# Windows 7 Excessive Memory Usage



## AiiNZ (Dec 20, 2009)

Recently, my computer has been using a lot of memory when idle. Mainly after a night of leaving it on, but I used to leave it for a week at a time and they never got so out of hand. 

It get's to the point were it's using 3GB out of 4GB of my RAM, and things get sluggish. This is with no programs open by the way.

Any suggestions as to what may be causing my problems? 

Home Premium, x64.


----------



## jcgriff2 (Sep 30, 2007)

Hi - 

System Services and apps always running in the background.

Check in with the Resource Monitor to see what is utilizing the RAM -
START | type *perfmon /res*

Regards. . .

jcgriff2

`


----------



## AiiNZ (Dec 20, 2009)

That's part of the issue. I can't seem to figure out the source of the problem. Form being turned on, the RAM usage gradually increases until it's sitting in the 3 - 3.5GB area, then my computer finally crashes.


----------



## jcgriff2 (Sep 30, 2007)

If RAM usage is constantly rising and you are not running additional apps, the problem may be a "leaky driver".

In 2008, I had a leaky IDT audio codec. After boot-up, it was ~ 50 MB RAM. Withing 6-8 hours, it was consuming nearly 2 GB RAM. I was then forced to do hard shutdown. HP released an updated IDT driver that fixed the issue.

Keep an eye on Performance Monitor to find out what is consuming the RAM -- click on "memory" tab; click on "private" column heading to sort.


----------



## LMiller7 (Jun 21, 2010)

You could also post a screenshot of Task Manager - Performance tab when memory usage is high. This is always a good starting point when investigating memory problems.


----------



## AiiNZ (Dec 20, 2009)

jcgriff2 said:


> If RAM usage is constantly rising and you are not running additional apps, the problem may be a "leaky driver".
> 
> In 2008, I had a leaky IDT audio codec. After boot-up, it was ~ 50 MB RAM. Withing 6-8 hours, it was consuming nearly 2 GB RAM. I was then forced to do hard shutdown. HP released an updated IDT driver that fixed the issue.
> 
> Keep an eye on Performance Monitor to find out what is consuming the RAM -- click on "memory" tab; click on "private" column heading to sort.


The process using the most RAM at present is svchost, in excess of 140,000KB.

Coincidently, my computer is HP, so maybe I could have that issue? I haven't downloaded any HP updates since I rebooted the system about 4 - 5 months ago, so it might be a good idea to do so now.

Here's a screenshot of my performance tab.

http://i51.tinypic.com/25t9lqo.png


----------



## LMiller7 (Jun 21, 2010)

This is why I asked for the screenshot. Task Manager - performance tab, won't usually reveal the problem, but it will often show where to look. The paged kernel memory is very high. Look at the paged pool column of the processes tab and report the highest value. This column is not shown by default and will need to be added from the view menu.

This may not reveal the problem but it is easy to check.


----------



## jcgriff2 (Sep 30, 2007)

Good catch on kernel paged pool. The screenshot shows it at 2999 MB -- about 10x the norm.

The svchost process utilizing ~ 140 MB RAM is normal and likely includes these system services - 

```
AudioEndpointBuilder
hidserv
HomeGroupListener
Netman
PcaSvc
SysMain
TrkWks
UxSms
Wlansvc
wudfsvc
```
SysMain = Superfetch uses about 90% of the memory for that particular svchost.

Windows 7 System Services - http://www.blackviper.com/Windows_7/servicecfg.htm

Regards. . .

jcgriff2

`


----------



## AiiNZ (Dec 20, 2009)

The highest paged pool value is the explorer process, using 554k.


----------



## LMiller7 (Jun 21, 2010)

554K isn't nearly high enough for this problem. This could be a sign of a malware infection. These processes will often hide themselves from view by Task Manager and similar programs. Do a full anti-malware scan. There are other possibilities as well.


----------



## jcgriff2 (Sep 30, 2007)

Be sure to click on "show processes from all users" in Task Manager "Process tab" - see lower-left corner.

Also, click on "view", "select columns" - check boxes for paged pool; non-paged pool


----------



## AiiNZ (Dec 20, 2009)

That was with processes from all users showing. 

The highest non paged is ccsvchhost.exe, which I think is something to do with Norton360, but that again is only a small value. About 360k.

What program would I use for a malware scan?


----------



## jcgriff2 (Sep 30, 2007)

That is Norton.

Was the system utilizing nearly 3 GB RAM when you checked Task Manager?

That is the point in time to check memory usage.

