Memory leak

[HDI]

Hi,

I have a windows xp pro SP2 with all updates and patches.

After 8-10 hours the computer freeses and I receive error 2019 in de
event log.

I checked task manager and the memory grows at 15MB/hour.
When I check the Proces tab I see no special memory grow.

I tried poolmon and see that the bytes of IRP and IO tags getting
higher and higher.

And what now?
What are these tags and how can I see what is using them?

Thx.

 

[=?iso-8859-1?Q?_db_=B4=AF`=B7.._=3E=3C=29=29=29=BA]

http://search.microsoft.com/results.aspx?mkt=en-US&form=MSHOME&setlang=en-US&q=error+2019+&x=14&y=11

there is some information related to
the error code at the above link.

you should see if any of them apply
to your configuration.

however, you might also try to boot
into safemode and safemode w/nw
and see if the same issue occurs
in those environments.

by comparing the performance
issues in different modes, we
may able to eliminate some
possible causes....

--

<)))º>·´¯`·.¸. , . .·´¯`·.. ><)))º>`·.¸¸.·´¯`·.¸.·´¯`·...¸><)))º>

..

 

[John John]

Hi,

I have a windows xp pro SP2 with all updates and patches.

After 8-10 hours the computer freeses and I receive error 2019 in de
event log.

I checked task manager and the memory grows at 15MB/hour.
When I check the Proces tab I see no special memory grow.

I tried poolmon and see that the bytes of IRP and IO tags getting
higher and higher.

And what now?
What are these tags and how can I see what is using them?

How do I determine a driver name from a pool tag?
http://www.jsifaq.com/SF/Tips/Tip.aspx?id=7102

John

 

[HDI]

How do I determine a driver name from a pool tag?http://www.jsifaq.com/SF/Tips/Tip.aspx?id=7102

John- Tekst uit oorspronkelijk bericht niet weergeven -

- Tekst uit oorspronkelijk bericht weergeven -

Ok, I have done this (findstr /m /l hIo *.sys and findstr /m /l hIrp
*.sys) and found for both rmcast.sys.

1. What does the h mean before the tag?
2. What now?

 

[HDI]

http://search.microsoft.com/results.aspx?mkt=en-US&form=MSHOME&setlan....

there is some information related to
the error code at the above link.

you should see if any of them apply
to your configuration.

however, you might also try to boot
into safemode and safemode w/nw
and see if the same issue occurs
in those environments.

by comparing the performance
issues in different modes, we
may able to eliminate some
possible causes....

--



.












- Tekst uit oorspronkelijk bericht weergeven -

however, you might also try to boot
into safemode and safemode w/nw
and see if the same issue occurs
in those environments.

It works perfect in safemode and safemode w/nw.

 

[John John]

Ok, I have done this (findstr /m /l hIo *.sys and findstr /m /l hIrp
*.sys) and found for both rmcast.sys.

1. What does the h mean before the tag?

It reduces the number of hits, sometimes useful on tags that are shorter
than 4 characters.
http://support.microsoft.com/kb/298102
http://search.yahoo.com/search?ei=UTF-8&fr=yfp-t-501&cop=mss&p=pooltag.txt&x=0&y=0

2. What now?

The IO/IRP leak might be elsewhere. Make sure that rmcast is in fact
being used and then find out who or what is using rmcast.sys. I think
that the leak may not be with rmcast.sys as such but that it may be with
something using it instead. Rmcast.sys is the Reliable Multicast
Protocol driver, I don't know much about this protocol and I am not sure
why you would have this running on your computer, according to
information on Technet "Windows XP does not include the Reliable
Multicast Protocol." Spyware comes to mind but it could be used by a
legit application, I just don't know enough about this protocol to give
you additional help, maybe someone else is familiar with it.

You might want to use Verifier.exe to further check on the leaky driver.
You can also use Process Explorer to see if you can find out what is
using rmcast.sys. Other tools that may be helpful in finding which
drivers are loaded are the built in MsInfo32 tool or the Windows 2000
Resource Kit Driver.exe utility. The links below might be helpful.

