Windows XP problem with system resources

[Vlk]

Taikonaut, why do you think the paged pool is being leaked? 37MB sounds like a very reasonable value to me... Just to make things little clearer: the paged pool, together with the non-paged pool, is basically the memory allocated by device drivers. avast indeed has a couple of device drivers, and uses some memory from these pools, but not excessive amounts (normally less then 1 megabyte).

Dave50, I'm still lil' confused: are you saying that
- if you install clean XP (no SP's) and avast, everything's OK
- if you install all the critical updates and SP1 on that machine (that is, just the Critical Updates, e.g. using the Windows Update tool), it starts to leak? If so, this sounds like something we should be able to simulate in our labs... BTW what's the best way to demonstrate the leak (ie. to bring the machine down), according to your experience?

Thanks
Vlk (from Redmond

Vlk

[Dave50]

Vlk -- yes.  If I clean install Windows XP and leave all Windows Updates off the computer, avast works fine and the computer performs perfectly.  If I then download Windows Updates (SP1 and critical updates), the computer works fine for 3-5 hours and then it starts slowing down dramatically and eventually applications start hanging.  If I uninstall avast, problem is cured.  If I leave Windows Updates off, problem doesn't happen.
There are no signs of anything wrong other than the slowdown until the application hanging errors appear.
Problem is, Vlk, this doesn't happen on everyone's computer.  I have friends who have the same machine I do, they use avast, and have no trouble with Windows Update.  This is why Dell and HP are telling some people to ignore Windows Updates -- they don't know why it happens either and rather than try to find out what's going on, they feel ignoring the updates is the easiest solution.

Dave

[Vlk]

I have friends who have the same machine I do

You mean exactly the same make or just equivalent parameters?
What machine do you have anyway? Is it a big brand computer or a little-known maker? Or even home-built puter?

Thanks
Vlk

[bbfi]

Hi Vlk,

Here is some more info about my system and software I have runned in the past and now.

Hardware presently -  
 1 ) emachine T4150 with VC31 motherboard, Pentium 4 - 1.5 GHz, and 512mb
 2 ) ATI radeon 7000 series AGP 2x/4x with 64mb video card
 3 ) ATI-TV Wonder card
 4 ) Brother MFC 9200C Multifunction Printer, Copier, Scanner, Fax

Software running at all times presently -
 1 ) Win XP (5.1.2600) SP1
 2 ) IE Shell 6.0.2800.1106
 3 ) True Launch Bar 2.2.0.9 and Start Killer
 4 ) MyIE2 0.8.2126 Browser
 5 ) SpamPal 1.52
 6 ) PopTray 3.0
 7 ) Zone Alarm Firewall 3.7.211
 8 ) Cacheman 5.5
 9 ) SaverNow 2.4
10 ) Webshots
11 ) WinPatrol 6.0
12 ) Clipomatic
13 ) CookieWall
14 ) WordWeb
15 ) PTBSync
16 ) FinePrint 2000
17 ) BrmfRsmg.exe for Brother 9200C
18 ) Directory Opus 6.2.5.10
19 ) AVG 6.0

System Hardware in Past -
In the past I was using a NVidia video card with 32mb with the same problem occurring.

I have tried Outpost 1.0 and Sygate 5.0 and 5.1 firewalls at different times with the same problem occurring.

When I did my tests which finally showed that avast might be a trigger, I only ran the following applications -
 1 ) Outpost 1.0 firewall
 2 ) Avast 4.1
 3 ) spamilihator
 4 ) FinePrint 2000
 5 ) BrmfRsmg.exe for Brother 9200C

It didn't make any difference if I ran the minimum amount of applications or all of the above ones I use presently but with Avast instead of AVG 6.0.  After 4 to 6 hours, my problems began as Dave50 explained also.  For some reason Taikonaut was able to last for a few days before his problems occurred.  


Hi Dave50,

I already did one reinstall of Win XP and tried using Avast, but I don't remember if I did all the Microsoft updates before or after seeing the problems with using avast.  And I don't feel like doing it again.  It was a real time waster for me.  

