Go Back   Tech Support Forum > Microsoft Support > Windows XP Support

memory leak in windows media player??

This is a discussion on memory leak in windows media player?? within the Windows XP Support forums, part of the Tech Support Forum category. i'm using windows media player 10 since a while windows media player got real slow. i checked at the list


Closed Thread
 
Thread Tools Search this Thread
Old 08-14-2006, 04:05 PM   #1
Registered Member
 
Join Date: Jul 2006
Location: netherlands
Posts: 15
OS: XP, Linux Redhat



i'm using windows media player 10
since a while windows media player got real slow.
i checked at the list with the processes how much memory it did use.
it's usually around 300-600 mb, is this even possible for windows media player?? the cpu usage of it is at 92-96%. when opening a song it get's even worse.
i tried scanning for virusses or spyware, didn't have any, no weird things either in the hijackthis log.
anyone have any idea what can be wrong with it?
btw reinstalling doesn't work.

__________________
nocturna99 is offline  
Old 08-15-2006, 04:41 PM   #2
TSF Team Emeritus
Microsoft Visiting Expert
 
Join Date: Jun 2006
Location: Woodland Hills, CA
Posts: 2,751
OS: Windows 98se/2000/XP/Vista/7/8 Pro/Linux(various)


Hi nocturna99

Try Process Explorer to double-check your background processes http://www.sysinternals.com/Utilitie...sExplorer.html
And AutoRuns to double-check your Startup processes
http://www.sysinternals.com/Utilities/Autoruns.html
And Rootkit Revealer to try & detect if a rootkit is involved
http://www.sysinternals.com/Utilitie...tRevealer.html

If the change is recent enough, you can always try a System Restore, to a restore point from before the trouble started.

If you haven't visited Windows Update recently, make sure to try that, too - as there might be a recent patch that helps your situation.

Best of luck
. . . Gary

[P.S... . let us know if you find a rootkit present - and would like strategies for recovery]

__________________
OldGrayGary is offline  
Old 08-16-2006, 12:59 PM   #3
Registered Member
 
Join Date: Jul 2006
Location: netherlands
Posts: 15
OS: XP, Linux Redhat


i've double checked the background processes and the start up processes, didn't see anything weird in there.

the rootkit revealer.. i've tried it, it found some things, also some things i don't know what it is. i've never used an rootkitrevealer before. how can i see if it's a rootkit?
i think it's too late for the restore point..
__________________
nocturna99 is offline  
Old 08-16-2006, 02:17 PM   #4
TSF Team Emeritus
Microsoft Visiting Expert
 
Join Date: Jun 2006
Location: Woodland Hills, CA
Posts: 2,751
OS: Windows 98se/2000/XP/Vista/7/8 Pro/Linux(various)


Hi again

The same webpage that you downloaded the SysInternals "Rootkit Revealer" from has information about how to use the program, and how to interpret the results. Visit those pages again, they are very clearly written & straightforward.

Quick note before we go to more detail: the only completely sure way to be absolutely certain a rootkit is no longer present -- is to zero-write your hard drive, flash the bios of your motherboard with a write-protected diskette (to avoid the possibility of a bios infection), and start all over from scratch - reinstalling everything. Any personal data saved to removable media needs to be scanned thoroughly before being restored to the freshly installed system.

If you have Symantec/Norton's "SystemWorks" installed on your system, it installs a rootkit-type process, which would show in the Revealer's log with entries that include the phrase "NTProtect". I have to say that I have yet to see a version of SystemWorks that is worth running, and recommend using other tools. http://www.eweek.com/article2/0,1895,1910077,00.asp This rootkit is thought to be less troublesome than the Sony one (following paragraph) - but in many techs opinion - no rootkit is a good rootkit. Symantec has since released a patch to undo it's rootkit-type behavior - but it's questionable if the system changes leave trouble behind.

Sony can also install a rootkit as part of a badly considered copy-protection idea. The bad news is that malware authors can co-opt the rootkit for their own use. As you might imagine, there are lawsuits going on.
Rootkit Malware threats -- http://news.com.com/FAQ+Sonys+rootki...3-5946760.html
Background info -- http://en.wikipedia.org/wiki/2005_So...ection_scandal

What can you do?
Detection & Removal -- http://www.pcsupportadvisor.com/rootkits.htm

You will find links to other rootkit detection & removal programs in that last link. But I stand by what I said at the outset -- to be completely sure, you really do have to wipe everything & start over.

Media Player has had several Security patches over the years, and a couple this year. It's cpu usage really shouldn't go over 25% for more than a moment. It's memory usage shouldn't go over 20mb under most situations I can think of. Either your Media Player is serious broken, or seriously compromised - neither of which is wonderful.
______________
If you want to try to salvage the current system, without starting from scratch:

1) If it's only the SystemWorks rootkit that was found, use LiveUpdate & install the update that fixes that.
2) If others are found, use the removal tools mentioned in the "Detection & Removal" link
3) Try the 5-Step Security checklist http://www.techsupportforum.com/showthread.php?t=15968
4) If the system scans clean after that, try a run of the Windows File Protection (aka System File Checker) - - from the Start/Run box, type the command "sfc /scannow" (without the quotes) [you will need either a Windows XP CD, or to point sfc to the spot on your hard drive that holds your Windows .cab files -- often in C:\Windows\Options\Cabs]
5) Then test Media Player after that. If it still proves balky, you can try reverting to version 9 http://ezinearticles.com/?Uninstall-...Again&id=56655 -- or going up to version 11. Or using a different player. But make sure the system is malware-free, above all.

