BecomingThin Posted February 8, 2011 Share Posted February 8, 2011 I have 2 windows swap files and I think I should have just one. One is in c:\ and one is in c:\windows\.The one in c:\ is about 5 times larger. I thought the one in c:\windows\ was malware and I deleted it but it comes back. I have a symptom recently, that my computer freezes up for no reason and has to be rebooted. Often times while it is idle. It used to occur at least once/day but now maybe a few times/week. The only other symptom I notice is when I open a file from an application menu, such as Word, the file list is always alphabetical and it used to be by modified date and that is the way I wish it still was. This started about the same time my computer started freezing. Link to comment Share on other sites More sharing options...
CharlotteTheHarlot Posted February 8, 2011 Share Posted February 8, 2011 I have 2 windows swap files and I think I should have just one. One is in c:\ and one is in c:\windows\.The one in c:\ is about 5 times largerTake a look at the date/time of these two swap files, what do you see? Link to comment Share on other sites More sharing options...
BecomingThin Posted February 8, 2011 Author Share Posted February 8, 2011 c:\Win386.swp is modified 2/7/11 8:35 pm, size 307,200KBc:\WINDOWS\Win386.swp is modified 2/6/08 1:27 p.m.m suze 61,440KB Link to comment Share on other sites More sharing options...
CharlesF Posted February 8, 2011 Share Posted February 8, 2011 c:\Win386.swp is modified 2/7/11 8:35 pm, size 307,200KBc:\WINDOWS\Win386.swp is modified 2/6/08 1:27 p.m. size 61,440KBIt's not possible that you have deleted recently your C:\WINDOWS swap file, last modification was in 2008.On the other hand, I have only one and it is in WINDOWS directory.Panel Config -> System -> Performances -> Virtual Memory... -> if the first line is ticked: "Let Windows...(recommended)", so the default path is suppose to be C:\WINDOWS\WIN386.SWPIf you have ticked (tweaked) the second line: "Let me specify...", you may have a new file in C:\WIN386.SWPHTHCharles. Link to comment Share on other sites More sharing options...
Fredledingue Posted February 8, 2011 Share Posted February 8, 2011 It's possible that the setting for the location of the swap file has been modified resulting in the creation of a 2d swp file elsewhere. Link to comment Share on other sites More sharing options...
BecomingThin Posted February 8, 2011 Author Share Posted February 8, 2011 Panel Config -> System -> Performances -> Virtual Memory... -> if the first line is ticked: "Let Windows...(recommended)", so the default path is suppose to be C:\WINDOWS\WIN386.SWPIf you have ticked (tweaked) the second line: "Let me specify...", you may have a new file in C:\WIN386.SWPHTHCharles.I checked my Virtual Memory setting and first one is ticked. But it certainly seems like the one in c: is what is being used. The one in Windows will come back if I delete it. I never payed attention to the date on it, though. Link to comment Share on other sites More sharing options...
BecomingThin Posted February 9, 2011 Author Share Posted February 9, 2011 It's possible that the setting for the location of the swap file has been modified resulting in the creation of a 2d swp file elsewhere.Maybe that's what has happened, although I don't know how. Perhaps this is something I should just not worry about it. Link to comment Share on other sites More sharing options...
CharlesF Posted February 9, 2011 Share Posted February 9, 2011 It's possible that the setting for the location of the swap file has been modified resulting in the creation of a 2d swp file elsewhere.Yes, it is what I was saying,but I find strange that the old one is the one who is coming back .If the swap file is deleted under real DOS at boot, do Windows will recreate a new one safely? If yes, he could try to delete the 2 from an WININIT.INI file (or the AUTOEXEC.BAT), and look for what is actually recreate.Perhaps this is something I should just not worry about it.Except that it can be a waste of place... Link to comment Share on other sites More sharing options...
CharlotteTheHarlot Posted February 9, 2011 Share Posted February 9, 2011 c:\Win386.swp is modified 2/7/11 8:35 pm, size 307,200KBc:\WINDOWS\Win386.swp is modified 2/6/08 1:27 p.m.m suze 61,440KBDelete the older one (the one in \Windows).I have 2 windows swap files and I think I should have just one. One is in c:\ and one is in c:\windows\.The one in c:\ is about 5 times larger. I thought the one in c:\windows\ was malware and I deleted it but it comes back.Are you saying it comes back with that old date/time? Or are you saying the last time it happened (comes back) was in 2008? Link to comment Share on other sites More sharing options...
