Vista Memory Problem

[Fuego75]

Hi.

I have an 8GB machine running Vista Ultimate x64 with SP2, fully patched, that keeps eating up all my 8GB of RAM within hours of a fresh reboot.

It boots clean at 26% memory usage, which then climbs up to around 85% at which point things slow down. Any attempt to select functions from already running programs, or running new ones, causes an out of memory error after this point. If I continue, I eventually run right out of memory and have to reboot.

I have tried to identify the culprit with Task Manager (with show processes from all users checked and all the relevant memory columns displayed), but not one program/process, seems to be using more than a couple of hundred megabytes, at most.

Going through the task list and killing all the non-essential ones and/or shutting down services that are not key to being able to continue running the system has not identified the problem either. Memory usage remains in the high 90%+ range and the system does not release any significant amount of memory.

Logging out and logging back in, doesn't work either.

The system can sit at the desktop, idle, for days with memory usage at 26%, but as soon as I start using it with Internet Explorer and/or Mozilla FireFox, usage starts to climb and just keeps going up as I use he system. Within an hour, or two, I am forced to reboot.

System is clean of spyware and viruses, as far as I can tell (using AVG and Windows Defender) and I can identify all the processes that I can see running.

Pagefile is 12GB, BIOS is set to use all 8GB of RAM (remapping hardware in the 4GB 32-bit window up above the 8GB of physical) and Windows reports 8GB of RAM available.

This has been going on for quite a few weeks now. The only thing that I've installed have been Windows standard Updates, through the online updater (including MSIE8). Prior to that I could run many different things without problems and even if I loaded a few large programs and memory usage climbed to 75%, it would go right back down again after closing these down.

I had a memory leak in Vista 64 with an earlier program that I was running that was also eating all my RAM (I forget the name of it, but it wasn't anything that I felt was essential and worth pursuing a fix for). This problem program did however show up in Task Manager with several gigs worth of RAM usage; so I killed and uninstalled it and everything went back to normal for quite a long time.

The problem at the moment is that I can't see what is using all the available RAM.

Anyone experienced anything similar?

 

[VaguelyRapt]

I don't know much about memory leaks, but here's a quick suggestion; I would try Memory Diagnostics Tool. F8 on boot for boot menu options and then Tab, or Start -> type Memory Diagnostics (requires reboot).

When looking for culprits, make sure you're viewing processes from all users (that button on the bottom of Task Manager).

Seeing as it couldn't be found in Task Manager, the first thing I suspected was indeed a virus/malware, and I personally don't trust AVG or Windows security. That's just me.

 

[usasma]

Try posting over in the Security forums for assistance in identifying this: System Security - Vista Forums

If that doesn't work out, then it's something that's hiding from you.
Are you using any sort of Internet Security application?

You can try using the free Process Explorer ( Process Explorer ) to view the processes and the threads running inside of them. It's also handy for shutting down processes (but remember the "shutdown -a" command to stop the system from shutting down when you kill something vital)


The following problem is similar BUT NOT identical to your problem (they had memory issues at boot).

I did this at work yesterday - and killed nearly everything running on the system. Finally, buried deep down in the system process, in the stack of one of the many ntkrnlpa.exe threads, I found an entry for Symantec Antivirus which seemed to be at fault.

The customer refuses to uninstall the Symantec (he got it from work and doesn't work there anymore) so he's stuck with the slowdown.

 

[Fuego75]

Thanks. Good suggestion about process explorer. I'll give that a try. Pretty sure my system is virus/malware free. AVG and Windows security have served me pretty well for many years. System is behind an ISA server firewall, but there are no Internet security apps on the desktop itself, other than what the browsers (IE and FF) provide, which also go through the ISA proxy server.

As I mentioned in my original post, task manager is showing process from all users.

I can have a look at memory diagnostics, but I'm not sure how a hard fault would manifest itself as anything else but a crash of some sort (whether application, in the Eventlog, or System bluescreen).

