\bing-lavasoft.xml
[-] Fichier supprimé : C:\Windows\SysNative\LavasoftTcpService64.dll
[-] Fichier supprimé : C:\Windows\SysNative\LavasoftTcpServiceOff.ini

***** [ DLLs ] *****


***** [ WMI ] *****


***** [ Raccourcis ] *****


***** [ Tâches planifiées ] *****


***** [ Registre ] *****

[-] Clé supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
[-] Clé supprimée : HKLM\SOFTWARE\Classes\TypeLib\{ED62BC6E-64F1-46BE-866F-4C8DC0DF7057}
[-] Clé supprimée : HKLM\SOFTWARE\Lavasoft\Web Companion

***** [ Navigateurs ] *****

[-] [C:\Users\xxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\5xn2s8fs.default\prefs.js] supprimée : user_pref("browser.newtabpage.url", "hxxp://www.bing.com/?pc=COSP&ptag=D060716-A295234DE60&form=CONMHP&conlogo=CT3334485");
[-] [C:\Users\xxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\5xn2s8fs.default\prefs.js] supprimée : user_pref("browser.search.defaultenginename", "Yahoo! Powered");
[-] [C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\5xn2s8fs.default\prefs.js] supprimée : user_pref("browser.search.selectedEngine", "Yahoo! Powered");
[-] [C:\Users\xxxxx\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] supprimé : search.avira.com
[-] [C:\Users\xxxxx\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] supprimé : fcfenmboojpjinhpgggodefccipikbpd

*************************

:: Clés "Tracing" supprimées
:: Paramètres Winsock réinitialisés

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [2493 octets] - [25/07/2016 23:35:40]
C:\AdwCleaner\AdwCleaner[S1].txt - [2013 octets] - [25/07/2016 23:21:53]
C:\AdwCleaner\AdwCleaner[S2].txt - [2527 octets] - [25/07/2016 23:26:55]
C:\AdwCleaner\AdwCleaner[S3].txt - [2601 octets] - [25/07/2016 23:30:47]
C:\AdwCleaner\AdwCleaner[S4].txt - [2675 octets] - [25/07/2016 23:33:59]

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [2863 octets] ##########

 

[SCANNERMAN777]

Have you tried running a leak test?

 

[tibo88]

I found the problem. It is linked to java. I don't know why but a lot of javas.exe processes were launched. I uninstalled java and it is ok.

Thank you for your help.

 

[ThrashZone]

Hi,
Yep Oracle bites
How many processes do you have now
I show all users as 55 processes at this moment the 8k you had going was pretty wild

 

[tibo88]

Now it is about 60 processes. Your question on the 9000 processes give me the hint to look at these processes.

Thank you!