Awareness Thread on Windows 8 Memory Leak with NDU.sys

Cryogenist

Senior Member
Joined
Jun 12, 2005
Messages
1,702
Reaction score
72
Hi guys.

Just wanna share with you guys on this Memory Leak ONLY in Windows 8.
Not sure any of you heard of it or got it before.

I gotten it a few times and finally managed to resolve it.

Apparently this guy below
"Windows Network Data Usage Monitoring Driver" or NDU.sys was introduced in Windows 8.

Info:
Windows Network Data Usage Monitoring Driver - Windows 8 Service - batcmd.com

This guy is pretty naughty and causes memory leak.

It is being reported in a few places below:

Discussion Threads
Non-Paged Pool Leak in Network layer
Windows 8 high memory usage - Windows Discussion & Support - Neowin Forums
Damjan's playground: Windows 8 RTM Memory leak - NDU.SYS?

This screenshot is gotten from Damjan's website
CJW3Uv7cES51iwptuRbfrza_D18WmNFFjmXGluZ2_6EAVWItX-Rf-_DU1kqqYSRqBc7WLhLNiNtlmbm76DNkmLSRhtQYGCA4Nj-w1oWArTJEO8pm9qrD


Causes
The exact criteria to trigger is not confirmed 100% though.
Some were pointing at the Network Drivers.
Like what some say, is probably a VERY BADLY written network code by dear Microsoft.

This guy will cause the "Non-paged pool" to grow massively, SQUEEZING almost every last bit of your RAM and also causes your pagefile to be VERY active. Which in turn affects your HDD/SDD IO performance.

The result = causing your system to be slowed down to a crawl, irresponsive

Temporary Solution
Restart the computer.

Alternative (Permanent) Solution

Open up "regedit" and go this key.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ndu

Change the "Start" value to 4 (to disable it).


Thanks for reading. :s12::)
 

2fast2drive

Senior Member
Joined
Jun 17, 2009
Messages
630
Reaction score
0
thanks for informing! =)

looks like Im gonna skip windows 8. Dont see any advantage for my typical usage at all.
 

Kyo_kusanagi86

Arch-Supremacy Member
Joined
Mar 13, 2001
Messages
10,350
Reaction score
619
Could U enlighten us why the value is changed to 4 instead of 2 or other numbers in the regedit?

Does 4 represent the amount of ram available?
 

Cryogenist

Senior Member
Joined
Jun 12, 2005
Messages
1,702
Reaction score
72
Could U enlighten us why the value is changed to 4 instead of 2 or other numbers in the regedit?

Does 4 represent the amount of ram available?

According to what they say on the forums, the value "4" is to disable it.

I cannot find the official reference on what does the values 0-4 represents, but
so far, the value "4" seems to disable the NDU.sys

No more memory leak so far. Try the same routine that triggers the memory leak, and nothing happens. Good to go I guess.
 

FatalityV

Arch-Supremacy Member
Joined
Aug 8, 2009
Messages
24,921
Reaction score
10
I think I will use your fix.

For my pc recently, after turning on for > 48 hours, slows to a crawl.
 

Cryogenist

Senior Member
Joined
Jun 12, 2005
Messages
1,702
Reaction score
72
I think I will use your fix.

For my pc recently, after turning on for > 48 hours, slows to a crawl.

Check if you have the same symptoms.

Your com's Non-Paged Pool's size is very massive.
Your com's RAM usage is hovering around 90% for no reason
Your HDD's activity is almost at 100% due to pagefile swapping.
 

Kiwi8

Honorary Member
Deluxe Member
Joined
May 3, 2001
Messages
128,402
Reaction score
10,115
I did not know there's such an issue. :o

But I wonder whether another symptom I encountered could be related to NDU.sys.

That is, sometimes, after a reboot, I will encounter problems with the network connection, which will either slow down, or block transmission in one direction. I didn't really notice the pool size, ram usage and hdd activitity increasing though. :o

Anyway, disabled NDU too, to see if it will improve.
 

Cryogenist

Senior Member
Joined
Jun 12, 2005
Messages
1,702
Reaction score
72
I did not know there's such an issue. :o

But I wonder whether another symptom I encountered could be related to NDU.sys.

That is, sometimes, after a reboot, I will encounter problems with the network connection, which will either slow down, or block transmission in one direction. I didn't really notice the pool size, ram usage and hdd activitity increasing though. :o

Anyway, disabled NDU too, to see if it will improve.

Haha.. When I first met up with this problem, I was quite dumbfounded.

I was like "What?", how can a new Haswell system slow down to a crawl for no apparent reason especially with the workload I given to it.

Then I start noticing the RAM usage especially high.

From there, managed to dig out a few threads online that seemingly point to the same issue.
 

speedknight

Moderator
Moderator
Joined
Jun 14, 2004
Messages
21,022
Reaction score
76
Will keep track of this
Currently system up for 10:17:25 and counting...
16GB ram,6.9GB in use 8.7GB available.
Page tool 572MB,Non page tool 357MB
 

E_T

Master Member
Joined
Aug 28, 2000
Messages
3,096
Reaction score
0
Not sure about this but starting last month, my Desktop + All software will suddenly become unresponsive to input. Had to do a hard reset to recover. Will KIV this solution.

But shouldn't the registry patch be at CurrentControlSet instead of the backup ControlSet001?
 

Shruokan

Junior Member
Joined
Nov 28, 2013
Messages
1
Reaction score
0
Hi there,
I had the same problem (at least i think so) and proceeded with the solution you provided. With this, i managed to lower my non-paged pool back to normal. However, my memory problem is still present. What should be my next course of action?
Thanks in advance
 
Important Forum Advisory Note
This forum is moderated by volunteer moderators who will react only to members' feedback on posts. Moderators are not employees or representatives of HWZ. Forum members and moderators are responsible for their own posts.

Please refer to our Community Guidelines and Standards, Terms of Service and Member T&Cs for more information.
Top