View Full Version : weird memory leak, trojans and more...


konny666
Sun, 2nd May '04, 3:22am
OK, so recently I had to fight off an "about:blank hijack" to Internet Explorer by some belligerent Trojan. I used "HijackThis" and "CWShredder" to get rid of the hijack.

But after solving that problem, I've got this crazy memory leak in WinXP. explorer.exe is taking up 50-70MB of ram. as a result, booting into the windows xp desktop shows my memory usage at 220-230MB. Right now its 320MB and I've only got 2 IE windows open! I'm also noticing a definite performance sluggishness - for example, when I've got NWN or IWD running, I can barely open a PDF in Acrobat. Usually I'm *always* alt-tabbing between Acrobat and a game, to look up rules and such. Suddenly, I can't do that. It's definitely the memory leak.

Any ideas?


(note: before all this happened, a fresh boot into the winxp desktop would yield a memory usage of 110MB. if i started shutting down apps, like McAfee and such, I could bring it down to 95MB. sometimes I'd do that before I played a resource-hogging game like Gothic 2)

ejsmith
Sun, 2nd May '04, 6:27am
Well, aside from crashing your machine, I only have a one other "tip".

Completely castrate Internet Explorer. No cookies, no java, no script, no activex, no sandboxes or auto-installs. Basically, the "high" security level, with some stuff turned down just a tiny bit. You'd be surprised how many problems this solves, before they even get started. Use a different browser for when you need better functionality.

konny666
Sun, 2nd May '04, 7:18am
is the best solution to my problem simply wiping windows and re-installing the OS?

it's been over 2 years since i installed the OS. is that too long?

Sarevok•
Sun, 2nd May '04, 2:15pm
Just format man, it takes like an hour maybe and then you have no problems with your PC. Anywayz, 2 years is a long time without formatting.

Wordplay
Sun, 2nd May '04, 2:22pm
True, somehow my Windows had bloated to over 4 gigs even though I had cleaned up everything. :confused:

Just remember to do the following after formatting: first install firewall, then update the OS, and then the drivers. Voilâ; clean machine for the next two or three years. :cool:

Taluntain
Sun, 2nd May '04, 6:08pm
NWN, when running, takes up all the available system resources, so running Acrobat alongside would definitely be sluggish no matter what. Same with IWD probably.

Wildfire
Sun, 2nd May '04, 6:10pm
Before formating, try running both Spybot (http://security.kolla.de/) and Ad-aware (http://www.lavasoftusa.com/software/adaware/).

You could also just try using a different browser, one like MyIE2 (http://www.myie2.com).

konny666
Sun, 2nd May '04, 7:50pm
Taluntain,

When they're *running* they take up full resources, yeah. But once you ALT+TAB to the windows desktop, they'll give up resources to other programs, unless those programs are running at "Low" priority or less. As I said, I've been doing that to check the manual/rules PDF's while playing the games for over a year...
Try it yourself.

Oh, and its Acrobat 5.1, to cut down on the unnecessary extra crap.

BTW If what you're saying is true, then it would be impossible to run a NWN Server process on a computer which also has the client running - the server runs in a completely different program/app/process (run nwserver.exe). As evidenced from the numerous NWN servers being run from the same computer as someone who's playing - not quite true.

Taluntain
Sun, 2nd May '04, 11:09pm
Alt+tabbing out of NWN (which is a completely unsupported feature, without any optimization) will, at best, make the game use a fraction less resources than if you're playing it, just because the game isn't progressing anywhere while you've minimized it. I think Gaider explained pretty much the same thing on the official boards a few weeks ago. The game's always been using up the same amount of resources when minimized. The culprit for your slowdown is somewhere else.

As for the server, I'm not sure what you're trying to prove with your post. You point out yourself that the server is a completely different process. One which does not use up all available resources.

Btw, Reader 6.0.1 has been out for half a year now. Try updating. Alongside that, you should run Ad-Aware to see if you've got any malware left on the computer.

Wordplay
Sun, 2nd May '04, 11:56pm
Tal, isn't he talking about the actual software, not just the reader part...?

