Lately I've been getting a problem where my computer randomly begins to slowdown to a crawl. Task manager reports that all or ~95% of the 8GB of RAM I have is in use. None of the processes visible in task manager (with show processes from all users checked) consumes enough ram to warrant all of it to be in use.
 
I found a thread on another website that described the same situation that found a solution in disabling write-caching on his drive through the device manager. He said that apparently there is/was some glitch associated with hard drive caching that would end up loading your RAM with the cache. It seems that the problem usually occurs when the disk is writing something (downloading for me) as it did for him. I disabled write caching and it seemed to solve the problem temporarily.
 
Here are pictures of the task manager and resource monitor while the ram is loaded.



 
And this is what it looked like after the problem stops. Also for no apparent reason.

 
 
 
 

Attachment(s)

Attachments are not available: Download requirements not met

For years when I have downloaded large ISO I would see it held in memory, and same when copying files to another location, or even when I playing around with Tumblr a lot (that seems to be heavy memory user). 
I had 6GB and due to low prices went up to 12GB kit (3 x 4GB) and that has helped. My other system with 8GB does well enough and no need. My last system had 4GB and upped it to 8GB which smoothed things out. 
Windows wants to cache disk directories so the more drives you have present the more and that would make sense to track and know to improve disk I/O too. 
I'll have to look into it more as I thought having disk cache enabled improved performance and you want that for your internal drives or anything on UPS too. 

You might want to download Process Explorer from http://technet.microsoft.com/en-us/sysinternals  as that will allow you to see a LOT of details about what processes are running and how much ram they are consuming (even the hidden processes).  Run this program right after a reboot, and see if the RAM usage suddenly jumps up under one of the "svchost.exe" processes.  If it does, you may have acquired a rootkit virus.  These are tough for some AV programs to detect and clean, but there are some specialized rootkit virus removal programs available (tdsskiller for example) which are usually free.
 
There is also the possibility that the prefetcher might be maxing out your RAM if you run a lot of different applications.  The prefetcher caches commonly used applications in RAM for easy use, but unfortunately, it is a bit aggressive in this capacity when a user is inconsistent or tends to use a lot of applications.

I've downloaded the program and I suppose I should be looking at which process is logging a bunch of events while my RAM is being loaded?
 
I believe the first time I had a slow down I tried a AVG scan and my RAM was free'd up again partway into the scan. However no threats were found/resolved and the RAM loading typically doesn't last forever, at least for a good 3-5 minutes.
 
I'll try to get this running the next time my computer slows down. Thanks.
 
 

Try running this very small program and see if it finds any threats.
 
http://support.kaspersky.com/viruses/solutions?qid=208283363
 
This is "tdsskiller" from Kapersky and it is free (and updated regularly).  It simply checks your boot drive for any rootkits that might be lurking around there.  The behavior you are describing sounds like a possible rootkit, but that is just one possibility.  This is just an easy way to rule that out (the scan takes less than a minute).

it found 1 medium threat. "sptd" service which looks like the service required to run daemon virtual drive tools. The only virtual drive software I remember installing is Alcohol 120%. Could that service still possibly be infected? I'm probably going to delete it and uninstall Alcohol 120% anyway as I don't need it anymore.
 

 
 

Attachment(s)

Attachments are not available: Download requirements not met

No, the SPTD driver causes no harm to the system.  It installs similar to a rootkit to elude detection by various DRM strategies.  If you wish to uninstall it, that's also perfectly fine. 
 
Based on the behavior you are describing, are you running Windows 7?  If so, the cause might very well be the superfetcher.  This is a program that utilizes as much memory as it needs (or wants) to "cache" programs that are run, in the attempt to predict the user's future use of said program again.  While the system works pretty well for users who are consistent in their usage of their system, it performs very poorly in many other situations.  The memory is released as soon as there is any demand for it at all, but it still draws power for the usage of the RAM, and can cause swapping if it becomes excessive.  You can turn this off to see if this solves the problem.  To do so, open up the services control panel applet (just select START, then RUN, then type "services.msc" in the resultant box).  The service in question is called "Superfetch". 
 