John

Process Explorer for Windows v10.21
http://www.microsoft.com/technet/sysinternals/Utilities/ProcessExplorer.mspx

How to Use Driver Verifier to Troubleshoot Windows Drivers
http://support.microsoft.com/kb/244617

(Drivers.exe available in the Windows 2000 Resource Kit)
http://support.microsoft.com/kb/927229

The Reliable Multicast Protocol Component of Windows Server 2003
http://www.microsoft.com/technet/community/columns/cableguy/cg0603.mspx

(See: Support for IP Multicasting section)
http://technet2.microsoft.com/windo...775f-4274-b300-5b3f76cfb46e1033.mspx?mfr=true

Microsoft Security Bulletin MS06-052
http://www.microsoft.com/technet/security/bulletin/ms06-052.mspx

http://search.yahoo.com/search?ei=U...able+Multicast+Protocol"+rmcast.sys&x=23&y=11

 

[Ron Martell]

Hi,

I have a windows xp pro SP2 with all updates and patches.

After 8-10 hours the computer freeses and I receive error 2019 in de
event log.

I checked task manager and the memory grows at 15MB/hour.
When I check the Proces tab I see no special memory grow.

I tried poolmon and see that the bytes of IRP and IO tags getting
higher and higher.

And what now?
What are these tags and how can I see what is using them?

Thx.

In the Process tab in Task Manager click twice on the "Mem Usage"
column header. That will sort the list into descending order based
on memory usage, with the highest usage items at the top. That may
show you something that is not readily apparent from an unsorted list.

What antivirus and antispysware software do you have installed? This
type of behavior is often associated with a malware infestation of
some kind. Try getting a second opinion by doing a free online scan
at one of the following sites:
Bit Defender http://www.bitdefender.com/scan8/ie.html
Trend Micro http://housecall.trendmicro.com
Kaspersky Online Scanner http://www.kaspersky.com/virusscanner
Panda ActiveScan http://www.pandasoftware.com/activescan
WindowSecurity.com TrojanScan http://windowssecurity.com/trojanscan
Webroot http://www.webroot.com/

Good luck

Ron Martell Duncan B.C. Canada
--
Microsoft MVP (1997 - 2008)
On-Line Help Computer Service
http://onlinehelp.bc.ca

"Anyone who thinks that they are too small to make a difference
has never been in bed with a mosquito."

 

[HDI]

In the Process tab in Task Manager click twice on the "Mem Usage"
column header. That will sort the list into descending order based
on memory usage, with the highest usage items at the top. That may
show you something that is not readily apparent from an unsorted list.

What antivirus and antispysware software do you have installed? This
type of behavior is often associated with a malware infestation of
some kind. Try getting a second opinion by doing a free online scan
at one of the following sites:
Bit Defender http://www.bitdefender.com/scan8/ie.html
Trend Microhttp://housecall.trendmicro.com
Kaspersky Online Scannerhttp://www.kaspersky.com/virusscanner
Panda ActiveScanhttp://www.pandasoftware.com/activescan
WindowSecurity.com TrojanScanhttp://windowssecurity.com/trojanscan
Webroothttp://www.webroot.com/

Good luck

Ron Martell Duncan B.C. Canada
--
Microsoft MVP (1997 - 2008)
On-Line Help Computer Servicehttp://onlinehelp.bc.ca

"Anyone who thinks that they are too small to make a difference
has never been in bed with a mosquito."- Tekst uit oorspronkelijk bericht niet weergeven -

- Tekst uit oorspronkelijk bericht weergeven -

Ok, thanks all.

I found it, some old never used software service.

 

[John John]

Ok, thanks all.

I found it, some old never used software service.

And what was that "old never used software service"?

John

 

[HDI]

And what was that "old never used software service"?

John



- Tekst uit oorspronkelijk bericht niet weergeven -

- Tekst uit oorspronkelijk bericht weergeven -- Tekst uit oorspronkelijk bericht niet weergeven -

- Tekst uit oorspronkelijk bericht weergeven -

A computer report program.