Sunday, November 2, 2014

Windows 8.1 memory leak which is invisible in process monitor and poolmon

After trying around for days, googling about everything and trying a lot I am left clueless.


I have a Razer 2013 Blade Pro with 8GB ram.
I have 30 GB allocated for additional virtual ram.


My system eats ram, after a day I have to reboot.
Task manager always shows 7.6-7.8GB of 8GB used (after a while)
It shows 10+GB committed after half a day.
Paged and non paged pool are less than a GB.
cached is less than a GB
Processes combined are less than a GB.


Normally 'poolmon' shows that something else like a driver is using the memory.
However, in my case poolmon shows no extra usage of anything.
Right now 12GB of disk space and 8GB of real memory are in use and nothing is using it.


So essentially my question is this:
If neither the task manager nor poolmon shows memory losses or usages, what else can I try to find out WHAT is using up 20GB of memory ?


Poolmon -b:


     Memory: 8304828K Avail:  357404K  PageFlts:749759184   InRam Krnl:31464K P:248372K
Commit:12798116K Limit:32880828K Peak:12958348K Pool N:168816K P:303892K
System pool information
Tag Type Allocs Frees Diff Bytes Per Alloc
CM31 Paged 76680 ( 0) 49859 ( 0) 26821 122609664 ( 0) 4571
wcdl Nonp 43 ( 0) 0 ( 0) 43 32427744 ( 0) 754133
MmSt Paged 997690 ( 0) 989424 ( 0) 8266 28019248 ( 0) 3389
rzud Nonp 109134 ( 0) 46163 ( 0) 62971 15651296 ( 0) 248
CM25 Paged 3295 ( 0) 0 ( 0) 3295 14479360 ( 0) 4394
MmRe Paged 21218 ( 0) 19623 ( 0) 1595 14009152 ( 0) 8783
Toke Paged 12315343 ( 0) 12310825 ( 0) 4518 8803808 ( 0) 1948
ConT Nonp 1585 ( 0) 1212 ( 0) 373 6365184 ( 0) 17064
BGIK Paged 1 ( 0) 0 ( 0) 1 6221824 ( 0) 6221824
Thre Nonp 449909 ( 0) 447365 ( 0) 2544 5244384 ( 0) 2061
Ntff Paged 582079 ( 0) 578052 ( 0) 4027 5218992 ( 0) 1296
CM16 Paged 9083 ( 0) 8010 ( 0) 1073 4685824 ( 0) 4367
Irp Nonp 75321006 ( 0) 75307341 ( 0) 13665 4645936 ( 0) 339
XENO Nonp 594 ( 0) 399 ( 0) 195 4317616 ( 0) 22141
ViMm Paged 1873388 ( 0) 1862026 ( 0) 11362 4057360 ( 0) 357
File Nonp 59994297 ( 0) 59983847 ( 0) 10450 3492864 ( 0) 334

The only unusual thing I see here is "pageflts" which is high, after first second of poolmon it drops to 50k per update.
I guess that indicates something, maybe just that something is trying to get memory in an insane rate.


Update:
I did not play on it, did not change resolution.
enter image description here


Update: Rammap images with photoshop loaded (5GB in process memory):
enter image description here
enter image description here
Rammap images with photoshop stopped (memory still shows to be full):
enter image description here


Also strange, aside from 18GB commited memory that are not shown, rammap shows 5 GB in processes which is also not the case.


P.S. I did a malwarebytes rootkit scan without anything.
That's the only thing I can think about, a major bug in the windows OS regarding memory usage or a kernel rootkit.

No comments:

Post a Comment

linux - How to SSH to ec2 instance in VPC private subnet via NAT server

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. S...