Results 1 to 5 of 5
  1. #1
    New Lounger
    Join Date
    Dec 2009
    Location
    Toledo, OH
    Posts
    2
    Thanks
    0
    Thanked 0 Times in 0 Posts

    memory leak in windows 7 64-bit

    I’d really appreciate any help. My Windows 7 64-bit PC with 4 GB of RAM is essentially useless now because of its memory leak. Hours or minutes after starting, the non-paged pool slowly climbs up to 3Gb, the physical memory used goes to 95% and it becomes unresponsive.

    I have done days of extensive research, and have tried nearly everything as you'll see. None of the tasks in TaskManager have excessive memory usage of any kind. Poolmon says the non-paged pool is what is being used up by tag ExbA. This apparently belongs to the Windows kernel. I determined this from windbg.

    What I've done:
    The usual checks found nothing. I checked all the windows programs (with sfc /scannow) and ran driver verifier. I didn't find anything conclusive.
    I forced a crash to get a memory dump while the non-paged pool was increasing and analyzed the dump with windbg. Here is the result:

    Debugging Details:
    ------------------
    OVERLAPPED_MODULE: Address regions for 'hiber_iaStor' and 'hiber_iaStor.sys' overlap
    DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
    BUGCHECK_STR: 0x5C
    PROCESS_NAME: System
    CURRENT_IRQL: 0
    ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
    LAST_CONTROL_TRANSFER: from fffff800053f636a to fffff80004e78bc0
    STACK_TEXT:
    fffff880`08c3cbc8 fffff800`053f636a : 00000000`0000005c 00000000`0000010c ffffffff`c000009a 00000000`00000000 : nt!KeBugCheckEx
    fffff880`08c3cbd0 fffff800`0541adf4 : fffff880`08c3cd00 fffffa80`bca9c880 00000000`000000c1 fffffa80`bca9c880 : hal!HalpDispatchSystemStateTransition+0xea
    fffff880`08c3cc20 fffff800`04f94eb5 : 00000000`00000001 00000000`00000000 fffffa80`03a476e0 fffffa80`bca8a500 : hal!HalpDispatchPower+0x58
    fffff880`08c3cc50 fffff800`0511473a : ffffffff`fa0a1f00 fffffa80`0a0042d0 00000000`00000080 00000000`00000000 : nt!PopIrpWorker+0x3c5
    fffff880`08c3cd00 fffff800`04e698e6 : fffff880`031d4180 fffffa80`0a0042d0 fffff880`031defc0 fffff880`0169e0d9 : nt!PspSystemThreadStartup+0x5a
    fffff880`08c3cd40 00000000`00000000 : fffff880`08c3d000 fffff880`08c37000 fffff880`08c3c9a0 00000000`00000000 : nt!KxStartSystemThread+0x16

    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!PopIrpWorker+3c5
    fffff800`04f94eb5 413aee cmp bpl,r14b

    SYMBOL_STACK_INDEX: 3
    SYMBOL_NAME: nt!PopIrpWorker+3c5
    FOLLOWUP_NAME: MachineOwner
    MODULE_NAME: nt
    IMAGE_NAME: ntkrnlmp.exe
    DEBUG_FLR_IMAGE_TIMESTAMP: 53b9f073
    IMAGE_VERSION: 6.1.7601.18526
    FAILURE_BUCKET_ID: X64_0x5C_HAL_CANNOT_ALLOCATE_RESUME_STRUCTURES_nt! PopIrpWorker+3c5
    BUCKET_ID: X64_0x5C_HAL_CANNOT_ALLOCATE_RESUME_STRUCTURES_nt! PopIrpWorker+3c5
    ANALYSIS_SOURCE: KM
    FAILURE_ID_HASH_STRING: km:x64_0x5c_hal_cannot_allocate_resume_structures_ nt!popirpworker+3c5

    FAILURE_ID_HASH: {b909daf8-07a2-dda7-7aea-3ad8c715cf48}

    I'm not sure how to replicate the problem but it seems to happen if I do the following:
    1 Reboot
    2 put computer to sleep
    3 wake it back up

    The problem is getting worse and I'm at my wit's end. I'm considering reloading Windows but don't want to lose programs I've installed or any data.

    Thanks in advance,
    BWK

  2. #2
    Super Moderator bbearren's Avatar
    Join Date
    Dec 2009
    Location
    Polk County, Florida
    Posts
    3,760
    Thanks
    26
    Thanked 424 Times in 338 Posts
    Get rid of hiberfil.sys and then recreate it. Go into Control Panel > Power options and disable hibernation/sleep, (including hybrid sleep) click on Advanced and go through all the options to eliminate hibernation/sleep for everything.

    Open an elevated Command Prompt and type (without the quotes) “powercfg -h off”. Shut down. Power on, go back through power options and make certain no hibernation/sleep option is selected anywhere. Shut down. Power on, check to see if C:\hiberfil.sys is gone.

    If the hiberfil.sys file has successfully been deleted, you can re-enable hibernation by opening an elevated Command Prompt and type (without the quotes) "powercfg -h on". You can then go back into power options and set them up as you wish. See if that had any effect on your problem.
    Create a fresh drive image before making system changes, in case you need to start over!

    "The problem is not the problem. The problem is your attitude about the problem. Savvy?"—Captain Jack Sparrow "When you're troubleshooting, start with the simple and proceed to the complex."—M.O. Johns "Experience is what you get when you're looking for something else."—Sir Thomas Robert Deware.
    Unleash Windows

  3. #3
    New Lounger
    Join Date
    Dec 2009
    Location
    Toledo, OH
    Posts
    2
    Thanks
    0
    Thanked 0 Times in 0 Posts
    I have caused hiberfil.sys to be deleted as described. But my problem continues. Any ideas?

  4. #4
    Super Moderator bbearren's Avatar
    Join Date
    Dec 2009
    Location
    Polk County, Florida
    Posts
    3,760
    Thanks
    26
    Thanked 424 Times in 338 Posts
    Open an elevated Command Prompt and type (without the quotes) "DISM /Online /Cleanup-Image /RestoreHealth" and hit Enter.

    When that finishes running, reboot.
    Create a fresh drive image before making system changes, in case you need to start over!

    "The problem is not the problem. The problem is your attitude about the problem. Savvy?"—Captain Jack Sparrow "When you're troubleshooting, start with the simple and proceed to the complex."—M.O. Johns "Experience is what you get when you're looking for something else."—Sir Thomas Robert Deware.
    Unleash Windows

  5. #5
    New Lounger
    Join Date
    Jan 2015
    Posts
    1
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Hi!

    I had the same situation (Win 7 Pro 64-bit, 4Gb memory).

    After analyse with poolmon, i go to \system32\drivers\ and found driver with text "ExbA" inside - it was USBAUDIO.sys

    My system used this file in USB Camera (audio) and USB synthezator.
    After i disabled driver "USB Audio Driver (WDM)" (i made it in 3party tool (FAR manager+plugins)) i get no memory leak.

    But my audio devices not worked... Need to search driver updates...

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •