Windows – Is this RAM usage normal (huge non-paged pool)

Same problem here. I found that these instructions for finding the issue with non-paged pool also work for paged pool.

This requires installing a 2gb windows driver kit package from Microsoft. I'm not sure if visual studio is necessary, even though the Microsoft installation directions say it is.

If you have windows 10, and want to avoid installing that massive package, I have created a zip file containing just the poolmon.exe and a shortcut that runs it using the "-b" option. According to Microsoft, the exe is standalone and should work. I don't know if the exe works with other Windows OS versions. The exe is from "WDK for Windows 10, version 1709"

1. First step is to run poolmon.exe -b. You can do this from the command prompt or the shortcut I provided in the zip file. Or create a new shortcut to poolmon.exe and in "properties" put the full "target" address in quotes and add " -b" after it, without quotes. The "-b" is important because it organizes the list according to the most bytes used.

You should get results that look like this: poolmon -b results

As you can see, in my case, the tag for the process using 7.2 gb of Paged Pool is "AvN".

2. Next open a command prompt and cd C:\Windows\System32\drivers Then findstr /s (Tag) *.sys where (Tag) is your tag from the left-most column in poolmon. It is very important that capitalization is exact.

Here are my results from command prompt, with one mistake where I did not correctly capitalize AvN. results from findstr

From this I can see that the tag "AvN" belongs to a driver called "avgMonFlt.sys". From a google search it seems that "avgMonFlt.sys" belongs to "AVG Antivirus Free". If I find that file in explorer, and look at the properties, under the "details" tab it gives me the name of the product "AVG Internet Security System" file description, Copyright owner, and other information. The "Digital Signatures" tab shows me who the signer is.

In most cases simply updating the driver will solve the issue. If an update isn't available, uninstalling the driver may be necessary. At the very least, you have identified the faulty driver and use that information to find a solution.

I actually haven't fixed this problem yet. I may just need to uninstall "AVG Antivirus" and get a different antivirus, or I may need to simply uninstall and reinstall. I just recently repaired it, as well as updating it, before this problem occurred. I will update this answer with my results.

Found it, you can add the column "NP Pool" to the "Processes" tab on Task Manager:

In my case, the culprit was Fling File Transfer, which has a serious memory leak. It was using more than 2 GB of the nonpaged memory pool before I restarted it. The above screenshot shows it after running for two minutes.

Bug report filed.