You can have your system checked by a security analyst. Follow these steps -

http://www.techsupportforum.com/sec...read-before-posting-malware-removal-help.html

Regards. . .

jcgriff2

`


----------



## AiiNZ (Dec 20, 2009)

Currently at the 3GB point of memory usage. Here's a screeny of my processes.

http://i52.tinypic.com/r9kcv9.png


----------



## jcgriff2 (Sep 30, 2007)

Where are you seeing the 3 GB RAM usage number?

The Task Manager screenshot shows 81 processes; highest memory usage = svchost @ 117 MB. The numbers do not add up.

However, looking at your prior screenshot; 77 processes - 2.98 GB RAM; 2999 MB Kernel paged pool.

If rogue driver causing this, Driver Verifier may be of help.

Run - http://www.techsupportforum.com/f217/driver-verifier-windows-7-and-vista-bsod-related-473665.html

Provide full system info - http://www.techsupportforum.com/f217/blue-screen-of-death-bsod-posting-instructions-452654.html

If Driver Verifier flags a 3rd party driver, it will BSOD your system. Please read the instructions thoroughly.

Regards. . .

jcgriff2

`


----------



## LMiller7 (Jun 21, 2010)

I believe the problem comes from the very high paged pool usage (labeled as Paged kernel memory in Task Manager). Processes running in kernel mode can allocate memory from either the paged or non-paged pool. Memory in the non-paged pool can never be paged out of RAM while that in the paged pool can be paged out by the memory manager. A portion of the paged pool will be in RAM. But Task Manager will not tell you how much and I don't think Resource Monitor will either.

In the case of malware infection the Task Manager process listing isn't going to be very revealing. A process can use a number of techniques to hide itself from Task Manager and malware often does this to hide it's presence.

A check for malware would be in order. A good way to do this would be to follow the instructions linked to by jcgriff2 above.


----------



## AiiNZ (Dec 20, 2009)

I ran the verifier, but didn't get too far. As the instructions said, I created my restore point. After the reboot required by the verifier, I had to start in safe mode to be able to login. After that, nothing. No difference, no BSOD either. Something I did wrong?


----------



## jcgriff2 (Sep 30, 2007)

It appears that Driver Verifier flagged a driver.

Look for folder - c:\windows\minidump

If it exists, copy the entire minidump folder to Documents folder; zip it up and attach to next post.


----------



## AiiNZ (Dec 20, 2009)

The minidump folder exists, but is empty.


----------



## jcgriff2 (Sep 30, 2007)

Is there a file - c:\windows\memory.dmp ?

If so, what is the date on it?

Can you boot into normal Windows?


----------



## AiiNZ (Dec 20, 2009)

I can boot into normal windows now, but only after the system restore. No such file exists.

I must thank you for your patience so far, you've been incredibly helpful.


----------



## jcgriff2 (Sep 30, 2007)

Provide system info - http://www.techsupportforum.com/f217/blue-screen-of-death-bsod-posting-instructions-452654.html

I'd like to see if any entries logged after driver verifier started.


----------



## AiiNZ (Dec 20, 2009)

Here's the stuff.


----------



## AiiNZ (Dec 20, 2009)

Anyone? This is getting beyond a joke, I can barely use more then one program at once.


----------



## jcgriff2 (Sep 30, 2007)

What is this start-up item?


```
[font=lucida console]
1exRkfUzJKI	c:\users\ainz\appdata\roaming\internetexplorer.exe[/font]
```
Remove Norton Internet Security using the Norton Tool Remover -