I exhausted Google searches before I posted. I couldn't find anything that seemed to be similar to the problem that I am experiencing, although I'm still trying the odd search with varying keywords, from time to time.

Thinking about it, this may have started with the installation of the new Windows Desktop Search version 4.0 engine. Can't be sure, but it may be something I definitely need to take a closer look at.

I'm wondering whether a restore to an earlier "system restore point" prior to the problem (say about 4 to 6 weeks ago) would prove useful in any of the possible scenarios.

 

[Fuego75]

Update: I elected to disable a few Firefox and IE plugins. I also applied a registry change to disable Vista pre-fetch (temporarily). The issue seems to be much reduced (been running for a few days now and memory usage is up to 49% from the initial 26% in use after a fresh boot), so I'm continuing to monitor the situation.

I suspect it was a plug-in causing the issue. It's still odd that I couldn't find the culprit through task manager, or that the memory was not released after closing down the browsers, but at least the machine isn't grinding to a halt now, forcing a reboot on me.

 

[usasma]

That's where Process Explorer would come in handy. In my previous example, I'd forced all Norton processes to close and still had issues. Rooting around in Process Explorer I was finally able to find an instance of Norton that had latched onto ntoskrnl.exe and was only evident in the stack of one thread in one particular process.

 

[tek101]

Update: I elected to disable a few Firefox and IE plugins. I also applied a registry change to disable Vista pre-fetch (temporarily). The issue seems to be much reduced (been running for a few days now and memory usage is up to 49% from the initial 26% in use after a fresh boot), so I'm continuing to monitor the situation.

I suspect it was a plug-in causing the issue. It's still odd that I couldn't find the culprit through task manager, or that the memory was not released after closing down the browsers, but at least the machine isn't grinding to a halt now, forcing a reboot on me.

FF is a good browser without too many "Add-on" ...
I'd disable them all ..for awhile ..see if it goes back to normal.

To make sure its clean ...: Do a complete scan with both...:
SUPERAntiSpyware.com - Downloads
Malwarebytes.org

 

[LordOfChaos]

Hey Folks,

I am having the same problems with my machine, and I will follow the advice already posted.

I did run memtest86+ and I had no RAM faults.

I have be having issues with IE, to the point where it wouldn't load. I am running AVAST HOME for security, and I ran Spybot to look for malware and the like. I only came up with one bad entry. Searching around on the net got me to look at the registry, and so I installed RegTool. After I ran RegTool, well, lets say that the registry, and bad activeX items were loaded with ****e. I removed it all, and IE went down. So hard that I couldn't log on to the net. I ended up installing FF, and well here we are.

Thanks for the helpful posts, I will let you know how I make out

PEACE

 

[Fuego75]

Well, it looks like I still have the problem - just that it's getting triggered less often. Now I'm not sure what's setting it off. I have it right now. System is at 93% RAM use (was 98%, but I terminated a couple of programs to get some space to check stuff).

Process Explorer doesn't show anything that has anywhere even remotely close to the missing 6 and threequarter odd GBs, wherever I dig with it.

Now I'm thinking either audio, or network drivers, with the former possibly more likely (I use stuff like ASIO4ALL and a few USB audio interfaces).

Most of what I use on this (vista 64, 8GB) desktop is also on my laptop (WXP, 2GB), running without problems there. Vista is really starting to try my patience. Tried pretty much all the suggestions I've seen here and in other threads and I'm running out of options, short of reinstalling (which I am really, really, tired of doing after years of doing this with W95, W98, WXP and WV).

There must be some way to see what the hell is using that memory, so I can at least narrow down the problem area. Right now, I am reduced to not using browsers and not using programs that use audio on this machine just to avoid the problem cropping-up. Yesterday I ran games like Left 4 Dead for several hours, without any problems.

Yeah, the more I think about it, the more I think it's something to do with USB audio drivers.

