Windows Forum

Ask something
Discussion Locked

Himem.sys problems

0 helpful
9 replies

by vaughaniwilkinson

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Recently, I have encountered a constant stream of problems. The first being constant Invalid PAge Faults and GPF's caused by almost any application in the boot process (usually Explorer) My PC then tells me that it cannot load windows and to reinstall windows. I am also getting this error msg on occasions "Error - Himem.sys has detected unreliable XMS memory at address 018d3806. XMS driver not installed". I have replaced Himem.sys numerous times from a Win 98 boot disk!? OK - heres the weird part. Recently I found a "Backdoor.SubSeven" virus infestation. NAV could not clean it up and advised to delete the infected file - Window.exe. Ever since then, nothing but problems. The weird part, Only seem to have problems every second boot ????????.

Any help you could provide with this curly one would help (and no, I don't really want to FDisk my drive)

9 replies

by dklippert

Try http://www.moosoft.com/

(There are no spaces in any of the URLS)

NAME: Backdoor.SubSeven
ALIAS: Backdoor-G, SubSeven, Sub7

The SubSeven backdoor was first discovered in May 1999. First samples of this backdoor were not packed, but later there appeared packed versions that were not easy to detect by contemporary anti-virus programs that had no Win32 'Aspack' file compressor unpacking support. The backdoor is usually distributed under different names via newsgroups and e-mails.
When run, the backdoor copies itself to \Windows\ directory with the original name of file it was run from or as SERVER.EXE, KERNEL16.DL, RUNDLL16.COM, SYSTEMTRAYICON!.EXE or WINDOW.EXE (names are different in different versions of SubSeven). Then it unpacks a single DLL file to \Windows\System\ directory - WATCHING.DLL (some versions don't do this). After that the backdoor patches Windows Registry so its main application could be run during all next Windows bootups (Run or RunServices keys) and finally creates and modifies some other Registry keys. The backdoor can also install itself to system by modifying WIN.INI or SYSTEM.INI file.

Also look at:

http://www.symantec.com/avcenter/venc/data/backdoor.subseven.html

http://www.symantec.com/avcenter/venc/data/backdoor.subseven22.html

by fenaikh

Hi

pls read these articles:

Troubleshooting HIMEM.SYS 3.10 XMS Test (TESTMEM) Failures (Q109845)
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q109845

How to Use a RAM Drive to Troubleshoot Memory (Q142546)
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q142546

Troj/Subseven
http://www.us.sophos.com/virusinfo/analyses/trojsubseven.html

backdoor SubSeven
http://support.shaw.ca/networks/subseven.htm

Good luck

Mohamed

***Very Important NOTE *********
After you copy the URL a space or a %20 maybe gets inserted in the URL when you paste it into your browser. Delete any spaces or such characters from the URL for the page to be loaded.

by vh_s

You have for certain a bad memory. Could happen..

Try to replace your memory, and himem shouldn't show that message again.

vh_s

This discussion is closed to new replies.