[Help]Memory Leak. All memory drained and used

[cinos11]

Today, my computer decided for some reason to start hogging all the memory.
The memory slowly goes up after around 3:30 minutes of being open.
CPU usage is at regular.

I have tried many things to fiqure out the problem.
Not even safe mode works.
Also it's very weird because i have 6gb of memory and its on max used.
Even disabling the internet doesn't change a thing.


Please help find the soulution.
There is nothing right now that will make it go down.
I have uploaded a picture showing how the memory goes up.

 

[usasma]

Please open up Task Manager to the Processes tab
Click on the "Memory (Private Working Set)" column header (to sort that column).
What is the Image name of the top user of memory (and is it much greater than the other entries)?

 

[cinos11]

Please open up Task Manager to the Processes tab
Click on the "Memory (Private Working Set)" column header (to sort that column).
What is the Image name of the top user of memory (and is it much greater than the other entries)?

Currently its firefox, digsby, then skype.
But those aren't the reasons it goes up, as when they aren't open my memory still maxes out.
I've still narrowed it down using the Resource Monitor that what is causing it is "svchost.exe (secsvc)" if i end the process the memory drops back to normal then goes back up. The 2nd~3rd time i end it then the process will no longer come back up.

Do you know why this process is causing this?

 

[usasma]

I don't know, but one possibility is an infection. AFAIK there's no "secsvc" in Windows - although there is a "secsvcs" - that's the service name for Windows Defender when running under svchost.exe

Download and install this free program from Microsoft: Process Explorer
Locate the PID of the svchost.exe process that's sucking up all the memory (in your Resource Monitor)

Then open up the new program (named Process Explorer) and hover the mouse over the instance of svchost.exe with the same PID. Let us know what it says.

Then, right click on the svchost.exe process and select Properties.
Then select the Threads tab
In the Threads tab, let us know the Start Address (everything before the !) for anything that shows a number under Cycles Delta

 

[cinos11]

I don't know, but one possibility is an infection. AFAIK there's no "secsvc" in Windows - although there is a "secsvcs" - that's the service name for Windows Defender when running under svchost.exe

Download and install this free program from Microsoft: Process Explorer
Locate the PID of the svchost.exe process that's sucking up all the memory (in your Resource Monitor)

Then open up the new program (named Process Explorer) and hover the mouse over the instance of svchost.exe with the same PID. Let us know what it says.

Then, right click on the svchost.exe process and select Properties.
Then select the Threads tab
In the Threads tab, let us know the Start Address (everything before the !) for anything that shows a number under Cycles Delta

Yes, i meant secsvcs.
It's the same in the picture provided and here the things requested:
As for the svchost.exe which is svshost.exe (Secsvcs)
i don't know which to choose, as there is multiple svchost's
which should i choose for properties?

EDIT: okay i found the correct svshost for the thing you requested:
Under cswitch Delta there is:

The start address says ntdll.dll which is before the !
that same dll shows for everything except for one that says 0x0
only a few CSwitch Delta's randomly shows numbers if that helps any also.

 

[usasma]

Can you post a screenshot of the one that says 0x0?

If that doesn't suggest something to me, then we'll have to try a different way of isolating the problem.

Please run a couple of the scans at this page to ensure that your current protection hasn't been hijacked: Malware (read the details at the link)

If that rules out an infection, then we'll have to start with clean boot troubleshooting: How to Troubleshoot a Problem by Performing a Clean Startup in Windows 7 or Vista

 

[cinos11]

Can you post a screenshot of the one that says 0x0?

If that doesn't suggest something to me, then we'll have to try a different way of isolating the problem.

Please run a couple of the scans at this page to ensure that your current protection hasn't been hijacked: Malware (read the details at the link)

If that rules out an infection, then we'll have to start with clean boot troubleshooting: How to Troubleshoot a Problem by Performing a Clean Startup in Windows 7 or Vista

I won't need to try the above scans.
I've tried using Nod32, and anti-malware bytes.
I've also tried booting in safe mode with minimal ticked.

The 0x0 has no useful information to show, as if i remember correctly it was in the section where you wanted the name of that dll before the !

If it helps any, i think i remembering updating windows defender around the time this started. But i also remember doing other stuff that could of caused this.

 

[baarod]

Can you post a screenshot of the one that says 0x0?

If that doesn't suggest something to me, then we'll have to try a different way of isolating the problem.

Please run a couple of the scans at this page to ensure that your current protection hasn't been hijacked: Malware (read the details at the link)

If that rules out an infection, then we'll have to start with clean boot troubleshooting: How to Troubleshoot a Problem by Performing a Clean Startup in Windows 7 or Vista

I won't need to try the above scans.
I've tried using Nod32, and anti-malware bytes.
I've also tried booting in safe mode with minimal ticked.