 

[zigzag3143]

Well, it looks like I still have the problem - just that it's getting triggered less often. Now I'm not sure what's setting it off. I have it right now. System is at 93% RAM use (was 98%, but I terminated a couple of programs to get some space to check stuff).

Process Explorer doesn't show anything that has anywhere even remotely close to the missing 6 and threequarter odd GBs, wherever I dig with it.

Now I'm thinking either audio, or network drivers, with the former possibly more likely (I use stuff like ASIO4ALL and a few USB audio interfaces).

Most of what I use on this (vista 64, 8GB) desktop is also on my laptop (WXP, 2GB), running without problems there. Vista is really starting to try my patience.

You might want to check out windows streaming media service, and what ever AV you have they can both run in the background

Ken

 

[Fuego75]

You might want to check out windows streaming media service, and what ever AV you have they can both run in the background

Ken

Thanks for the advice, but I had already shutdown these services (except the AV watchdog, which it seems can't be shutdown).

I also went through disabling various hardware interfaces, but still did not get the memory back. Reboot is the only way to recover.

I may try a Vista repair reinstall (I assume it's the same as XP - you boot the distrubution CD and do a repair reinstall), but to be honest I am losing faith in Vista fast - which up until now I had a fairly reasonable respect for, having run it trouble-free almost since release.

 

[usasma]

Nope, the Vista repair must be launched from within Windows. More info here: John Barnett's Windows Vista Support: Windows Vista Repair Options

 

[Frostmourne]

Does your motherboard support 8GB of RAM? Do the voltages come up properly in the BIOS?

 

[Fuego75]

Hi again. Yes, the motherboard (ASUS P5E premium wifi@n) does support 8GB and everything looks fine in the BIOS.

I rebooted last night and had 24% RAM (just under 2GB) used. This morning it is up to 47% (nearly 4GB) used. Main things that were idling, were Skype, Live Messenger, Sidebar apps (RSS feed, performance stats, calendar, weather), Steam, Logitech MX Rev Mouse, Webcam, Windows Defender, AVG, PrevX, MS Bluetooth, ATI, G15 and Daemon Tools Lite applets, all idling in the task bar tray. Services like Virtual Server and IIS, which I sometimes use, were shut down. No errors logged in Event logs, overnight either.

The memory is disappearing into *Pool Non-Paged*, but no process is taking it (verified by PerfMon and there are a lot of stats to check I can tell you). I spent 12 hours yesterday trying to track this problem down. Full PerfMon analysis, Registry checks, File checks, various spyware and adware scans (all clean) and nothing.

Just the "Available bytes" number going down and "System Pool Non-Paged Used" going up. It doesn't seem like any visible process is using it, nor any of system drivers or services (according to PerfMon).

And always, when it reaches the high 90% used, I am unable to run new applications, even if I terminate just about everything else.

I'm thinking about installing the W2K3 resource tools to check out the resource leak monitor, but it clearly isn't designed to be installed in Vista 64 and I can't find any equivalents, but really, I'm grasping at straws.

Still need to try a repair, but I'm not hopeful.

 

[Frostmourne]

Take a look at process explorer and use Ctrl+I to investigate what is running on your pc. A svchost service could be sucking up RAM.

 

[LordOfChaos]

Hey All,

So here is the update that you all have been waiting for with baited breath. HA!

Screw it, I installed Windows 7. Everything runs fine. Well except for my no x64 driver havin wireless network adapters.

Good thing that I can build hardwires.

I did not find the problem, and as much as I hate to lay on a blanket statement, just reformat, and start again.

Make sure to back up those important files!

I appreciate the help you all gave. I apologize for being to lazy, or to sick of the problem to have helped any further.

PEACE

 

[Fuego75]

Well I'm too stubborn to reformat and reinstall and since this is my thread originally :P ....

