1

This question already has an answer here:

There seems to be a leak from a driver on my computer. When looking at the Memory tab of ProcessExplorer I see that the System Commit is slowly filling up to the maximum over the course of a few days. It always seems to take ~3 days to get to the 60GB of max commit charge. (My computer has 20GB of RAM and a 40GB pagefile)

processExplorer

I have traced that memory charge to something with the tag 1tfb using poolmon.

poolmon

I thought it might have been a driver so I have done a "findstr /s 1tfb" in the windows drivers folder and it does not find anything.

Actually, calling 'findstr' used to return that no results was found, right now it does not seem to ever return. It just continues working forever. I don't know if that is related or not.

On the processes side, there are no big process hogging all the memory. The total memory used by my processes total up to the Physical Memory amount.

How can I trace who's using all that memory ?

marked as duplicate by magicandre1981 windows-7 Feb 10 '17 at 16:37

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    support.microsoft.com/en-us/help/298102/… You may find that this query may not find the appropriate driver because the driver is not loaded from %SYSTEMROOT%\drivers. In this case, run more global searches such as: findstr /m /l 1tfb *.sys ...that start from %SystemRoot%, %ProgramFiles%, %SystemDrive%, %ProgramData%. – HelpingHand Feb 9 '17 at 22:46
  • 1
    Great ! That did it, the driver was loaded from SYSWOW64 instead. Didn't think of checking in there. The faulty driver was a USB blocker that I was toying with for usage at work (newsoftwares.net/usb-block/features). Guess I won't be using it after all. Thanks for the help ! You can put your comment as an answer if you want and I'll accept it. – Tristan Dubé Feb 9 '17 at 23:29
  • Great! Glad to have helped. – HelpingHand Feb 9 '17 at 23:36
2

"You may find that this query may not find the appropriate driver because the driver is not loaded from %SYSTEMROOT%\drivers. In this case, run more global searches such as:

findstr /m /l 1tfb *.sys 

...that start from %SystemRoot%, %ProgramFiles%, %SystemDrive%, %ProgramData%"

Source: https://support.microsoft.com/en-us/help/298102/how-to-find-pool-tags-that-are-used-by-third-party-drivers

Not the answer you're looking for? Browse other questions tagged or ask your own question.