IE uses too much memory

[airbornex]

Hi all. Recently, I noticed the IE on my laptop is eating up lots of memory and giving me problems. It will launch very slowly (or sometimes 'hang' in the process and refuse to start at all) and build up memory usage. It can use as much as 170,000k of memory even with one tab, and it will not decrease the usage even when excess tabs are being closed. Also, it will crashed after using some time.

I have been doing research through google and it seems that these are the work of some trojan horse or malware. However, solutions seem to differ with various users so I decided to come here and seek some proper help.

I have done the 8-step removal instructions as described in another thread and attached the required logs.

BTW, I am using Windows XP SP3 and IE7, both are upgraded a couple of weeks ago from SP2 and IE6 - but the symptoms occurred before the upgrading. Also using AVG 8.0, Ad-aware 2008 and Spyware Blaster 4.1.

Thanks in advance!

****************************************

I ran into some problems while trying to post this thread up which brings me to another problem. Since 2 days ago, when I am trying to access some webpages, it gives me the 'IE cannot display the page' error. The same just happened to me twice when I tried to submit this page but failed (I am now using another computer). Wonder what is wrong with it again. >< Anyway it is connected to the net via a D-link router.

Thanks once again.

 

[kimsland]

Wow too much going on in HJT

Run Startup Control Panel, and stop as many things starting as possible (except AntiVirus)
Note: These are just startup shortcuts

Also do this:

(Some members say they have already tried this in a reply; but later I find it has not been done!)
The following not only resets all Internet Explorer's settings, but also removes all temp files, all extensions are disabled (toolbars, browser extensions, and Browser Helper Objects), and activeX controls are restored.


How to use Reset Internet Explorer Settings (RIES

To use RIES in Internet Explorer 7, follow these steps:

1. Click the Tools menu, and then click Internet Options.
2. On the Advanced tab, click Reset.
3. In the Reset Internet Explorer Settings dialog box, click Reset.
4. When Internet Explorer 7 finishes restoring the default settings, click Close, and then click OK two times.
5. Close Internet Explorer 7. The changes take effect the next time that you open Internet Explorer 7.

Note for users who cannot start Internet Explorer 7 for some reason, use RIES from Internet Options in Control Panel.

Lastly run CCleaner

Then Restart

And post a new HJT log (hopefully lots smaller!)

 

[airbornex]

Hi. Thanks for the swift reply.

I downloaded the program and disabled some stuffs I think, since I am not sure which tab(s) to look into. There are only one program under Startup (user) and Startup (common), and the longest list came from HKLM / Run where I stopped the most programs.

However, as I bought this laptop from college and they did some configuration to suit the school's network and system, there are still a large number of items I myself have never seen before and unsure whether if I can stop them safely. Hence the log did not seem to reduce significantly. Please advise me which are the programs I can safely stop if possible.

 

[kimsland]

You can find out lots of details on all your files starting here: http://www.castlecops.com/StartupList.html

C:\Program Files\Bonjour\mDNSResponder.exe
Read here: http://www.raymond.cc/blog/archives/2008/02/10/how-to-uninstall-or-remove-bonjour-mdnsresponderexe/

C:\Program Files\CyberLink\Shared Files\RichVideo.exe
Part of Power DVD (running in Services.msc as Cyberlink richvideo)
You can tick and remove

C:\Program Files\ltmoh\Ltmoh.exe
Read here: http://www.castlecops.com/s1938-Ltmoh_exe.html

There are a lot of Games and Network settings, that are required for the laptop to work properly at the college. Are these needed any longer, are you attending the college ?

I'd go back to Startup Control Panel and untick everything (this is reversible)
Except for:

C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (obviously used by Acronis)
C:\WINDOWS\system32\agrsmsvc.exe (part of Modem Service)
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe (you have AVG Antivirus)
C:\PROGRA~1\AVG\AVG8\avgrsx.exe (you have AVG Antivirus)
C:\PROGRA~1\AVG\AVG8\avgemc.exe (you have AVG Antivirus)
C:\PROGRA~1\AVG\AVG8\avgtray.exe (you have AVG Antivirus)
(Note: AVG is pretty slow these days, maybe try a Free Antivirus like Avast or Avira)
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Touchpad Mouse support)
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (you have wireless)
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (you have wireless)

That's about it

I can't see any Malware, but it's a very big log

 

[airbornex]

Yes, I am still attending college.

I have unchecked all the unnecessary programs in Startup but I can't find the following:

Unneccessary and not found

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\CyberLink\Shared Files\RichVideo.exe
Part of Power DVD (running in Services.msc as Cyberlink richvideo)

Necessary but not found
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
(But I do found a C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe)

C:\WINDOWS\system32\agrsmsvc.exe (part of Modem Service)

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe (you have AVG Antivirus)
C:\PROGRA~1\AVG\AVG8\avgrsx.exe (you have AVG Antivirus)
C:\PROGRA~1\AVG\AVG8\avgemc.exe (you have AVG Antivirus)

Here is another HJT log for your reference.

 

[kimsland]

Not found programs are there

One of them (RichVideo.exe)
is in Start->Run-> services.msc
Scroll down to Cyberlink richvideo
You can stop and disable this (by double clicking on it and chaging the settings)


C:\Program Files\Bonjour\mDNSResponder.exe
I gave you the reference link to read on

 

[airbornex]

I see. Thank you so much!

By the way, does my HJT log shows anything else that require fixing?

 

[kimsland]

Not that I can see

Wait, maybe this one: O16 - DPF: {C487F60B-59B9-47D9-BFDF-AB26786F8823} - http://zone.msn.com/bingame/zpagames/zpa_stoo.cab62201.cab

 

[airbornex]

Ok. I will monitor the situation and post back if the problem persists. Thanks once again!