Give that a try, and if you don't like the result, you can simply restart the "Superfetch" process.  No harm no fowl.

I agree with Latharion about giving a shot at disabling the SuperFetch service (Vista & Win7)..It's a huge huge memory/resource hog!!!..It had my g/f's laptop on it's knees until I finally figured out what the issue was and disabled it..One of Micro$oft's "Woops, we wucked wup" I think..Whether that's the problem or not, I suggest disabling it anyway, IMHO.

I was pretty certain that the problem was SuperFetch as when I disabled it for almost a day and then re-enabled it, my RAM got fully loaded again minutes after.
 
However just now my computer was fully loaded again even though superfetch was disabled and it finally mustered up the small amount of power it took to get process monitor up to reveal that explorer.exe was logging a metric ton of read events. Which screams a virus to me. Killing explorer.exe temporarily through the task manager immediately freed up my RAM, and I ran explorer.exe again.
 
So what's my next step?

Do you have "indexing" enabled?  Depending on the size of the drive, and how full it is, it might have a huge index.  Also, check your "Temp" folder (under C:\Users\@USERNAME\AppData\Local\Temp ).  That folder might have a very large number of files that need to be deleted.  Any file that is not dated with today's date is a pretty good candidate for being cleaned out.
 
Also, it's always a good idea to do a thorough virus scan when in doubt.  It might also be prudent to try a secondary virus scanner, just to be sure.

Yeah I did an hour long virus scan in safe mode with AVG and it found nothing. Also tried a Mcafee rootkit removal tool with no results.
 
There were plenty of files in my temp folder modified before this date. Over 1 gig really. And Indexing is enabled i believe. Says I have 9,230 items indexed.

You could try disabling indexing and see if that helps.  You can always enable it again if you wish.
 

If you don't have VMware, VirtualBox, or a Virtual XP running on your system then it rules those out. And I don't see vmware or vbox lsited anywhere... are you sure a virtual XP machine isn't running? I don't know off the top of my head what that shows up as in Explorer. Also, any virtual disk drives like Virtual Clonedrive, or even ramdisk software present?
 
When superfetch fills up your memory it is labeled as STANDBY  memory, it's the BLUE stuff in the Resource image that was posted. The OS will instantly dump standby RAM when a legitimate program calls for RAM, so it's silly to disable it as it doesn't benefit anything. Actual memory used by programs is displayed in GREEN. So clearly, this is not a superfetch problem. And if this was a hardware problem, it would be in gray.
 
I'd suggest ya download and run MSE just because, can always uninstall it later without it leaving stuff behind. As Latharion mentions, Process explorer would let you see what program or process is using up all that memory the next time it occurs. Because I only see two possibilities here. Either something has hijacked your system and runs stuff in the background, or your OS install got messed up in some weird way.

kougar


If you don't have VMware, VirtualBox, or a Virtual XP running on your system then it rules those out. And I don't see vmware or vbox lsited anywhere... are you sure a virtual XP machine isn't running? I don't know off the top of my head what that shows up as in Explorer. Also, any virtual disk drives like Virtual Clonedrive, or even ramdisk software present?

When superfetch fills up your memory it is labeled as STANDBY  memory, it's the BLUE stuff in the Resource image that was posted. The OS will instantly dump standby RAM when a legitimate program calls for RAM, so it's silly to disable it as it doesn't benefit anything. Actual memory used by programs is displayed in GREEN. So clearly, this is not a superfetch problem. And if this was a hardware problem, it would be in gray.

I'd suggest ya download and run MSE just because, can always uninstall it later without it leaving stuff behind. As Latharion mentions, Process explorer would let you see what program or process is using up all that memory the next time it occurs. Because I only see two possibilities here. Either something has hijacked your system and runs stuff in the background, or your OS install got messed up in some weird way.

Have you read the thread? Pretty much everything you asked or said was already answered or done.
 
@Latharion I've disabled indexing and cleared my temp folder and so far I haven't had a memory issue since. I'll report back again if the problem comes up again.