Why start removing all that malware one by one now, when your OS anyway needs formatting...? Fresh start, like they say.

Rednik
Mon, 3rd May '04, 12:02am
I hope I'm not sounding stupid or something, but could it have anything to do with the latest worm? It's rumored to slow down computers if they're hooked up to the internet.


http://news.yahoo.com/news?tmpl=story&u=/afp/20040502/tc_afp/internet_virus_040502191735

konny666
Mon, 3rd May '04, 9:11pm
Tal,

I think you misunderstood my post. My point was that, prior to 3 days ago, I was able to ALT+TAB out of any Bioware game (while paused), and open up Acrobat (either 5.1 or 6.x) to browse the PDF manuals without any problem. What I am saying is that I *WAS* doing that for the year or so I've been playing NWN. And suddenly, after the malware hit my system, this was no longer possible due to *something* taking up a massive amount of resources, both CPU and memory. I was able to diagnose what that *something* was - see below.

(Running Acrobat with NWN running in the background is no different than starting the NWServer process with NWN running in the background... that was the point of my example. NWN is designed to work with other processes running in the background. You can, for example, start the server - which is a separate program from NWN - load a module into it, then start NWN, go into multiplayer mode, connect to localhost, and play that module. It'll work just fine, sometimes with even better performance than playing that module in single-player mode)


Others,

I was able to solve the problem. The memory leak was due to some sort of malware/spyware/worm "hiding" in the computer, preventing any of my usual anti-virus programs, or HijackThis, Spybot S&D from detection. It took Ad-Aware running in safe mode to get rid of it. The latest Microsoft critical update has hopefully hardened IE from future infection. Anyways, I will be staying away from IE from now on and just using Netscape 7.1, or maybe FireFox.

Also I have found that surfing the Internet with IE, even in HIGH security mode (the one where almost everything is supposedly blocked) can STILL allow this malware/worm/whatever to get onto your system! Ridiculous...

Wordplay
Mon, 3rd May '04, 9:53pm
*Hint* *Tip* *Nudge* *Nudge*

Mozilla 1.7 :D

Taluntain
Tue, 4th May '04, 12:46am
konny666, I think you misunderstood mine, considering that at the end you came to the same conclusion as I did - "The culprit for your slowdown is somewhere else." The NWN comments were just some background info, not the point of my posts. ;)

Btw, why are you running Acrobat just to read manuals/walkthroughs? Run Reader, it uses significantly less resources than the full Acrobat.

konny666
Wed, 5th May '04, 12:01am
ah, the wonder of the internet. looks like we are bother misunderstanding each other...

anyways... yup, you're right, i do use Reader. or whatever the "free" one is called. *sigh* ... oh, and the reason I use 5.1 instead of 6.0x is because it shaved 10 seconds off the loading time and it works PERFECTLY with all my PDF manuals - even new ones like HoTU. maybe i'll have to upgrade once I get a manual which needs 6.0, but so far that is not the case.

others: i'm experimenting with netscape now. one thing i can't stand is the 15 second loadup time! IE takes half a second to load, so its tempting to go back to it, in fact, i'm using it right now... probably will get hit by another worm soon...

Taluntain
Wed, 5th May '04, 12:23am
Funny, 6 loads much faster for me than 5...

Btw, if you need just a browser, don't get Netscape. Get FireFox (http://www.mozilla.org/products/firefox/).

Rastor
Wed, 5th May '04, 4:26pm
Although are are some JavaScripts out there that will not work on any browser except IE. I've never had any worm/spyware problems with IE, but then I have yet to see anything that can get through a hardware VPN firewall and NPF.

For the record, I've run Outlook XP Pro along with NWN, Trillian, and Internet Explorer with virus software and firewalls running and got the best performance that I've ever seen out of NWN. This was on a computer that barely meets the minimum specs too.

