[Help]Memory Leak. All memory drained and used

cinos11 · 24 May 2010

Today, my computer decided for some reason to start hogging all the memory.
The memory slowly goes up after around 3:30 minutes of being open.
CPU usage is at regular.

I have tried many things to fiqure out the problem.
Not even safe mode works.
Also it's very weird because i have 6gb of memory and its on max used.
Even disabling the internet doesn't change a thing.

Please help find the soulution.
There is nothing right now that will make it go down.
I have uploaded a picture showing how the memory goes up.

usasma · 27 May 2010

Please open up Task Manager to the Processes tab
Click on the "Memory (Private Working Set)" column header (to sort that column).
What is the Image name of the top user of memory (and is it much greater than the other entries)?

cinos11 · 28 May 2010

usasma said:

Please open up Task Manager to the Processes tab
Click on the "Memory (Private Working Set)" column header (to sort that column).
What is the Image name of the top user of memory (and is it much greater than the other entries)?

Currently its firefox, digsby, then skype.
But those aren't the reasons it goes up, as when they aren't open my memory still maxes out.
I've still narrowed it down using the Resource Monitor that what is causing it is "svchost.exe (secsvc)" if i end the process the memory drops back to normal then goes back up. The 2nd~3rd time i end it then the process will no longer come back up.

Do you know why this process is causing this?

usasma · 28 May 2010

I don't know, but one possibility is an infection. AFAIK there's no "secsvc" in Windows - although there is a "secsvcs" - that's the service name for Windows Defender when running under svchost.exe

Download and install this free program from Microsoft: Process Explorer
Locate the PID of the svchost.exe process that's sucking up all the memory (in your Resource Monitor)

Then open up the new program (named Process Explorer) and hover the mouse over the instance of svchost.exe with the same PID. Let us know what it says.

Then, right click on the svchost.exe process and select Properties.
Then select the Threads tab
In the Threads tab, let us know the Start Address (everything before the !) for anything that shows a number under Cycles Delta

cinos11 · 29 May 2010

usasma said:

I don't know, but one possibility is an infection. AFAIK there's no "secsvc" in Windows - although there is a "secsvcs" - that's the service name for Windows Defender when running under svchost.exe

Download and install this free program from Microsoft: Process Explorer
Locate the PID of the svchost.exe process that's sucking up all the memory (in your Resource Monitor)

Then open up the new program (named Process Explorer) and hover the mouse over the instance of svchost.exe with the same PID. Let us know what it says.

Then, right click on the svchost.exe process and select Properties.
Then select the Threads tab
In the Threads tab, let us know the Start Address (everything before the !) for anything that shows a number under Cycles Delta

Yes, i meant secsvcs.
It's the same in the picture provided and here the things requested:
As for the svchost.exe which is svshost.exe (Secsvcs)
i don't know which to choose, as there is multiple svchost's
which should i choose for properties?

EDIT: okay i found the correct svshost for the thing you requested:
Under cswitch Delta there is:

The start address says ntdll.dll which is before the !
that same dll shows for everything except for one that says 0x0
only a few CSwitch Delta's randomly shows numbers if that helps any also.

usasma · 29 May 2010

Can you post a screenshot of the one that says 0x0?

If that doesn't suggest something to me, then we'll have to try a different way of isolating the problem.

Please run a couple of the scans at this page to ensure that your current protection hasn't been hijacked: Malware (read the details at the link)

If that rules out an infection, then we'll have to start with clean boot troubleshooting: How to Troubleshoot a Problem by Performing a Clean Startup in Windows 7 or Vista

cinos11 · 30 May 2010

usasma said:

Can you post a screenshot of the one that says 0x0?

If that doesn't suggest something to me, then we'll have to try a different way of isolating the problem.

Please run a couple of the scans at this page to ensure that your current protection hasn't been hijacked: Malware (read the details at the link)

If that rules out an infection, then we'll have to start with clean boot troubleshooting: How to Troubleshoot a Problem by Performing a Clean Startup in Windows 7 or Vista

I won't need to try the above scans.
I've tried using Nod32, and anti-malware bytes.
I've also tried booting in safe mode with minimal ticked.

The 0x0 has no useful information to show, as if i remember correctly it was in the section where you wanted the name of that dll before the !

If it helps any, i think i remembering updating windows defender around the time this started. But i also remember doing other stuff that could of caused this.

baarod · 30 May 2010

cinos11 said:

usasma said:

Can you post a screenshot of the one that says 0x0?

If that doesn't suggest something to me, then we'll have to try a different way of isolating the problem.

Please run a couple of the scans at this page to ensure that your current protection hasn't been hijacked: Malware (read the details at the link)

If that rules out an infection, then we'll have to start with clean boot troubleshooting: How to Troubleshoot a Problem by Performing a Clean Startup in Windows 7 or Vista

I won't need to try the above scans.
I've tried using Nod32, and anti-malware bytes.
I've also tried booting in safe mode with minimal ticked.

The 0x0 has no useful information to show, as if i remember correctly it was in the section where you wanted the name of that dll before the !

If it helps any, i think i remembering updating windows defender around the time this started. But i also remember doing other stuff that could of caused this.

Replace defender with MSSE. If that doesn't help simply uninstall it. http://www.microsoft.com/security_essentials/

cinos11 · 30 May 2010

Okay, i got the picture of you requested.

usasma · 30 May 2010

I agree with baarod - install MSSE. But remove any other antivirus first.

But, if you still want to look further into this, please left click on each of the items that have numbers in the Cycles Delta column, then click on the "Stack" button. Post the screenshot of each in your next post.