BecomingThin Posted February 9, 2011 Author Share Posted February 9, 2011 I have 2 windows swap files and I think I should have just one. One is in c:\ and one is in c:\windows\.The one in c:\ is about 5 times larger. I thought the one in c:\windows\ was malware and I deleted it but it comes back.Are you saying it comes back with that old date/time? Or are you saying the last time it happened (comes back) was in 2008?I didn't pay attention to the date until now. I believe it comes back with that old date because it just came back recently. I saw this problem in the past and tried to solve it but I gave up. I thought it was malware, someone suggested I have a rootkit. Recently some other malware symptoms showed up so I tried to get rid of this again. When I looked a few days ago it wasn't there and now it is back. In the past, I deleted it and it sometimes returned the same day but sometimes it took several days. I've used Spybot and ClamWin and no malware shows. Actually Spybot found something yesterday but I don't think it was related. In the past I used AVG and Avast but none of them sees this file as a problem.Maybe, as suggested, somehow (that I don't remember-may it wasn't me that did it) the location of the swap file was moved. Maybe Windows sees there is no swap file and makes a new one. That bit of space for the one in Windows isn't a problem because I have plenty of disk space. Link to comment Share on other sites More sharing options...
submix8c Posted February 9, 2011 Share Posted February 9, 2011 Just for the heck of it, note the exact location of the swap files, F8 boot to "Safe->Command Prompt Only" and delete both of them then restart. Only one should show and remain. If both reappear, I'm at a loss (unless another poster is correct/has answer). FWIW, maybe some odd-bird "malware" or BAT file is execeting "creating" an "extra" (why?). Link to comment Share on other sites More sharing options...
BecomingThin Posted February 9, 2011 Author Share Posted February 9, 2011 Just for the heck of it, note the exact location of the swap files, F8 boot to "Safe->Command Prompt Only" and delete both of them then restart. Only one should show and remain. If both reappear, I'm at a loss (unless another poster is correct/has answer). FWIW, maybe some odd-bird "malware" or BAT file is execeting "creating" an "extra" (why?). This won't create a problem, if I delete both? I'm willing to try it but I don't have time right now. Maybe this evening or else tomorrow. Link to comment Share on other sites More sharing options...
CharlotteTheHarlot Posted February 10, 2011 Share Posted February 10, 2011 Just for the heck of it, note the exact location of the swap files, F8 boot to "Safe->Command Prompt Only" and delete both of them then restart. Only one should show and remain. If both reappear, I'm at a loss (unless another poster is correct/has answer). FWIW, maybe some odd-bird "malware" or BAT file is execeting "creating" an "extra" (why?). This won't create a problem, if I delete both? I'm willing to try it but I don't have time right now. Maybe this evening or else tomorrow.No problem. Do exactly what submix8c said to do (I was going to suggest the same thing!).Easiest to do this after: reboot | F8 | Command Line Only, but I believe it depends on the current swap settings.If it is set to Let Windows Handle ... AND you have ConservativeSwapfileUsage=1 in 'system.ini' AND you have lots of memory, your swap file will likely be 0 bytes and timestamped to your last bootup time. This can probably be deleted anytime.In other situations where the swap is being written to often, I suspect it may be locked (but correct me if I am wrong as I never do this myself anyway) and may require the F8 treatment to delete it.Definitely delete them both at the same time and reboot. Then open some big programs and files to force paging to disk and then search for the swap file(s).If there are two after this experiment you will have discovered something that none of us have ever likely encountered. Likely explanation would be some very strange malware that did not cover its tracks very well. Link to comment Share on other sites More sharing options...
BecomingThin Posted February 10, 2011 Author Share Posted February 10, 2011 No problem. Do exactly what submix8c said to do (I was going to suggest the same thing!).Easiest to do this after: reboot | F8 | Command Line Only, but I believe it depends on the current swap settings.Definitely delete them both at the same time and reboot. Then open some big programs and files to force paging to disk and then search for the swap file(s).If there are two after this experiment you will have discovered something that none of us have ever likely encountered. Likely explanation would be some very strange malware that did not cover its tracks very well.Ok, good. I will do it, hopefully I will have time later today. I will try to delete without F8, otherwise with F8, and I will reboot, and do some activities, and let you all know what happens. Link to comment Share on other sites More sharing options...
submix8c Posted February 10, 2011 Share Posted February 10, 2011 Shouldn't happen WITHOUT F8 since the swap file (one of them) will be active and in-use. Impossible! Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now