Sempurna

Hi everybody,

My system specs:
Model: Dell Inspiron 510m laptop
OS: Microsoft Windows XP SP2
Processor: Intel Pentium M 1.60 GGz
RAM: 1.59 GHz, 512 MB
Single Hard Drive: 33.7 GB, 16.0 GB free


OK, here's my problem. Over the last few weeks I've been experiencing a really strange problem which has never occured before. When I look in Task Manager, the kernel memory usage is steadily increasing, even when I'm not doing anything but staring at it.

Of course, when I open programs and run them, the kernel memory usage increases even faster. At bootup, the total would be around 40 MB, paged 25 MB, and nonpaged 15 MB. But, as time goes by, this will change with the total and paged areas steadily increasing, but the nonpaged figure remaining pretty constant (13 -15 MB range).

When the total reaches around 180 MB, with paged about 165 MB, the system will begin to behave buggy. The screen would not load everything as it should, and everything will eventually hang. I sometimes get a prompt stating that the disk doesn't have enough space and to close some programs.

While the kernel memory is increasing, the available RAM steadily decreases. At bootup, the system will have around 260 MB free, but by the time the error occurs, free RAM would have dropped to around 50 - 60 MB.

I've never experienced this before, and assumed it was due to a buggy Windows update. But, I've done the latest updates, and the problem remains.

Sometimes, this buggy behaviour will occur within an hour of heavy computer usage. It takes longer if usage is not heavy, but being a helper in the security forum requires me to have multiple IE pages open, with a number of other diagnostic programs running as well.

Any suggestions?

~~~

justpassingby

Hi Sempurna !

In the task manager go to the processes tab => view => select columns and tick paged pool, non-paged pool and virtual memory. Check whether the memory leak appears there. If it does, tell us which process is in cause.

Sempurna

Hi justpassingby,

Thank you for the quick reply.

I don’t see much difference in the Processes tab of Task Manager. The indicated numbers don’t change very much, yet the kernel memory usage continues to balloon.

I’ve included some images to for you to see. Perhaps you could pinpoint the process that is having the memory leak.

The first image is right at bootup, and the second is roughly half an hour later, with only IE, Task Manager, and Paint open.


Overall picture:








~~~


Memory Usage:








~~~


Virtual Memory:








~~~


Paged Pool:








~~~


Non-paged Pool:








Thank you again for the kind assistance and your time.

~~~

justpassingby

I see no obvious sign of a particular process which memory usage has increased. That's weird cause the commit charge does indeed increase.

The memory leak may very well be in something that's running at a lower level than the processes we see there. I don't know much about the kernel memory, I'll have to do some research on that. In the mean time I'll try to have some other microsoft techs to check this thread.

Do you remember having installed any new device 'round the time the problem began ?

You might try to uninstall any update from windows update you've done 'round that time to see if that problem could be linked to one of those.
edit : ok, don't uninstall any update yet, simply list the ones you believe you could have installed right before the problem began to occur and follow the instructions from my next post.

justpassingby

I may have found something that will tell us more, problem is I've never used it so you'll have to trust Microsoft's instructions on it. Follow the instructions from this link and paste the log in your next post :
http://support.microsoft.com/kb/q177415/

Also, what antivirus and firewall are you using ? Could you disconnect from the internet for a while (unplug the ethernet cable if you're on a wired network, right-click the wireless icon and click deactivate if you're on a wireless one), deactivate your antivirus and firewall and report whether the kernel memory keeps increasing while the firewall and antivirus are off.

sagittar

hi sempurna , i have almost the same problem , memory usage keeps rising until system crashes in almost any application but i don't think it's because of a windows update because i disabled updating some time ago before this problem starts . i'll check back later to see if anyone comes up with a solution ..
i hope you get rid of the problem soon ...

justpassingby

Sagittar, your problem is not likely to be related to the kernel memory, I answered in your thread go check it out

Kalim

Hi Sempurna

TBVH I see no problem in your memory usage at all. I will advise you, that as your add software and updates to your system, 512MB is a bottleneck and it'll slow down your system drastically with an AV/AS/FW running. Your system will have to start prioritizing and cutting memory down for everything to optimize as Windows does by default. That's a given.

It seems you have around 750MB page file set. In Task Manager, the Commit Charge (k) is the total memory you have available (limit), included is the peak RAM used in a session and the current RAM usage (total). Kernel memory listed is for the page file and non-page file.

The non-paged will hardly ever change. The paged is what will fluctuate and altogether it's your page file basically.

The RAM usage depends on how you have your settings configured:
Have you set the system to load Kernel data into RAM? (it's faster allround but takes more RAM space)
Have you set it to load the prefetch into RAM? (same implications as above)

Infact compare it to one of mine right here on a fairly new but very customized XP SP2 x86-bit install:

On bootup I have around 26 processes running. My paged file is set to 100MB on this system below as I have 1.5GB RAM, and it will get used 98% most o0f the time. Windows will always find a use for your RAM and page file, so that it doesn't go to waste.