[Dave50]

Vlk -- my computer is an HP Pavilion 760N, XP home (I currently have SP1 and all critical updates installed).  I've got 512mb ram, a Pentium-4 1.8 ghz processor.  I've got a 120gb hard drive with 99.48gb available.

Two of my friends have the exact same machine and none of us have any unusual programs added to the computers.  Two other friends have HP Pavilions, different models, one additional friend has a Dell Dimension 2100.

All are using avast and love it.  Of the people who have my model machine, one works with avast and Windows Updates, the other has the slowdown problem after a few hours.  The two other HP's which are different models both have the slowdown problem if they install Windows Updates.  The Dell also has the same problem.

In all cases, once the slowdown is noticed, a reboot resolves it for a few hours and then it happens again.
Like I said earlier, a clean install of XP without Windows Updates -- no slowdown.

I am aware of a similar issue regarding Windows Updates and Norton 2003 and 2004, and even with
AVG-6 Free.  So, I don't think the problem is avast .  For some reason, some computers have problems with the updates and others don't.  Earlier in this thread, Technical reports a problem as well but I don't know what machine he's using.

Dave

[Vlk]

Thanks for the system info. I'll try to get a similar machine for testing (our QA guys wanted some new metal anyway

So, I don't think the problem is avast .

Maybe not, but if it happens only if avast is installed we must face it.

Thanks for your help
Vlk (still in MS campus)

[Dave50]

Vlk -- thanks for all of your help and my appreciation to the entire avast team!  If you can solve this one,
Bill Gates should give you an award.

Dave

[Lisandro]

Well, in my case the leak happened only in Kernel Memory Paged Pool (Memory->Pool Paged Bytes in PerfMon) and none of the processes showed any sign of leaking. I'll post also a pic of what pool i'm just talking about, I mean MS calls the same type of memory with different names in different places (VM and Private bytes etc.).

When it comes to memory logging, then at least WinXP Pro has quite nice tools for that. You should look at Control Panel -> Administrative Tools -> Performance (or Run:"perfmon") from there you can set it to log hundreds of things.

Thank you very much, Taikonaut  
Sometimes we already have the 'thing' in our system but just do not use it...
I'll try to configurate the logs and see what I get.
Again, thank you. For other users, which can start Task Manager in these situations, I suggest Process Explorer from SysInternals. There is an option (column) called 'Peak Working Set' which stores the maximum level of resources utilization.

Today I had a 'freeze': after an Hibernation, Power on, 3 or 4 hours of utilization... Keyboard and monitor answers become lazy... too lazy... I shut down avast residents completely. Nothing went better... I shut down ZA, nothing... I have to restart. Now, everything ok. But I want to log the system resources to see what is going on  

[Taikonaut]

Taikonaut, why do you think the paged pool is being leaked? 37MB sounds like a very reasonable value to me... Just to make things little clearer: the paged pool, together with the non-paged pool, is basically the memory allocated by device drivers. avast indeed has a couple of device drivers, and uses some memory from these pools, but not excessive amounts (normally less then 1 megabyte).

You are right, around 40MB (sorry for not stating it clearly but the pic was taken without avas!) seems to be a normal value for my configuration (as I also stated in my first post), but with avast running I have 80MB after 2 days and it keeps rising at a rate of around 1MB/h (I'm attaching a pic of this also).

I have done now some more digging and I believe that I have found the source of the leak in my comp. I used PoolTag from www.osr.com to obtain the following data (its taken after 1 day and 22 hours of uptime):

Code: [Select]

PTAG    PAG/NON   # Allocs    # Frees  Alloc-Free       Used   Used after startup
----    -------  ---------  ---------  ----------  ---------   ------------------
Strg      PAG      7247198    6896000     351198    41506880    3028912
PcNw      NON       393121       178514     214607    12321104   12319528
Gh05      PAG      7627617    7626770       847      7959984    4572296

PS I added the last column myself it's values are taken somewhere half an hour after system startup.