The 0x0 has no useful information to show, as if i remember correctly it was in the section where you wanted the name of that dll before the !

If it helps any, i think i remembering updating windows defender around the time this started. But i also remember doing other stuff that could of caused this.

Replace defender with MSSE. If that doesn't help simply uninstall it. http://www.microsoft.com/security_essentials/

 

[cinos11]

Okay, i got the picture of you requested.

 

[usasma]

I agree with baarod - install MSSE. But remove any other antivirus first.

But, if you still want to look further into this, please left click on each of the items that have numbers in the Cycles Delta column, then click on the "Stack" button. Post the screenshot of each in your next post.

 

[cinos11]

I agree with baarod - install MSSE. But remove any other antivirus first.

But, if you still want to look further into this, please left click on each of the items that have numbers in the Cycles Delta column, then click on the "Stack" button. Post the screenshot of each in your next post.

Here are the pictures.
Also do you think i should disable windows defender and then install MSSE while having Nod32 and MSSE running both at the same time?

 

[usasma]

DO NOT run 2 antivirus (or 2 firewalls) at the same time. It will slow your system down and may even let viruses in.

Uninstall NOD32, then install MSSE. If, after we're done troubleshooting, you want to reinstall NOD32 you can go ahead and do it.

Installing MSSE should disable Windows Defender. On my system Windows Defender is set to start Manually - and is not started (I have MSSE installed).

Sorry, but the stack pictures don't provide any new info. I really think that having MSSE installed will make the Windows Defender problem go away - but the only way to be sure is to try it.

 

[cinos11]

DO NOT run 2 antivirus (or 2 firewalls) at the same time. It will slow your system down and may even let viruses in.

Uninstall NOD32, then install MSSE. If, after we're done troubleshooting, you want to reinstall NOD32 you can go ahead and do it.

Installing MSSE should disable Windows Defender. On my system Windows Defender is set to start Manually - and is not started (I have MSSE installed).

Sorry, but the stack pictures don't provide any new info. I really think that having MSSE installed will make the Windows Defender problem go away - but the only way to be sure is to try it.

I installed MSSE without uninstalling nod32, but disabled the real-time protection on MSSE. It seems when i started the computer i no longer have the problem since MSSE disabled windows defender when it was installed.

One of my last few questions would be is Nod32 good enough with the anti-spyware
protection it already has. Because now that windows defender has been disabled i no longer have that 2nd anti-spyware open. Which leads to the 2nd question:

Is it possible to disable the anti-virus real-time protection on MSSE and only have anti-spyware real-time protection, so that way i can still have both of them running?

 

[jcgriff2]

Windows Defender comes installed in Windows 7.

On this system, I use ESET NOD32, Windows Defender, Windows Firewall.

Uninstall MSE. Then update Windows Defender definitions -
START | type win def

Or go to Windows Defender site --> https://www.microsoft.com/security/portal/Definitions/HowToWD.aspx

Regards. . .

jcgriff2

.

 

[cinos11]

Windows Defender comes installed in Windows 7.

On this system, I use ESET NOD32, Windows Defender, Windows Firewall.

Uninstall MSE. Then update Windows Defender definitions -
START | type win def

Or go to Windows Defender site --> https://www.microsoft.com/security/portal/Definitions/HowToWD.aspx

Regards. . .

jcgriff2

.

Did you not read my posts?
The whole reason i can't use windows defender is because it has a memory leak.
And then your telling me to use it again...

 

[usasma]

Wait for a month. After the next cycle of Windows Updates see if you can go back to the way things were.
If not, seek help from Windows Defender experts (I'm not one).

 

[jcgriff2]

Is it possible to disable the anti-virus real-time protection on MSSE and only have anti-spyware real-time protection

MSE employs Microsoft anti-malware, aka, Windows Defender.

 

[cinos11]

Is it possible to disable the anti-virus real-time protection on MSSE and only have anti-spyware real-time protection

MSE employs Microsoft anti-malware, aka, Windows Defender.

I thought it was anti-spyware not anti-malware in windows defender

 

[usasma]

You say potatoe - I say potahto
It's all in how you define it -there's considerable overlap in any of the definitions.

 

[cinos11]

You say potatoe - I say potahto
It's all in how you define it -there's considerable overlap in any of the definitions.

Okay, well though should i still run MSE open on real-time protection while having nod32 open at the same time with real-time protections.

Since they both also have anti-spyware/virus