Memory Leak

[Deraye]

I have been having a memory leak in Windows 10 64bit (8gb of memory) for a while now. It has taken from eight to ten hours for the system memory to go from 30% to 75%. At that point I typically reboot to release the memory and start over again. I have tried everything I can to locate the driver that may be causing the issue with no success. My system is totally up to date. All drivers are up to date, my antivirus has been run several times and I have mad as many adjustments to see if it is the cause with no luck.

I ran poolmon and found the tag Proc seems to be where the issue lies. Out of the over 110,000 allocations it has only freed 10. Sadly, I have 211 .sys files associated with the pool tag Proc. The memory leak seems to be speeding up slightly and I have been trying to correct this for over a week now. This is definitely not my area of expertise. Any assistance in narrowing down the possible culprit would be appreciated. I uploaded the file with the list of drivers associated with Proc just in case it helps.

 

[Regedit32]

Hi Deraye,

Are you able confirm what network processes are running via Task Manager.

In the meanwhile, as would be expected, among your PoolTag list you can see the NDU.sys listed.

This is the Windows Network Data Usage driver used to monitor your data usage. I may be mistaken on this point, but if memory serves me correctly Microsoft first introduced this with Windows 8.0; happy to be corrected on that point if anyone else recalls.

That particular driver and associated service are set to Automatically start by default although this depends on TCP/IP service settings. NDU.sys does have a history of clashing with some network drivers, hence my opening question re your Network processes.

A temporary resolution to test whether this is actually what is going on would be to disable NDU via your registry, then restarting computer, and monitoring your Paged Pool and Non-paged Pool usage via Task Manager's Performance tab.

If you would like to try this we can modify the appropriate key via an elevated command prompt like so:

• Right-click on Start then left-click on Command Prompt (Admin)
  
  This will open the Administrator: Command Prompt window to C:\WINDOWS\System32>

• At this prompt type or copy & paste the following command:
  
  

  REG ADD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ndu /v Start /t REG_DWORD /d 00000004

  
  Press Enter key to execute command.
  
  As the value all ready exists you will be prompted to confirm you want to overwrite it. Type y or yes then press Enter key.
  
  You will then see a confirmation that the operation was successful.
  
  Sample image below to demonstrate
  
  
  

• Note: The original Data Value for Start was 00000002
  
  If after trying this you see no improvement you can reset the value by repeating the steps above using the command:
  
  

  REG ADD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ndu /v Start /t REG_DWORD /d 00000002

• Close the command prompt window and any other applications then restart computer.

Time will tell whether this helps or not.

Ultimately though, if the above appears to help, what you will need to do is investigate your Network drivers and see what updates are available for them. You may need to work on installing the driver only and avoid any additional software included in any packages offered from the driver supplier.

Once you manage to find updated drivers and install them, you will then want to reset that NDU Start back to 00000002 as mentioned in my notes above, in order to verify that you truly have resolved the clash between NDU.sys and whichever driver it is not getting along with this.

Regards,

Regedit32

 

[Vince Massi]

You can download the free Win Patrol to find out what start-up processes you have. It will also tell you what processes are running when your memory usage goes up.

 

[Deraye]

Thanks guys,

@Regedit32, I took a look at my registry settings and it was already set to 4. I set it to 2 just to test what would happen and surprisingly the memory leak slowed down. Didn't stop it but slowed it down. That got me thinking about the Killer Network drivers. I recently updated them but it was worth a second look.

I reset the registry key to 4 to stop the process from starting so I could start from where I left off. This time I went to the actual Killer Network website to pull the drivers. Started to install them and it notified me I had an older version of the drivers installed. Blew me away. I just updated them from the MSI website. I could have pulled an older version, but I could have sworn I pulled the latest version.

It hasn't been very long since I updated to the drivers directly from Killer Network to test to see if this was the issue but here is hoping. I will keep you posted.

Again, thanks for setting me on what may be the correct path.