Windows 7 Windows Explorer Memory Leak

[bp1000]

I'm trying to sort out a Windows 7 issue for a customer of mine. He runs Windows 7 Professional x86 on a Dell Latitude E5500 with 4GB memory. The system up to date with patches from Windows Update. He uses Microsoft Office 2007 and Adobe Acrobat Professional CS3. He started having issues with the responsiveness of the system and when I went to look at it, explorer.exe was using in excess of 1GB Memory (Private Working Set) as per Task Manager. Killing and then restarting explorer brought the system back to normal operation but over time the memory usage grows again. The memory use grows even if he is not actively using the computer. In between him stopping work at 5pm, with explorer using about 15MB after a kill and restart, it can be in excess of 1GB when he comes back to his desk at 9am the next morning.

I went through the process of disabling shell extensions to the point of turning off all third party extensions and then all 3rd party plus as many of the Microsoft ones without severely impacting the system functioning to no avail. Explorer continues to grow. I've looked through many knowledgebase articles and tried various "fixes" to no avail.

I'm looking for options as to what to do next.

[cluberti]

Would probably be worthwhile to download/install DebugDiag and use that for memory leak detection (it has a memory/handle leak "rule" that you can run and take manual dumps of the process over time, and then use DebugDiag to analyze those same dumps for leak patterns).

[bp1000]

Would probably be worthwhile to download/install DebugDiag and use that for memory leak detection (it has a memory/handle leak "rule" that you can run and take manual dumps of the process over time, and then use DebugDiag to analyze those same dumps for leak patterns).

Thanks cluberti. I thought I would test using DebugDiag on my own system first. I manually injected the leak tracking DLL into my explorer.exe process and let it run for a while. I then created a full dump, and ran the memory pressure analysis on it. I got an error in the report when it was trying to analyse the heap info. Where it shows the Heap Details, my first heap (default process heap) shows reserved memory of 0 bytes. The report then gets an overflow on trying to display the committed memory as a percentage of reserved memory, as reserved memory is 0 and divide by zero creates an overflow.

Is this something you have seen before, or do I need to do something differently. My system doesn't have the issue of my client, but I wanted to get familiar with the tool before using it on his system. I noticed that DebugDiag v1.1 indicates it is only tested up to Windows Vista and prior. As I'm running Win7 (as is my client) is this going to be an issue? After a bit of searching, I have found that v1.2 is in beta, and can be requested from MS. I'll try this version if and when I can get it.

I have attached the analysis report file.

Memory_Report__explorer.exe__11102010111316802.rar

[cluberti]

I would recommend 1.2, yes. I've seen debugdiag do this in the past on Win7 systems, but I've never figured out what was in common amongst the systems where it did this. Looks like you might need the 1.2 beta, indeed.

[bp1000]

I found a v1.2 Beta on a tools site. The first time I ran the memory pressure analysis it failed with an undeclared variable Well I fixed that but now it is having issues with g_UtilExt having no value. The Crash Hang analysis works fine, so looks like not much testing done on the memory pressure analysis. Hopefully, I can either fix it up myself or maybe MS have a beta 2 to send me.

[bp1000]

Well, I managed to get the memory analysis script working, and it looks like a Dell-rebadged version of the Lexmark toolbar was causing the memory leak in Windows Explorer. Funny, I'm sure this was one of the Shell Extensions I turned off but made no impact. Thanks for recommending DebugDiag. I can see I'll be using this again.

[cluberti]

Good to hear you were able to figure it out!