Sunday, 4 September 2016

Driver memory leak

An issue I've not before, machine starts to stutter, checking task manager memory usage is pinned at 99%. Sorting the processes by usage nothing untoward is shown. In the users tab it showed 4 gig for my user, so at least I knew it wasn't a process that belonged to me.

Informative posts that helped get to the bottom of it, 
Poolmon allowed me to see which processes where using the memory.

picture of text showing process NDNB trying to use 17 gig of ram

The big numbers in the seventh column point to NDNB. In cmd change the working directory to C:\Windows\System32\drivers and using find,
findstr /s NDNB. Resulting in a lot of garbage text with NDU.sys in the middle.

Solution from tomshardware

SOLUTION:
Windows Network Data Usage Monitoring Driver - Windows 8 Service

This service provides network data usage monitoring functionality.
This service exists in Windows 8 only.
Startup Type

Windows 8 edition without SP
Core Automatic
Professional Automatic
Enterprise Automatic
Default Properties

Display name: Windows Network Data Usage Monitoring Driver
Service name: Ndu
Type: kernel
Path: %WinDir%\system32\drivers\Ndu.sys
Error control: normal

Default Behavior

The Windows Network Data Usage Monitoring Driver service is a kernel mode driver. If the Windows Network Data Usage Monitoring Driver fails to start, the error is logged. Windows 8 startup proceeds, but a message box is displayed informing you that the Ndu service has failed to start.

To Fix Memory Leaks on Non-Paged-Pool:
Changed the registry value instead of using Autoruns:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ndu

Change the Start value to 4 (for disable).


The only other issues I can see that are related to the memory leak are killer network drivers. Multiple reboots did not fix the issue. 

No comments:

Post a Comment