Kernel Memory Leak... Almost there

MonkeyKong007

Hey people, i searched the forum and none of the posts seemed to help...

i have used poolman.exe and have found this


Tag Type Allocs Frees Diff Bytes Per Alloc

Thre Nonp 54219 ( 37) 171 ( 0) 54048 34158336 ( 23384) 632

a tag called Thre seems to be hogging a lot of non paged memory and not giving it back, its only freeing up 171 of its 54219 a massive difference.

i have isolated the files this is associated with, which is called

hsfdpsp2.sys

it is a file used apparently for a modem which i dont have, i dont even use my current modem so i have disabled it.. but the problem still persists

how do i
A) find out what application is using hsfdpsp2.sys,
get rid of it so it doesnt hog memory

Thanks

Debt_Free_Chick

Looks like it's a driver for a Conexant modem, according to this and this

MonkeyKong007

Debt_Free_Chick wrote:

Looks like it's a driver for a Conexant modem, according to this and this

thanks for the quick reply...

i havent got one of those modems! the one i do have i have disable just in case and still i get the problem

anyone help?

scheming_gypsy

find the file and rename it. If it has any effect rename it back

bbb_uk

In addition to what scheming_gypsy has said, can I add if it can't be done within windows because it is in use then you'll have to do it from safe mode or DOS. Did you mean you have uninstalled (if poss) the driver/software when you said you disabled it?

If you get errors from within Windows about it having trouble finding/loading this file and assuming other than the errors your PC (and all your software) works fine then you may have to use registry editor and carefully remove any mention of this file. I say carefully as messing around with the registry could stop you from booting windows. I would also create a system restore point just in case.

MonkeyKong007

bbb_uk wrote:

In addition to what scheming_gypsy has said, can I add if it can't be done within windows because it is in use then you'll have to do it from safe mode or DOS. Did you mean you have uninstalled (if poss) the driver/software when you said you disabled it?

If you get errors from within Windows about it having trouble finding/loading this file and assuming other than the errors your PC (and all your software) works fine then you may have to use registry editor and carefully remove any mention of this file. I say carefully as messing around with the registry could stop you from booting windows. I would also create a system restore point just in case.

i renamed it, but the file keeps reappearing every time i restart...

i have diasbled my modem but it isnt a conexant one, so i dont think that will do the job... i dont have any conexant hardware im positive... if i did how could i find it?

also i dont know where to begin if i was to uninstall the driver...

MonkeyKong007

the file itself doesnt even seem to be in use... its weird. i can rename or even delete it. it still comes back when i reboot tho.

the only time it doesnt hog all the kernel mem, is in safe mode - Directory Service Restore mode

there i have looked on poolman and it doesnt hike up memory.

criminal_smile

Switch off system restore before rebooting to safe mode. Then try to delete / rename it again. Hopefully it won't be there when you reboot normally.

bbb_uk

Try doing what criminal_smile says before trying to rename it as Windows whilst its running will replace certain drivers that are missing/corrupted automatically. This is known as Windows File Protection (WFP). Renaming the file from within safe mode should hopefully prevent windows replacing it with a copy. From within safe mode rename the file to something like xxxhsfdpsp2.xxx (note the additional 3 'x' at the beginning and the extension being renamed to .xxx)

drlight_2

This file is a driver and loaded with a modem but it is not part of modem manufacturer drivers but a winxp file, your modem works without it but windows is installing drivers for some sort of extra function wich it will use your modem to perform, bit of a mystery to me. You can turn off some of these functions in modems in control panel if it's installed.
hsfdpsp2.sys
I wonder if it abbreiviates hardware, software, file,data protocal, service pack2 ?

MonkeyKong007

thanks for all the suggestions...

i managed to successfully delete that file, which had been isolated as the file directly associated with the pool tag "Thre"

however, Thre is still coming up on the pool monitor as leaking a massive amount of memory.

Can anyone suggest how i isolate the file responsible using this pool tag

i have tried
cd /d %SystemRoot%\System32\Drivers
findstr /m /l hThre *.sys

in Command Prompt, this originally isolated the file hsfdpsp2.sys. Now that is gone (it doesnt come up when i type in the above) i dont know what to do.

when typing in this
cd /d %SystemRoot%\System32\Drivers
findstr /m /l Thre *.sys

i get these files listed

acpi.sys
aec.sys
afd.sys
amdk6.sys
amdk7.sys
asyncmac.sys
ati1btxx.sys
ati1raxx.sys
ati1rvxx.sys
ati1snxx.sys
ati1tuxx.sys
ati1xbxx.sys
ati1xsxx.sys
ati2mtag.sys
atinbtxx.sys
atinraxx.sys
atinrvxx.sys
atinsnxx.sys
atintuxx.sys
atinxbxx.sys
atinxsxx.sys
bridge.sys
bthport.sys
bthusb.sys
cdaudio.sys
cdfs.sys
cinemst2.sys
classpnp.sys
crusoe.sys
dmboot.sys
dmio.sys
dxg.sys
fastfat.sys
fdc.sys
filedisk.sys
fips.sys
flpydisk.sys
fltmgr.sys
ftdisk.sys
GBFSHook.sys
GoBack2K.sys
hsfbs2s2.sys
hsfcxts2.sys
http.sys
i8042prt.sys
imagesrv.sys
imapi.sys
intelppm.sys
ipfltdrv.sys
ipinip.sys
ipsec.sys
irenum.sys
klif.sys
kmixer.sys
ks.sys
ksecdd.sys
modem.sys
mountmgr.sys
mrxdav.sys
mrxsmb.sys
mtlmnt5.sys
mtlstrm.sys
mup.sys
mutohpen.sys
MxlW2k.sys
ndis.sys
netbt.sys
nmwcd.sys
npfs.sys
ntfs.sys
nv4_mini.sys
nwlnkipx.sys
p3.sys
parport.sys
pci.sys
portcls.sys
processr.sys
ptserlp.sys
rasacd.sys
raspptp.sys
rdbss.sys
rdpdr.sys
rdpwd.sys
redbook.sys
RMCast.sys
scsiport.sys
serenum.sys
serial.sys
sis162u.sys
slnt7554.sys
slntamr.sys
slnthal.sys
smbali.sys
sonydcam.sys
sr.sys
srv.sys
stream.sys
tcpip.sys
tcpip6.sys
tdi.sys
tdpipe.sys
tdtcp.sys
termdd.sys
tsbvcap.sys
Tsknf601.sys
udfs.sys
update.sys
usbcamd.sys
usbcamd2.sys
usbhub.sys
usbintel.sys
usbport.sys
usbvideo.sys
vdmindvd.sys
videoprt.sys
vinyl97.sys
volsnap.sys
vpctcom.sys
wacompen.sys
wanarp.sys
ws2ifsl.sys


can anyone be of any help?