Best of luck
. . . Gary
__________________
OldGrayGary is offline  
Old 08-18-2006, 04:02 PM   #5
Registered Member
 
Join Date: Jul 2006
Location: netherlands
Posts: 15
OS: XP, Linux Redhat


i finally managed to remove the rootkit without formatting, well at least i think it's fully removed now.
at the first attempt it just came back, did it some other way now and didn't have any trouble for a while, media player also works normal now, i rescanned after the rootkit was removed and it found a LOT of malware. managed to remove them.
the cpu usage of media player went back to 2-4% and it only uses around 15 mb of the memory now.
all my other programs also don't give any trouble anymore.
well thanks for the help.
__________________
nocturna99 is offline  
Old 08-18-2006, 06:26 PM   #6
Registered Member
 
Join Date: Jul 2006
Location: netherlands
Posts: 15
OS: XP, Linux Redhat


nvm it's back again..


dunno how to delete my post.. got it fully removed now i think..
__________________
nocturna99 is offline  
Old 08-19-2006, 01:37 AM   #7
TSF Team Emeritus
Microsoft Visiting Expert
 
Join Date: Jun 2006
Location: Woodland Hills, CA
Posts: 2,751
OS: Windows 98se/2000/XP/Vista/7/8 Pro/Linux(various)


Since these are difficult to be certain about, now would be a good time to make backups, in case you have to go the zero-write route in the future.

Best of luck -
. . . Gary
__________________
OldGrayGary is offline  
Old 08-19-2006, 02:16 AM   #8
Registered Member
 
Join Date: Aug 2006
Posts: 19
OS: xp pro


Quote:
Originally Posted by nocturna99
nvm it's back again..


dunno how to delete my post.. got it fully removed now i think..
some rootkits are tricky to remove but i can hook you up with a fixer uper pm me if you still have that crap on your cpu.
__________________
pcbored is offline  
Old 08-19-2006, 04:01 PM   #9
TSF Team Emeritus
Microsoft Support
 
Geekgirl's Avatar
 
Join Date: Jan 2005
Location: Pennsylvania
Posts: 15,123
OS: XP Home SP3 x3 /XP Pro SP3/Vista Ultimate SP2/Win7 Pro 64-BIT


nocturna99 plz post a HiJackThis log in the HiJackThisLog Help Forum, one of our highly trained security analyst will look over your log and help you rid of your rootkit issue.

Look over the First Steps at Removing Malware thread also before posting your HJT log.
__________________
Geekgirl is offline  
Old 08-20-2006, 11:00 AM   #10
Registered Member
 
Join Date: Jul 2006
Location: netherlands
Posts: 15
OS: XP, Linux Redhat


Quote:
Originally Posted by Geekgirl
nocturna99 plz post a HiJackThis log in the HiJackThisLog Help Forum, one of our highly trained security analyst will look over your log and help you rid of your rootkit issue.

Look over the First Steps at Removing Malware thread also before posting your HJT log.
managed to delete it already :) zero written my hard disk and flashed the bios
__________________
nocturna99 is offline  
Old 08-20-2006, 11:11 AM   #11
TSF Team Emeritus
Microsoft Support
 
Geekgirl's Avatar
 
Join Date: Jan 2005
Location: Pennsylvania
Posts: 15,123
OS: XP Home SP3 x3 /XP Pro SP3/Vista Ultimate SP2/Win7 Pro 64-BIT


Is WMP 10 still acting up on you? Heres some links for troubleshooting WMP 10

http://www.microsoft.com/windows/win...eshooting.aspx

http://www.microsoft.com/windows/win...10/errors.aspx

http://www.mmserv.ait.ac.th/MPU-web2...elpscreen.html
__________________
Geekgirl is offline  
Old 08-22-2006, 02:11 AM   #12
Registered Member
 
Join Date: Jul 2006
Location: netherlands
Posts: 15
OS: XP, Linux Redhat


WMP isn't acting up anymore, i guess the rootkit was the problem.
it started to act up also for other programs a while before it got deleted.
__________________
nocturna99 is offline  
Old 08-22-2006, 06:13 AM   #13
TSF Team Emeritus
Microsoft Support
 
Geekgirl's Avatar
 
Join Date: Jan 2005
Location: Pennsylvania
Posts: 15,123
OS: XP Home SP3 x3 /XP Pro SP3/Vista Ultimate SP2/Win7 Pro 64-BIT


Rootkits are nasty little buggers, glad things are working ok for you now

__________________
Geekgirl is offline  
Closed Thread

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is on
Smilies are on
[IMG] code is on
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Post a Question


» Site Navigation
 > FAQ
  > 10.0.0.2


All times are GMT -7. The time now is 01:49 PM.


Copyright 2001 - 2014, Tech Support Forum

Windows 7 - Windows XP - Windows Vista - Trojan Removal - Spyware Removal - Virus Removal - Networking - Security - Top Web Hosts