NIS/ N360 Removal - http://jcgriff2.com/NRT_N360_Removal.html

Here is memory usage in descending order -

```
[font=lucida console]
Image Name                     PID Session    Mem Usage Status          User Name                                              CPU Time Window Title                                                            
========================= ======== ==================== =============== ================================================== ============ ========================================================================
svchost.exe                    128 Services  128,608 K Unknown         NT AUTHORITY\SYSTEM                                 
chrome.exe                    4544 Console   107,836 K Running         Ainz-PC\Ainz                 
explorer.exe                  1268 Console    76,480 K Running         Ainz-PC\Ainz                                        
SearchIndexer.exe             3432 Services   61,452 K Unknown         NT AUTHORITY\SYSTEM                                 
chrome.exe                    4824 Console    61,208 K Unknown         Ainz-PC\Ainz                                        
msnmsgr.exe                   1752 Console    61,100 K Running         Ainz-PC\Ainz                                        
chrome.exe                    4876 Console    53,416 K Unknown         Ainz-PC\Ainz                                        
svchost.exe                    380 Services   46,416 K Unknown         NT AUTHORITY\SYSTEM                                 
sidebar.exe                   3068 Console    37,852 K Running         Ainz-PC\Ainz                                        
dwm.exe                       1620 Console    35,268 K Running         Ainz-PC\Ainz                                        
wlcomm.exe                    3400 Console    31,772 K Unknown         Ainz-PC\Ainz                                        
svchost.exe                    992 Services   24,936 K Unknown         NT AUTHORITY\LOCAL SERVICE                          
WmiPrvSE.exe                  2812 Services   24,388 K Unknown         NT AUTHORITY\NETWORK SERVICE                        
CCC.exe                       4284 Console    23,404 K Running         Ainz-PC\Ainz                                        
chrome.exe                    3004 Console    21,344 K Unknown         Ainz-PC\Ainz                                        
chrome.exe                    5068 Console    19,068 K Unknown         Ainz-PC\Ainz                                        
System                           4 Services   19,048 K Unknown         N/A                                                 
Pen_Tablet.exe                2444 Console    18,660 K Running         NT AUTHORITY\SYSTEM                                 
svchost.exe                   1056 Services   18,084 K Unknown         NT AUTHORITY\LOCAL SERVICE                          
chrome.exe                    3360 Console    17,512 K Unknown         Ainz-PC\Ainz                                        
chrome.exe                    1816 Console    17,304 K Unknown         Ainz-PC\Ainz                                        
chrome.exe                    3764 Console    16,840 K Running         Ainz-PC\Ainz                                        
chrome.exe                    2480 Console    16,832 K Unknown         Ainz-PC\Ainz                                        
chrome.exe                    3560 Console    16,664 K Unknown         Ainz-PC\Ainz                                        
chrome.exe                    3428 Console    16,628 K Unknown         Ainz-PC\Ainz                                        
svchost.exe                   1324 Services   16,624 K Unknown         NT AUTHORITY\NETWORK SERVICE                        
taskhost.exe                  6084 Services   16,476 K Unknown         NT AUTHORITY\LOCAL SERVICE                          
svchost.exe                   4688 Services   16,296 K Unknown         NT AUTHORITY\LOCAL SERVICE                          
svchost.exe                   4848 Services   14,696 K Unknown         NT AUTHORITY\LOCAL SERVICE                          
svchost.exe                   1724 Services   14,052 K Unknown         NT AUTHORITY\SYSTEM                                 
iTunesHelper.exe              3812 Console    13,672 K Running         Ainz-PC\Ainz                                        
lsass.exe                      664 Services   12,360 K Unknown         NT AUTHORITY\SYSTEM                                 
csrss.exe                      548 Console    12,248 K Running         NT AUTHORITY\SYSTEM                                 
spoolsv.exe                   1468 Services   12,044 K Unknown         NT AUTHORITY\SYSTEM                                 
ccsvchst.exe                  1976 Services   11,892 K Unknown         NT AUTHORITY\SYSTEM                                 
SbieCtrl.exe                  2912 Console    11,432 K Running         Ainz-PC\Ainz                                        
explorer.exe                  3268 Console    11,192 K Running         Ainz-PC\Ainz                                        
taskhost.exe                  1908 Console    11,008 K Running         Ainz-PC\Ainz                                        
svchost.exe                   1528 Services   10,368 K Unknown         NT AUTHORITY\LOCAL SERVICE                          
TrustedInstaller.exe          5672 Services   10,212 K Unknown         NT AUTHORITY\SYSTEM                                 
hamachi-2.exe                 1104 Services   10,120 K Unknown         NT AUTHORITY\SYSTEM                                 
svchost.exe                    772 Services    9,968 K Unknown         NT AUTHORITY\SYSTEM                                 
