SWAP file size keeps on increasing

A win 2000 pro pc with sp4 128 mb ram
The problem is this : The size of swap file automatically keeps on increasing even when no application is running.
The system is on a LAN with TINY personal firewall running.
The size keeps on increasing and when the total memory size ram +swap reaches near 320mb (when system starts memory consumed is near 95mb and even if no application is run it takes about 25 min for that size to reach 300mb) the screen becomes garbled with colored lines on it and a sec later the system restarts.
I checked with avg antivirus---no virus found
MS Anti-Spyware--No spyware found
Nothing unusual in HJT logs also.
Though sometimes it gave an error in Lsass.exe and gave a dialog that system will shutdown in 30 sec. (OS was patched for blaster worm and dcom was also disabled)
Checked for all the running processes but found nothing unusual.

Had to reformat and reinstall the OS because the problem was not allowing for any work to happen.

Does any one has any idea what would have caused such a problem.

Since the reformat do you still have issues? Have you cleaned the machine out of dust-bunnies and the like (possible overheat?)

Have you tried using ProcessExplorer to see what might be using the memory?

Your will notice HUGE improvement in performance by adding more ram.

128 just isnt enough these days..

Just my humble opinion of course.

MLF

128MB isn't much....

You may have had some program running with a memoryleak. That'll "eat up" your memory.
Besides the ProcessExplorer mentioned by MsMittens you can also check with taskmanager.
You may need to switch on a few more columns. Sort by memory and watch which process eats your memory.

Hi,

Well, I know that 128Mb is within the specifications for Win2k, but I prefer to rely on my own personal experience. ;)

I would not start with less than 256Mb and would prefer 384 or 512Mb.

As a start, you need to go to your system settings and change the "let windows select" option to give a PAGE FILE (swap files are win9x) of 512MB user defined. I am talking about "virtual memory" here.

The way BillyWindows works is it gives about 2x your RAM to the page file (and the swap file in 9x), so you will have 128 + 256 (page file) which gives you 384Mb

OH!............I must ask, is that 128Mb a single strip, or 2x64Mb?

Anyway, what I suspect is happening is that the memory is getting used up, and there is not enough virtual memory allocated on the HDD for it. If you think about it, a machine with little physical RAM needs more virtual memory?...............I have a machine across the room with Win2000 on it..........BillyWindows gives it 2Gb of page file, yet it only gets to 190Mb of its 1024Mb of RAM when I start it................it then gets to around 320~340Mb when I start using it.

So, we now come to your problem with the display..............I am willing to bet a lakh of rupees that you have "integrated" (on motherboard) video :D ...............that means that you are sharing the RAM with the video..........like you have 128Mb RAM and a 64Mb video, that means that the system will only have 64Mb for the system to use.

SOLUTION:

1. Manually increase the page file size.
2. Get some more RAM............watch out! if you have RAMBUS RIMMS you will need to install matched pairs ;)

Please let us know how you get on

After the reinstallation I till now haven't seen the problem occur again. Though haven't reinstalled all the programs that were on the earlier one
I checked with many tools for running processes but nothing unusual, which i didnot of it, was running.
I also suspect memory leak, and i checked in task manager to see which process was consuming the most memory but there was no memory consumption increase in any of the listed process. But the memory graph kept on increasing.
Also some times Lsass.exe showed error and initiated a system shutdown. What could this point to.
The ram is just one 128 mb SDRAM strip
I know it is not enough but cannot upgrade to larger one now. And it fulfills all my needs.

Hi Sun~,

Please manually set your system to 512Mb of page file.

After that you need another SDRAM strip.............go for a 256Mb, but you need to check what your motherboard will support.............a 512 would be better :)

Cheers

lsass.exe is a system process of the Microsoft Windows security mechanisms. It specifically deals with local security and login policies.

Note: lsass.exe also relates to the Windang.worm, irc.ratsou.b, Webus.B, MyDoom.L, Randex.AR, Nimos.worm which spread via floppy disk drives, mass-mailing and peer-to-peer sharing. Please review file path for clarification of this.

From:

http://www.liutilities.com/products/...library/lsass/

So could have been a variant you av client didn't catch. I've also seen bad raid controllers do this, but I don't think that's the culprit.

sunday11a - Does the PC have any type of IDE raid or SCSI raid capabilities?

edit: I must learn how to proof read

Good call dino...

That lass thing...can hit before you have time to get the updates....

I had a real prob with one machine...and that worm. xp home

Ended up formatting :confused:

MLF

There is no RAID no SCSI just a single 40gb IDE HDD. Regarding RAM nihil i dont have any need of increasing it. All my work gets done properly even on 128.
My system was patched properly with antivirus also updated.
And the pc had been running fine for more than 2 months. And software firewall was always in place, with no file sharing enabled and port 135,137,138,139,445 total access blocked.

Guys, here is my 2 cents..might be a shot in the dark ..Ok reformatting it should have taken care of the problem..now.reinstalling your o/s is fine and all the other recomendations are in order especially more ram..you can never have enough..If you don,t have a big hdd drive like 120gig or so to let windows manage the swapfile we stick to at least double your ram which in your case manully set to 256mb swapfile...

Ok my first question is ..since you sit on a network even with your firewall in place , my guess is that you get infected from somewhere on your network..have look at the traffic which you let through on the firewall profiles, and stop them one by one to try and determine which one is giving you the the infection..I can not specificly remember the virus name but i know a friend of mine also got infected and each time you restart and so fourth the file size gets modified up to a point that your drive is filled up or in your case your swapfile size..

hope it helps
cheers
vanman

My av didnot detect any virus. SO could be that it is not in the wild
The inbound traffic for any port is blocked and is only allowed for those for which an outbound connection has been initiated. Ocassionally i used to check the local network also for shares. Might be i got it in that way.

Hi sun~

Please increase the size of your page file like I suggested.

Also, I would like you to run Xen by Paul Brown (another goddam limey/pom)

It is seriously cool..........my advice is to leave your fonts alone

:)

http://www.x9k.net/

Please let me know how you get on :D

The problem was resolved after reinstalling nihil
And i have increased the size of page file but how will it help me i dont know
I will see what xen is

Hi Sun~,

Glad to hear that things are looking up :) The larger page file will help stop crashes..............this machine is a 266Mhz PII with 128 Mb of RAM running WinME, so I know your problems............Win2000 is a much better OS in my opinion.

With this one, I have manually set the Swap (page) file and use Ram Idle Pro as a memory manager (WinME is very bad regarding memory leaks)

Xen is a Windows tuning package, and works very well.

Good luck

;)

The bigger swapfile on the older systems is a must at least double your actual ram, in your case 256.You can go even more if you have a big h/disk, but double is always a good balance..
You can also setup your sytem to be a network server in system properties which will then allocate more cache ram..I might be wrong nihil you can correct me if i am wrong.All i know is that in the older o/s like 98 you could do that but i am not sure in me or 2000..I am still curious though

cheers
vanman

Hi,

WinME was the last OS with the network server option. It was really to handle large hard drives more efficiently, but it did increase the cache.

On Win2000 it is:

<System Properties>
<Advanced>
<Performance Options>

And then it asks if you want to optimise for applications or background services. I guess background services is the equivalent of server.

EDIT: It sounds rather as if a memory leak could have been taking place?

With a relatively small amount of RAM you need to be sure to only start applications and services when you need them, and close them afterwards. :)