Windows 10: Extreme Non paged memory usage on windows 10

Hello everyone,I'm looking for a solution to fix the 20+GB non paged memory usage in Windows 10. I follow the guide what you can read on StackExchange/Superuser.Memory:67014784K Avail:21094036K PageFlts:226108 InRam Krnl:15340K P:6250068K Commit:123381596K Limit:159684792K Peak:153907544K Pool N:22401880K P:7611364K Tag Type Allocs Frees Diff Bytes Per Alloc Even Nonp 468594745 2982 316020338 1867 152574407 19529540192 142720 128 MmSt Paged 595936455 6747 595302774 5836 633681 2030382960 -420320

:)

 

Large amount of Paged Pool memory usage over time

I have been fighting with this for some time and I can't figure out what it is. Over time, my Paged Pool memory usage keeps climbing until eventually I have to reboot to clear it out. It is a tough problem to search for because most people seem to have a problem with non-paged pool memory and all of those problems get included in the search results.

I have 32GB of RAM and once the paged pool reaches around 18GB or so it starts to bog down and get sluggish. And when I say 18GB, I mean 18GB with nothing open. I have my typical tray stuff, which I have tried killing, but nothing releases the RAM. I have let it climb all the way to 32GB before, but then the computer becomes useless and took about a half hour or so to shut down.

When I run Rammap it shows that paged pool is huge, and in the process list there is a process called MemCompression that has an extremely large amount of RAM in use. Not the full size of the paged pool, but definitely really big.

There are several threads talking about using Poolmon to track down processes using lots of paged or non-paged pool memory, but the process on mine that is extremely large has a tag of Se, which is tough to search for in the strings because virtually every file has Se in it somewhere.

Right now I just rebooted again, so the usage is back to "normal" (if you consider 11GB memory in use normal for just having Chrome open) and my paged pool is around 2GB or so. It will increase again by this evening, so I will get some screen grabs of the Rammap and the process list. Any other screens I can grab that might help?

 

How is this memory usage even possible?

The Paged pool and Non paged pool usage values are high, particularly the latter. On my 8 GB Windows 10 system they are 300 MB and 167 MB but these can vary on different systems and over time. Not all of the Paged pool will be in RAM but typically a large part will be. There is no way to tell from Task Manager how much. All of the Non paged pool will be in RAM and that is particularly concerning. These pools are used primarily by device drivers and the kernel itself. Very little will be by processes.

As for the memory usage displayed in the process listing. This is not full process usage which will typically be considerably higher. And there are substantial users of memory that are not processes. For that reason the process list is often of limited value in diagnosing high memory usage. And there are other substantial users of memory as well.

Once you have had a malware infection you van never be 100% certain is has been completely removed. This applies even for an expert with physical access to the computer and has spent much time with it. In many cases the only way to be completely free of malware is a clean install of the OS and all applications.

 

Memory leak (usage gradually increases)

Memory usage in Windows is by no means confined to processes. There is the Non-paged pool, the resident portion of the Paged pool, the file cache (quite different from the "Cached" value shown in Task Manager) and more. Most of this is not itemized in Task Manager at all.

The Non-paged pool usage is very real memory usage. And in fact a high value here is far more serious than is process usage. Almost all process memory usage is pageable. This memory can be removed from RAM to the pagefile or elsewhere thus making it available it for more important uses. Windows memory manager has almost complete control over this. Under memory pressure the usage of processes will be reduced to meet the demand, drastically if necessary.

Not so with the Non-paged pool. All of this must remain in RAM at all times, even in the event of extreme memory pressure. The memory manager has no control over it. The only limit on it's size imposed by the OS is 75% of RAM size or 128 GB, whichever is less.

When memory usage is abnormally high it is very often caused by the Non-paged pool. From what I have seen on this and other forums it seems to be more often than not. Other than the OS itself the biggest user of the Non-paged pool is device drivers. Unfortunately this can be difficult to diagnose. Process usage of the pool is usually quite trivial, rarely more than a few hundred KB for an individual process. 1 MB would be very high. This can be shown in Task Manager but by default it is not.