Although, using alt-TAB to get out of NWN does cause problems with the game.

konny666
Thu, 6th May '04, 12:16am
thumbs-up to FireFox. it's just like IE... except without the perceived security flaws! :)

metal leper
Thu, 6th May '04, 1:17am
alt-tab causes problems with a lot of games, as does pressing the windows key

Disabling them (and other windows shortcuts is apparently bad programming practise (MSDN basically says to not even think about doing it), though I personally wish games would give me the option of disabling them from working while I'm playing

Firefox isn't like IE - tabbed browsing, and extensions make it a million times better IMO. Unfortunately it's easier for badly coded websites to crash it

Webmasters with sites that don't load properly in browsers that aren't should be sent emails with a link to validator.w3.org. Unfortunately IE seems to be more important than standards these days, but it still can't cope with alpha transparency, :D

konny666
Thu, 6th May '04, 2:59am
I know alt+tab causes problems for lots of people - and BTW there *is* an app which can disable your windows key, at least - but for me, its never caused problems for any of the BioWare engine games. All IE games and NWN (haven't tried kotor) work fine with that - good thing, since they're the ones I usually need to check the manual while playing. OTOH, most first person shooters go batty whenever I try to alt+tab...

firefox is still only a "demo", right? so it can only get better. hopefully any stability issues will be ironed out for version 1.0 - but something tells me Microsoft will try to steal as many of FF's good ideas as it can for IE v7.0!

Ahrontil
Thu, 6th May '04, 6:44am
At the risk of repeating myself ad nauseum, (I think I may be developing Alzheimers), you should have a Firewall like Zonealarm installed to prevent future infection.

If you haven't then, you can check your current defenses here. (http://grc.com/zonealarm.htm)

I think I posted stuff about this before, but I cannot remember, (I think I may be developing, ooh? what is it called now? No, its gone, nevermind). :)

metal leper
Thu, 6th May '04, 1:08pm
As far as I can tell it's the mozilla stuff that makes firefox crash rather than problems with firefox

Undoubtedly MS will take ideas developed in other browsers and try to patent them. Shame firefox isn't under the BSD license - they could just rerelease the exact same product but make it look more microsofty and as long as they credited the original authors (who reads that anyway?) they can do what they want with it. That'd things much easier for them.. :rolleyes:


But yes, everyone using windows would be well advised to have a firewall - people using other OSs should have one too, but it's not as critical

Does anyone know if there's a windows equivalent of tripwire/aide? They are programs that take a snapshot of your system, so you can check against that to see what's changed.

(Oh, and by the way, windows lets you choose to disable shortcut keys (individually) I think, but I'm far too lazy to disable them everytime I want to play a game and then have to turn them back on when I'm done)

ejsmith
Fri, 7th May '04, 12:26am
Wow.

I've been using Firebird/Firefox for a while, now. And it's at least as stable as IE, but without all the security holes. IE is actually pretty stable for me, but it's basically like BrowseX; text and pictures, and that's about it.

I'm not justifying the domain, I'm just pointing it out. www.microsuck.com (http://www.microsuck.com) has an enormous list of "alternative" choices, all down the left hand column. And it's well worth your time to take a look through there, in terms of browsers.

After that, I recommend Zonealarm and Norton's AV. I've tried Mcafee (in the past), and I've tried some other firewall (I don't even remember which ones). ZA updates on a consistant basis, and Norton's has always worked well for me (and that is saying something :) ).

After all that, I'd recommend a complete crash. Re-partition, low level format, clean install.

Always land going with the wind-rows.

Rastor
Sat, 8th May '04, 8:38pm
Does anyone know if there's a windows equivalent of tripwire/aide? They are programs that take a snapshot of your system, so you can check against that to see what's changed.
Norton Utilities will do it. There may also be a Windows system utility with XP that will do it.

Webmasters with sites that don't load properly in browsers that aren't should be sent emails with a link to validator.w3.org. Unfortunately IE seems to be more important than standards these days, but it still can't cope with alpha transparency, The problem is not bad HTML. The problem that's preventing some of those sites from displaying is that Mozilla and others do not support certain types of embedding. Reload the majority of those sites in IE and they'll work fine.

BTW, there are security holes in any browser. Hackers just don't write programs to exploit holes in Mozilla, Opera, FireFox, etc. because those browsers are not as common as Internet Explorer.