By default, I have Windows Update and all extra services/processes OFF. I'm running SpybotS&D Teatimer, a HOSTS file, Avast (3 modules only), Comodo Pro firewall, Spyware Guard and Spyware Blaster. I have Fx with 59 extensions/4 themes installed (16 tabs) open, IE 7 (2 tabs) has just been opened about 4 minutes ago and minimum extra's, although I have Nvu, MMC, Calc open too:






Compare those figures to yours and you'll see that you are much better off.

My IE is double yours in RAM usage. My Comodo (CPF) is 10MB more than yours in RAM and Virtual Memory. My Windows Explorer is 7x your RAM size and around 6x times in Virtual Memory usage. Same with services, svchost and so on. I have ~580MB RAM used up there as you can see.

The problem on your system is with something other than what's shown above. In all of the screenshots above, you had sufficient RAM free. Is it possible for you to take a screenshot of the processes and performance tabs in Task Manager when you have very little RAM free and high page file?

That would help.

Either one of your programs is buggy and holding data code in RAM when it should be releasing it or something other, if you haven't got a lot of apps open.

justpassingby

Thx for taking the time to give a look Kalim

It's not visible on the screenshots but from what Sempurna said, his total Kernel memory sometimes goes above 180MB (165Mb paged memory). That seems a lot to me, could it still be normal depending on the softwares that are running ?

Or maybe it's that Kernel loaded into the ram stuff... Run regedit and navigate to HKEY LOCAL MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management. What are the values of DisablePagingExecutive, LargeSystemCache and IOPageLockLimit (the latter value may not exist depending on your version, and actually I'm not even sure it's doing anything in an XP system) ?

Kalim

No worries justpassingby.

It depends really, on what is taking up the extra Virtual Memory. If your system doesn't have enough RAM, it will start draining your page file, right to the peak it's allowed to. I believe the culprit may probably turn out to be IE.

justpassingby

To check whether this is really a memory leak, you could also restart the computer when you're about to shut it off and leave it on overnight (disable any screensaver or power management feature except the one that will turn the screen off). If the kernel memory remains the same when you're not using it, then it's probably some bottleneck with your ram as Kalim said. XP will work better on 1GB than on 512MB of ram especially if you use many apps at the same time. It should be possible to add one stick of ram in your laptop.

But do try the other leads : check what's really using your kernel memory with poolmon.exe and see if you can single out the source of the constant increase, and tell us whether the Kernel is loaded in the ram (we'll know with the value of the DisablePagingExecutive key in the registry).

Sempurna

Thank you for the quick response guys.

I have to go out of town for a function, and won't have access to this lappie for about 48 hours. Once I get back, I'll update you guys on what you've suggested for me to do, and the results.

I've been trying to troubleshoot this problem for a while now. It seems there are other problems with this machine. For example, while troubleshooting chkdsk won't run to completion, and when I run sfc /scannow it tells me to insert a XP Professional CD when this machine is running XP Home Edition. So, both chkdsk and sfc /scannow cannot run to completion.

Will take all your advice in, including adding more RAM.

Catch up with you guys in a couple of days, then.

Cheers!
~ Semps

~~~

Sempurna

Hi justpassingby & Kalim,

OK, problem solved.

Did the poolmon.exe thing as suggested by justpassingby. The logs are attached below.

The problem appeared to be a driver with the pooltag SoBB, and I couldn't find it, whether searching in the pooltag.txt file as provided by M$ (meaning the problem wasn't a M$ .sys file) or through my system.

But, the thing seemed not to free up any kernel memory and just became a monster as time went by. So, going back to my training, I decided to look at all the drivers running on my system and see which could be the culprit.

Found nothing suspicious. Just the normal drivers, as there has been for the longest time. So, looking at the running ones, I decided to uninstall the active security software running in my system and see if they could be the problem. If not, I was going to go through each and everyone of the drivers and disable them one by one.

First to go was SnoopFree. SoBB remained and continued to gobble up kernel memory. Then uninstalled Comodo firewall. Same thing.

Then, bingo! Uninstalled Active Virus Shield and SoBB disappeared. Reinstalled all the security software, and for the last 24 hours things appear to be back to normal. Kernel and RAM memory usage appear to be stable, and that SoBB monster has not reappeared.

May I ask what happened? Did a M$ update screw up something with AVS, or did a AVS module update get corrupted somehow?

Edit: Managed to run chkdsk to completion, no problem there. But, sfc /scannow still asks for an XP Pro CD, while my system is installed with an XP Home version. Why is that?

~~~

Attached Files

	poolmon01.txt (23.4 KB, 7 views)
	poolmon05.txt (23.3 KB, 2 views)

Kalim

Good work Sempurna.


What happened is what I expected.

Whenever you collect the pooltag for the paged memory, it's like a snapshot at any one second. It changes by the minute as memory is acquired and released.

Some software that requires a range of memory address space will not let it go, basically because it still needs it. It will only let it go once switched off, as then it will not need it. That's basically like your AV software. A memory leak is only if it didn't release the memory space once the application or code belonging to the application is not needed and/or closed.

That sort of memory pagefile is nothing to be concerned about, really.

One aspect to try is, to switch off the AVS and then see if you see SoBB back in there with the same pagefile usage. If so, then that's a memory leak and a buggy software. If not, then everything is fine.

Place the XP Home CD inside and it should be OK to run. XP Home has SFC in there too.