services.exe                   656 Services    9,044 K Unknown         NT AUTHORITY\SYSTEM                                 
SearchProtocolHost.exe        2688 Services    9,008 K Unknown         NT AUTHORITY\SYSTEM                                 
svchost.exe                    852 Services    8,872 K Unknown         NT AUTHORITY\NETWORK SERVICE                        
WTouchUser.exe                1992 Console     8,388 K Running         Ainz-PC\Ainz                                        
winlogon.exe                   592 Console     8,312 K Unknown         NT AUTHORITY\SYSTEM                                 
hamachi-2-ui.exe              3648 Console     8,252 K Running         Ainz-PC\Ainz                                        
MOM.exe                       3656 Console     7,912 K Running         Ainz-PC\Ainz                                        
ccsvchst.exe                  2720 Console     7,840 K Running         Ainz-PC\Ainz                                        
wmpnetwk.exe                  1080 Services    7,544 K Unknown         NT AUTHORITY\NETWORK SERVICE                        
iPodService.exe               4020 Services    7,440 K Unknown         NT AUTHORITY\SYSTEM                                 
AppleMobileDeviceService.     1744 Services    7,432 K Unknown         NT AUTHORITY\SYSTEM                                 
wuauclt.exe                   4264 Console     7,216 K Running         Ainz-PC\Ainz                                        
SearchFilterHost.exe          5516 Services    7,032 K Unknown         NT AUTHORITY\SYSTEM                                 
BambooCore.exe                3612 Console     6,376 K Running         Ainz-PC\Ainz                                        
WUDFHost.exe                  2572 Services    6,260 K Unknown         NT AUTHORITY\LOCAL SERVICE                          
tasklist.exe                  4016 Console     6,260 K Unknown         Ainz-PC\Ainz                                        
atieclxx.exe                  1376 Console     6,176 K Running         NT AUTHORITY\SYSTEM                                 
WmiPrvSE.exe                  2620 Services    5,820 K Unknown         NT AUTHORITY\SYSTEM                                 
mDNSResponder.exe             1696 Services    5,708 K Unknown         NT AUTHORITY\SYSTEM                                 
ObjectDock.exe                3296 Console     5,656 K Running         Ainz-PC\Ainz                                        
conhost.exe                   5852 Console     5,648 K Running         Ainz-PC\Ainz                                        
Pen_Tablet.exe                1708 Services    5,520 K Unknown         NT AUTHORITY\SYSTEM                                 
MacG.exe                      3092 Console     5,360 K Running         Ainz-PC\Ainz                                        
svchost.exe                   2816 Services    5,332 K Unknown         NT AUTHORITY\NETWORK SERVICE                        
issch.exe                     3640 Console     4,932 K Unknown         Ainz-PC\Ainz                                        
Dock64.exe                    3732 Console     4,740 K Running         Ainz-PC\Ainz                                        
SbieSvc.exe                   1120 Services    4,660 K Unknown         NT AUTHORITY\SYSTEM                                 
wininit.exe                    556 Services    4,596 K Unknown         NT AUTHORITY\SYSTEM                                 
Pen_TabletUser.exe            2276 Console     4,540 K Running         Ainz-PC\Ainz                                        
lsm.exe                        672 Services    4,500 K Unknown         NT AUTHORITY\SYSTEM                                 
csrss.exe                      476 Services    4,380 K Unknown         NT AUTHORITY\SYSTEM                                 
BSOD_Windows7_Vista_v2.60     5052 Console     4,364 K Running         Ainz-PC\Ainz                                        
atiesrxx.exe                   936 Services    4,364 K Unknown         NT AUTHORITY\SYSTEM                                 
jusched.exe                   3688 Console     4,328 K Not Responding  Ainz-PC\Ainz                                        
raysat_3dsMax2009_64serve     1296 Services    4,048 K Unknown         NT AUTHORITY\SYSTEM                                 
cmd.exe                       5400 Console     4,008 K Unknown         Ainz-PC\Ainz                                        
WTouchService.exe             1192 Services    3,904 K Unknown         NT AUTHORITY\SYSTEM                                 
hpwuschd2.exe                 3836 Console     3,640 K Running         Ainz-PC\Ainz                                        
PsiService_2.exe              1904 Services    3,584 K Unknown         NT AUTHORITY\SYSTEM                                 
AdskScSrv.exe                  468 Services    3,120 K Unknown         NT AUTHORITY\SYSTEM                                 
AAM Updates Notifier.exe      6064 Console     2,060 K Running         Ainz-PC\Ainz                                        
smss.exe                       348 Services    1,204 K Unknown         NT AUTHORITY\SYSTEM                                 
UnsignedThemesSvc.exe          492 Services    1,012 K Unknown         NT AUTHORITY\SYSTEM                                 
vbc.exe                       3272 Console       124 K Unknown         Ainz-PC\Ainz                                        
System Idle Process              0 Services       24 K Unknown         NT AUTHORITY\SYSTEM                                 
 
[/font]
```
At the time you ran the BSOD file collection app, 2.3 GB RAM in use out of 4 GB RAM total.

Change your virtual memory (page file) settings to system managed.

You have 11 Crome apps running.

Regards. . .

jcgriff2

`


----------

