Huge memory leak into non-paged pool

Noticed the amount of memory committed to the non-paged pool had become very high recently, as much as 6.5gbs (I have 16gbs installed). Through a process of trial and error - rebooting having disabled key software one at a time - I discovered 4gbs of this leakage was due to the Glasswire program. I was running the latest version of your software.

1 Like

@VinceHale

Did your task manager show that GlassWire was using your memory?

Do you use Bittorrent?

Thanks

Along with BitTorrent; are you using FTP? I find glasswire gets a bit greedy when I’m using FileZilla.

I am having the same situation. From the task manager (I actually use Process Hacker) I can often see GlassWire using lots of not only RAM but CPU.

I wasn’t though sure it would be GW leaking into the non-paged pool, so I ran some generic google searches until I found a thread at superuser dot com (sorry, new user, cannot post links and only one image apparently) named “Windows 10 high memory usage (unknown reason)” which you can google

from which I learnt to install Windows WDK to have access to poolmon.exe,

with which I then identified that the biggest (and continuously growing) occupier of this non-paged pool, has the tag GWCD, which by the letters already gives a hint,

but I followed through with the instructions

until I ended up with gwdrv.sys

imgur dot com/VgfcajF.png

which when I right-clicked and went into properties,

imgur dot com/hq6yoHC.png

is a digitally-signed (by Symantec) GlassWire Driver (as per the description) copyright SecureMix LLC which from what I’ve googled, is the maker of GlassWire.

So I guess this excludes the possibility that I’ve got a virus infecting this driver?

Since I started writing this, the leak seems to have grown by about 30 megabytes. I really don’t like to have to be rebooting all the time… I use lot of stuff at the same time and reopening my environment is annoying. I simply suspend the computer when I leave and like to reopen my session exactly as it was.

If not for this new issue, I never need to do it otherwise, always good performance and stability. But if I don’t reboot for a while, one day I get to the machine and it’s crawling crawling crawling… until it dies (this happened when I left it for some 48 hours without suspending).

By the way I’ve just today updated to the most recent version of GlassWire, problem continues. Apparently even with app updates, the driver is not updated since 2015, looking at the properties above.

Look forward to a solution, I really like GlassWire.

Big thanks

1 Like

@ricardosalta

If you reinstall GlassWire with its “clean” install option does it solve it?

Good question. I didn’t try that. I will now.

This clean install will not mess with Windows Firewall configurations or?

No, but if you want to do that you can go to Windows Firewall and choose “restore defaults” before reinstalling GlassWire. But it’s not necessary in your case unless you want to.

Cool, I didn’t want to reset anything regarding Windows Firewall - so I’ll now proceed with the clean install and report back.

1 Like

Problem not solved with clean install of Glasswire. Haven’t rebooted more than 24h ago, and GW appears to be responsible for about 1.5GB of non-paged memory leak. (GWCD and dsfi if I’m not mistaken but GWCD for sure)

For the memory usage by the driver, it depends on the network activity you have. The more network connections you have the more memory we have to use, because we have to track each network connection to count the traffic correctly.

Also we have some pools of objects to speedup the resource acquisition and decrease the probability of network slow down. The OS decides when these pools should be cleared and the unused objects are released after some time.

On my PC memory usage varies from time to time.

For me it’s about 11K-15K of bytes when I’m working. If I run multiple youtube videos (that cause multiple connections) the memory usage increases up to 80K bytes.

If I run a torrent client with several uploads the memory usage increased up to 100K-110K bytes.

For the memory leaks, it’s very unlikely.

The driver is tested very well using the utilities provided by Microsoft and all memory issues were fixed a very long time ago.

We have not received any BSOD reports caused by our driver.

We’re looking at adding a no host/no traffic mode that does not log hosts/traffic at that will use hardly any resources.

Was a few days with GlassWire fully uninstalled. Non-paged pool kept at around 300 megabytes all the time.

After a while of having it installed again, it’s already ballooning, my computer is already crawling to a halt, and when trying to make a full reinstall, I even get an error.

I have to kill it with Process Manager and press retry to be able to proceed.

Anything you suggest I investigate, or is GlassWire just not for me?

@ricardosalta

Have you scanned your PC for malware recently? Please be sure all antivirus products are up to date along with Windows also being up to date.

Sorry for the problem. We think GlassWire is for everyone and we can’t seem to recreate this problem, so I thought maybe it could be an OS problem?

I just want to add to this as I’ve had issues too. I installed Glasswire on our Azure Windows Server 2012 VM to monitor outgoing traffic destinations to diagnose higher than expected usage.
It seems to have caused a number of server hangs and I have had Azure support look at this and they determined the same thing, it’s an issue with the driver requesting a large non-paged pool.

@Dom_Barnes

Thanks for your feedback. We are working on making changes with our 2.0 software so you can optionally use a lot less resources by no longer monitoring hosts or traffic types.

I can confirm same bug on my PC.
running pro version 1.2.100.
Running windows 10 home 64bit, and I have huge memory leak caused by your device drivers…
Me too went & did some checks with poolmon.exe and WDK/SDK tools (xperf), and it seems that your app either directly or via the File tag cause quite some memory leak. If leaving computer running for a week, it can take extra 8GB !

No torrents, no ftp, NADA and this beast managed to use 98% of my 32 GB RAM in 3 hours running with only my browser reading forums running besides it. Also ate 94% of my CPU, slowed computer to a crawl, nearly crashed it. Uninstalled FOREVER - will never trust glasswire again.

Have a same problem in the last version.

Well, I would suggest that GlassWire should use a different tag for every allocation site which allocates memory in the nonpaged pool. So allocation site 1 uses GWC0, the next uses GWC1, etc.
A user that experiences a memory leak can than tell which tag and therefore which allocation site is the source of the problem.

Just ran into the same issue with the GWCD tag, uninstalling GlassWire freed up 31GB of RAM.

Any update on this?