Pool memory depletion Toke SeTd Proc

[MWimmer]

I have a paged pool memory leak in Toke and SeTd tag and a non-paged pool
memory leak in Proc and SeTd tag every time when I start a new process

OS: Microsoft Windows XP Professional x64 Edition

poolmon:
Tag Type Allocs Frees Diff Bytes

Toke Paged 926942 ( 6) 883109 ( 6) 43833 51351296
SeTd Nonp 926942 ( 6) 883109 ( 6) 43833 5610624
SeTd Paged 926942 ( 6) 883109 ( 6) 43833 4888608
Proc Nonp 43533 ( 0) 1 ( 0) 43532 45969792


The problem is quite easy to reproduce:

FOR /L %%c IN (0,1,32000) DO attrib.exe %SystemRoot%\system32\attrib.exe

I've read already about how to find out which driver might consume pool
memory but I could not find any.

If I use the performance monitor to display the number of running processes
the number increases only. Terminating processes do not decrement the counter.

windbg also still shows the terminated processes but not the task manager.

So it seems, someone is still holding references on process objects, which
are not cleared, even if the process terminates.

I appreciate any kind of help or hint how to stop this behavior.

 

[Y3LL0H]

The same error occurs at my place.
I'm running Windows 2003 R2 X64 with 32 GB of RAM. Using WinSSHD batch jobs
are running on the machine. After a couple of days the machine has no
resources anymore (Event ID 333). PoolMon reports a huge amount of alloc
procs ( 1 freed) and just as much SeTD ( paged and non paged) and Toke .
Please give me a hint where to look for the leak ....

 

[MWimmer]

Luckily I found the guilty!
In my case the Aladdin HASP key driver caused the problem.
I also heard a lot of display drivers probably causing this kind of problem.
Hope you will solve your problem.

 

[Y3LL0H]

Hi,

you completely right, at my case it was also the Alladin HASP driver. We
used the latest Alladin drivers from their site and the leak is gone.

The fact we now have a problem the latest driver does not recognize the
dongle is a new one, but not relevant for this discussion.

thanks for thinking with me!!!