1

There seems to be a leak from a driver on my computer. When looking at the Memory tab of ProcessExplorer I see that the System Commit is slowly filling up to the maximum over the course of a few days. It always seems to take ~3 days to get to the 60GB of max commit charge. (My computer has 20GB of RAM and a 40GB pagefile)

processExplorer

I have traced that memory charge to something with the tag 1tfb using poolmon.

poolmon

I thought it might have been a driver so I have done a "findstr /s 1tfb" in the windows drivers folder and it does not find anything.

Actually, calling 'findstr' used to return that no results was found, right now it does not seem to ever return. It just continues working forever. I don't know if that is related or not.

On the processes side, there are no big process hogging all the memory. The total memory used by my processes total up to the Physical Memory amount.

How can I trace who's using all that memory ?

Improve this question
3
  • 1
    support.microsoft.com/en-us/help/298102/… You may find that this query may not find the appropriate driver because the driver is not loaded from %SYSTEMROOT%\drivers. In this case, run more global searches such as: findstr /m /l 1tfb *.sys ...that start from %SystemRoot%, %ProgramFiles%, %SystemDrive%, %ProgramData%.
    – HelpingHand
    Feb 9, 2017 at 22:46
  • 1
    Great ! That did it, the driver was loaded from SYSWOW64 instead. Didn't think of checking in there. The faulty driver was a USB blocker that I was toying with for usage at work (newsoftwares.net/usb-block/features). Guess I won't be using it after all. Thanks for the help ! You can put your comment as an answer if you want and I'll accept it.
    – Tristan Dubé
    Feb 9, 2017 at 23:29
  • Great! Glad to have helped.
    – HelpingHand
    Feb 9, 2017 at 23:36

1 Answer 1

Reset to default
2

"You may find that this query may not find the appropriate driver because the driver is not loaded from %SYSTEMROOT%\drivers. In this case, run more global searches such as: 

findstr /m /l 1tfb *.sys

...that start from %SystemRoot%, %ProgramFiles%, %SystemDrive%, %ProgramData%"

Source: https://support.microsoft.com/en-us/help/298102/how-to-find-pool-tags-that-are-used-by-third-party-drivers

Improve this answer

Not the answer you're looking for? Browse other questions tagged .