Paged and nonpaged pool memory leaks... caused by zombies!

Ugh, it's been over a year since I posted here... hope I'll make updates more frequently...

Anyway, recently I struggled with pinpointing cause of memory leak on some Windows Serve r2008 R2.

This leak was quite rare, because it wasn't caused by working applications, instead, due to some driver bug, system wasn't able to release all memory from closed proccesses (20K to be precise) and this eventually caused all physical memory to fill up... and crash the server.


It looked like this in RAMmap:

Thanks to this post I was able to find problematic driver. And it was indeed, Alladin HASP USB dongle driver.

So, lesson learned: if you think you have memory leaks, go check it with RAMmap also. Proccess explorer or similar tools can show you leaking active app.

And just for reference: fltmc command can help find active filter drivers which may cause memory leaks.