Recently I have noticed that Windows OS takes 5GB while start up and during works with other programs it reaches 8GB. The memory (RAM) not freeing up, even after closing all running programs.

enter image description here

What is the cause, and how can I fix it?

  • Why should the memory free up? That would be wasteful. It is much better if the OS keeps it in use (e.g. with a cache of the old program which you just closed). As long as it can free it quickly when needed there is no reason to free it before that time, and plenty of reasons not to do so.
    – Hennes
    Apr 3, 2016 at 19:11
  • I cannot run other programs
    – Mirodil
    Apr 3, 2016 at 19:23

2 Answers 2


You have a memory leak caused by a driver. Look at the high value of nonpaged kernel memory (4.8 GB in your case). In your case this is over 1 GB. You can use poolmon to see which driver is causing the high usage.

Install the Windows WDK, run poolmon, sort it via P after pool type so that non paged is on top and via B after bytes to see the tag which uses most memory.

Now look which pooltag uses most memory as shown here:

enter image description here

Now open a cmd prompt and run the findstr command to see which driver uses this tag:

enter image description here

Now go to the drivers folder (C:\Windows\System32\drivers) and right-click the driver in question (intmsd.sys in the above image example). Click Properties, go to the details tab to find the Product Name. Look for an update for that product.

If the pooltag only shows Windows drivers or is listed in the pooltag.txt ("C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\triage\pooltag.txt") you have use xperf to trace what causes the usage. Install the WPT from the Windows SDK, open a cmd.exe as admin and run this:

xperf -on PROC_THREAD+LOADER+POOL -stackwalk PoolAlloc+PoolFree+PoolAllocSession+PoolFreeSession -BufferSize 2048 -MaxFile 1024 -FileMode Circular && timeout -1 && xperf -d C:\pool.etl

capture 30 -60s of the grow. Open the ETL with WPA.exe, add the Pool graphs to the analysis pane.

Put the pooltag column at first place and add the stack column. Now load the symbols inside WPA.exe and expand the stack of the tag that you saw in poolmon.

enter image description here

Now find other 3rd party drivers which you can see in the stack. Here the Thre tag (Thread) is used by AVKCl.exe from G-Data. Look for driver/program updates to fix it.


There is a feature called superfetch started from Windows Vista to give all the extra ram something to do. Programs you use often will get cached so they load faster. The task manager/resource monitor output is not always perfect, but it should not cause any harm.

  • I cannot run other programs, because of there no free memory, for exmaple VMware
    – Mirodil
    Apr 3, 2016 at 19:26
  • this has nothing to do with superfetch. He has a driver memory leak Apr 4, 2016 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.