Windows 8 out of memory over time: Toke Paged consuming over 5GB

Laptop: Lenovo ThinkPad W530

As I leave my computer on for a day or so it starts to run out of memory. This continues until it freezes up completely.

I've read numerous articles that has lead me to the screen shot below, and Toke which consumes over 5GB of type paged. But all I can find on the tag Toke is highlighted in the screenshot... which isn't relevant to my setup.

Alternatively, although again not relevant, there was a workaround provided to someone by Microsoft:

http://social.technet.microsoft.com/Forums/windowsserver/en-US/32f414c2-fefc-4ee3-94fa-231a18272234/toke-paged-pool-tag-consuming-high-amount-of-memory?forum=winserverTS

Can anyone provide some insight on what could be causing this?

Note: If you need additional information I will pull it up asap. This has been an ongoing problem for the past 9+ months. Unfortunately I don't have the time for a wipe and load with our current development push.

^{Click for full size}

Update: I've found the culprit. Seems like it's virtscrl.exe which is Lenovo Auto Scroll. Others have had the same issue: http://forums.lenovo.com/t5/W-Series-ThinkPad-Laptops/virtscrl-exe-memory-leak/td-p/1193015

Looks like they have a new version (2.02) that isn't public yet. Link to download is here:

https://dl.dropboxusercontent.com/u/62276273/gfvv05ww.exe

Update 2: It's been great ever since. Maxing out at around 37% memory usage. Woot!

Answer

I've seen this in the past and the toke tag is used by the Intel WIFI driver. So install the latest driver.

If this doesn't fix use xperf to trace what causes the usage. Install the WPT, open a cmd.exe as admin and run this:

xperf -on PROC_THREAD+LOADER+POOL -stackwalk PoolAlloc+PoolFree+PoolAllocSession+PoolFreeSession -BufferSize 1024 -MinBuffers 256 -MaxBuffers 256 -MaxFile 512 -FileMode Circular && timeout -1 && xperf -d pool.etl

capture 30s of the grow. Open the ETL with WPA.exe, add the Pool graphs to the analysis pane.

Put the pooltag column at first place and add the stack column. Now load the symbols inside WPA.exe and expand the stack of the Toke tag. Now find other 3rd party drivers which use this tag. Look for driver updates