It would seem that the Strg is responsible for the leak. Now I did some searches and this is what i found:

• From pooltag.txt:

Code: [Select]

Strg - <unknown>    - Dynamic Translated strings

• From MS Knowledge Base Article MS KB262386, it would seem that the driver filename is mrxsmb.sys (my system has the version 5.1.2600.1143 (xpsp2.021108-1929) of that file by the way) and its a MS's driver.

So basically it appears that avast is just somehow causing this MS driver to start leaking in my system. I'm going to try running avast's resident providers one at a time to see which one causes it.

/edit: forgot the pic

[Lisandro]

So basically it appears that avast is just somehow causing this MS driver to start leaking in my system. I'm going to try running avast's resident providers one at a time to see which one causes it.

Thanks Taikonaut for your posts. They are being very usefull to get near the problem. Please, keep reporting...  

[Taikonaut]

I'm going to try running avast's resident providers one at a time to see which one causes it.

So here goes:

Code: [Select]

    Resident task    Period    Alloc-Free         Used
------------------    ------    ----------   ----------
              none    1h:20m     no change    no change
Instant Messagning    1h:00m       +15 038   +1 972 352
               P2P    1h:10m        +2 196     +272 736
     Internet Mail    1h:30m     no change    no change
   Standard Shield    1h:10m       +10 473   +1 356 872  
Comments:
All these values are from the Strg pool tag. I hadn't installed this time the Outlook/Exchange thingy so no tests for it. Also no Instant Messagning software was running. As for P2P, then I had previously tried to see if the leak continued without eMule - it did, so eMule was running all the time here. During the Internet Mail test avast scanned a couple of emails.

Oh and this is what the Strg does (uptime 1 day) when avast is not installed:

Code: [Select]

PTAG    PAG/NON   # Allocs    # Frees  Alloc-Free       Used
----    -------  ---------  ---------  ----------  ---------
Strg      PAG       481555     481473         82        5976Well, I can't think of anything else to check or log so I hope this helps.

[Vlk]

Taikonaut,

all I can say is WOW, thanks for such an in-depth examination!!

Your posts show that you have deep technical knowledge of the system internals, and are of great help to us.

I believe the information you gave us should be sufficient to solve the problem. I'm currently in contact with some core MS developers and I hope we can together find a solution to this tricky problem.

Again, thanks a lot for your help.
Vlk

[Vlk]

OK Guys!!
I THINK I FINALLY GOT IT!!!

Taikonaut, Dave50 and anyone other experiencing the same problem, please download an updated avast driver from http://www2.asw.cz/~vlk/aswMon2.sys (Windows XP only!!), place it to the \Windows\System32\Drivers directory, and reboot for the machine for the changes to take effect.

And please, let us know how it goes...
BIG THANKS TO ALL YOU GUYS WHO HELPED TO TRACK DOWN THIS ISSUE!!

It's 4:53am here, and I feel tired. Hopefully the fix will work.

Good night,
Vlk

[Dave50]

Vlk -- good morning or good night.  Don't you love all the different time zones?  

It's nearly 6:30AM here and I'm on my way to a long day at work.  I will download the driver tonight and then let the computer run for several hours.  I'll report back.

Many thanks for everyone's help.  Avast is THE BEST!

[Lisandro]

OK Guys!!
I THINK I FINALLY GOT IT!!!

Taikonaut, Dave50 and anyone other experiencing the same problem, please download an updated avast driver from http://www2.asw.cz/~vlk/aswMon2.sys (Windows XP only!!), place it to the \Windows\System32\Drivers directory, and reboot for the machine for the changes to take effect.

And please, let us know how it goes...
BIG THANKS TO ALL YOU GUYS WHO HELPED TO TRACK DOWN THIS ISSUE!!

It's 4:53am here, and I feel tired. Hopefully the fix will work.

Good night,
Vlk

Thanks Vlk for your hard work. Is it posible that this file be updated in all XP systems just asking for a program update? Seems to correct a lot of errors.