explorer.exe using most of my RAM

Can you upload it to a file hoster? The screenshots are OK, but they're not conclusive and I'd like to poke around at the actual data.

So, it looks like you may have been correct - the Macrium image file in question is indeed being mapped directly into memory:



As to why, no running process is specifically doing it (as you had seen), including explorer. That leaves the system cache, or a filter driver. Give me some time to see what I can dig up, but in the meantime you probably want to try and reproduce the issue without any antivirus/antispyware applications installed (not disabled - we need the drivers themselves removed, and that requires complete removal), and you might also want to run shellexview and disable any non-Microsoft shell extensions to make sure those aren't in play here (they shouldn't be, but it is possible). Assuming you've done the above and it reproduces, that leaves the system cache as the culprit (and it is possible for it to do this).

I'll have to go back to my notes to see if there is a way (I believe there is) to "tweak" or tune the system cache so it doesn't do this. There can be a performance detriment when copying large files by doing this, but it is better than locked RAM if this is the case. If you can try the above and see if it reproduces, and post back, I'll get on the system cache info.

Same behavior with all non-Microsoft shell extensions disabled. The RAMMap file can be found in: https://rapidshare.com/files/1153131866/RAMMap2.zip

I do have some other additional information to add. It turns out if I run Verifier on any non-Microsoft driver, the RAM usage drops in half. Not sure whether to attribute that to Verifier running since it does change how the system behaves, or could it be some driver causing a memory leak/high memory usage?

Oh, and I should mention I am running Verifier with just Standard settings checked for custom settings.

My next question is, what are the exact repro steps? I am potentially going to be building the dyncache service from the source for this, but it's not showing as metafile (it's showing as mapped file, which is slightly different). Is the file copy being done by Windows Explorer, or a 3rd party application? It's important.

OK, I'm building DynCache now - give me some time to verify once it's built, and I'll send it to you privately.

Alright. I really appreciate your time and your help on this one, cluberti. :)

Just as an FYI: Download: Microsoft Windows Dynamic Cache Service - Microsoft Download Center - Download Details is supposed to resolve the problem, as well. Not sure if it works for 7 since it is not listed.

Turns out the Microsoft DynService fix does not work with Windows 7.

Code:

The Dynamic Cache Service service terminated with the following error: 
The specified program was written for an earlier version of Windows.

I'll await your version. Again, I REALLY appreciate you taking the time to do this.

OK, I have a version that loads and works on Windows 7. If you're interested, I can PM you a link for download and installation instructions.