Reinstall really is a last resort for me, because of the time needed (measured in days) to get everything back to where it was. Besides which, W7 brings it's own issues with it (for example the third party CODECs restrictions in Media Player/Centre, just to mention one that I just found out about). Still, I'm glad (for you) that you have worked around the issue.

Anyway, my memory leak problem continues.

Running detailed perfmon profiles, I have pinned it down to non-paged memory pool use. Using perfmon I have ruled out system cache use, as well as device drivers, services and all user processes.

I have installed W2K3 Resource tools successfully and run memtriage (Nice little diagnostic, btw), which has pointed me in the direction of mmSt tags (mm section object prototype ptes).

As such (following various Kb articles and the like), I've disabled any shared files and folders on my system, for now. I did find one oddity there, whilst checking what was being shared (including media). In the roaming profile, the system had a couple of Logitech MX5000 keyboard files (last_mx5000-flash.bin and mx5000-flash.bin) marked as being shared in the SetPoint folder inside C:\Users\...\AppData\Roaming\Logitech\. Scanning these files with various tools did not reveal anything malicious, but I mention it anyway since I thought it was odd.

I've also applied a registry patch to limit non-paged pool use to 60% (was 80% by default, I believe) to see if the memory manager will kick in before all physical memory is exhausted.

Atm, it's too early to say what effect this has had, if any, on my issue. I'll try to report back.

Meantime I'm trying to find a copy of the mempool diagnostic for Vista 64 to see if I can gather some further info. It is available in the support folder of various other distributions (XP, W2K, W2K3), but not for Vista for some reason (m$ is trying my Vista patience, damn them).

Anyone know where I can find poolmon.exe for Vista 64, or whether I can use say the W2K3 version under Vista 64?

This is the Kb that discusses use of poolmon btw: How to use Memory Pool Monitor (Poolmon.exe) to troubleshoot kernel mode memory leaks As one can see, I'm going in the general direction of a memory leak in Vista 64 itself, when certain conditions are prevalent. Hopefully I won't have to go as far as using Windbg to get some more clues

Finally, another possible area that may be contributing to my issue is memory being consumed (but not released) through volume shadow copies (I just have a hunch), so I may try turning off anything that causes a Volume Shadow Copy to kick-off (restore points, etc. I guess).

 

[LordOfChaos]

"Well I'm too stubborn to reformat and reinstall and since this is my thread originally :P .... "


I completely understand what you are saying. I am quite the same way.

My only other argument for formatting would be, that you have already wasted more time on it than it would take to install.

I will look forward to hearing what you find out, as it never hurts to know what is going on in M$'s head. I am always eager to learn something new.

(COMPLETELY OFF TOPIC) Who would have thought that running both or your broadband routers, in series, with the same IP address would be a not so good idea for your network? Learned this last night. YEA!

PEACE

 

[VaguelyRapt]

My only other argument for formatting would be, that you have already wasted more time on it than it would take to install.

I don't know how rational that argument is, it works well for gambling addicts too

Seriously now, I've been quietly following this thread since my first and only post. I really want to see how it turns out (unfortunately, I don't think I'm experienced enough to help out myself). As much as I like troubleshooting myself (even my sig says never give up), I had a problem myself that wasn't solved by a clean install and it led to very important conclusions as to where the problem originated (I ended up fixing it by writing 0's to my HDD and then reinstalling Vista, as it was a matter of bad partitioning). Perhaps a clean install will completely kill the problem, and perhaps in will give some insight (e.g. if you reinstall all your programs one by one, you'll find which one's don't destabilize the system and which do, or perhaps you'll find it's a hardware issue all together).

Maybe the only input I have for this thread is to rethink about a clean install, you never know.

 

[usasma]

I get this at work every day.
It's your system - only you can decide what amount of time is appropriate.
Myself, I'll troubleshoot any problem until the owner gives up - but that's because I like doing this. Also, I can afford the time on my own stuff since I have 9 different systems at home.