Memory Leak | NtfF Paged, MmSt Paged, FMfn Paged, File Non Paged, NtxF Non Paged high memory usage

Question

I use Windows 11 Home Edition. At the end of the day, despite closing all folders, programs, and ensuring no background processes are consuming significant RAM, memory usage still shows around 80% to 90%. I’ve investigated the issue and here’s what I’ve found:

1- Memory Diagnostic Tool: I ran the memory diagnostic tool by pressing Windows key + R, typing mdsched.exe, and hitting OK to restart the device. No issues with physical RAM were detected.

2- Drivers and System Updates: All my drivers and the Windows OS are up to date. I’ve also scanned my computer for viruses and malware using various programs, and no threats were detected.

3- Clean Boot Environment: I disabled all services except for Microsoft services and restarted my computer.

In a clean boot environment, the memory usage is as follows:

• Used memory: 4.2 GB
• Unused memory: 11.5 GB
• Paged pool: 240 MB
• Non-paged pool: 347 MB
  

While in this clean boot environment, I ran PoolMonX to check for memory leaks. The first tag was Cont Non Paged with 134,660 KB.

After that I started the Windows virus and threat protection scanner, the paged pool and non-paged pool usage increased rapidly. After approximately 12 minutes, the memory usage was:

• Used memory: 7.1 GB
• Unused memory: 8.4 GB
• Paged pool: 1.9 GB
• Non-paged pool: 975 MB
  

Even after stopping and closing windows virus and threat protection scanner, the used memory remains around 7 GB. In PoolMonX, the tags show:

• Ntff Paged: 533,195 KB
• MmSt: 302,930 KB
• FMfn Paged: 248,328 KB
• File Non Paged: 172,042 KB
• NtxF: 139,359 KB
• Cont Non Paged: 134,660 KB
  

I have recorded the screen showing this behavior. You can view it at the following link:

https://drive.google.com/file/d/1bniE5mJphEJu6DKoZc-nhZ7_tNlkfZn8/view?usp=sharing

It is not only about the Windows virus and threat protection scanner. When I use File Explorer, open a folder, close it, and then open another folder, the Ntff Paged tag KB gradually increases and does not decrease even after closing File Explorer and folders.

I would be grateful for any support on this matter.

Answer 1

Hello

According to present information, it seems we are getting a "paged pool" leak issue. Usually the paged pool leak could be related to driver.

1. According to the tag, it could be related to specific filter driver. Please open administrator command line and run "fltmc". Then check any suspecious filter driver.

Use the auoruns tool to check the exact driver name. Open the tool as administrator then navigate to the "driver" tab. Untick them, reboot to verify the issue, too.

Autoruns - Sysinternals | Microsoft Learn

2. Open the task manager, navigate to "details" tab. Right click the colume then enable "handle" option, then sort the handle and check if there is any service occupying many handles (larger than 10000). A handle leak issue may cause the pool leak issue, too.