Out of resources, but which ones?

XP Pro system in a domained environment, Dell Dimension 2400, P-4 2.4GHz with 1Gb RAM

This is a recurring problem that has persisted for well over 9 months, at times it is worse than others.

5.1.2600 SP2 build 2600

The current uptime of the system is just under 6 days (5d 22h 26m to be exact)

Current environment:
18241 Handles, 711 Threads, 61 Processes

Commit Charge (K)
Total 656044   Limit 2520256    Peak 929564

Physical memory
Total 1046528     Available 395324     System Cache 503244

Kerne Memory (K)
Total 96176     Paged 75656     Nonpaged 20520

Commit Charge: 633M/2461M

In this instant the system is behaving as if there is no available memory: I am unable to open any applications (Adobe Acrobat Reader, for example), or in another example, unable to create a new email in Outlook or a new tab in Firefox.

At times I am unable to open a folder window in My Computer until I close some other open application (any open application, apparently to free up system memory).

When I reboot the system will function normally for some period of time, possibly one day, possibly six then the problem will return until the next reboot.

The system is as free from viruses, worms, trojans and other exploits as it can be, as detected by Norton Antivirus, the most recent version of MS Antispyware (or whatever they are calling it these days), Hijack this, and various online scanners.

It appears that the system is short on -some- system resource, but I have no idea -which- resource it might be.
Who is Participating?
KenneniahConnect With a Mentor Commented:
Norton is well known as being a resource hog that can slow down your computer dramatically. I have seen many computers (including my own at home) that had some performance issues that all went away after removing everything Symantec. While I haven't seen this particular problem with it, I wouldn't exclude Norton from causing the problem because I've seen such a wide variety of other problems cause by it. For performance reasons, and also because of Norton not finding viruses that Mcafee and even the free AVG found in my testing, I don't don't recommend Norton to anyone.

I wish I could say beyond a doubt that the problem was. These kinds of leaks are just a pain to track down. I would probably try disabling the IE helper in Spybot in addition to the update. Speaking up, when you said you updated it, did you mean the update inside or actually downloading the latest version from http://www.safer-networking.org/en/download/index.html  (1.4 is the latest). The update inside the program just updates detection files etc.
You more than likely have a leaky system app. No easy way to determine which one. You can also check your settings for performance and page file size. Here http://support.microsoft.com/?kbid=308417 is a good tutorial on how to check and change those settings.
Right-click the Taskbar and hit Task Manager when this ocurrs.
On the Performance tab, look at the Total under Commit Charge. If that is getting higher than the amount of ram you have, then it will cause major slowdowns. If it gets near the number for Limit, then you won't be open anything new without closing others. You can try looking on the processes tab to see which processes are using up large amounts of memory.

If you aren't seriously stressing the system with multiple running progams, most like the cause is a memory leak in some running program or device driver. Finding out which can be a pain, but looking at the processes in Task Manager is a good start.
Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

minganoAuthor Commented:
I've never gotten the commit charge above 60% of actual physical memory (1 Gb) and peak has never been noted to equal physical memory.  In this instance the numbers were:

Commit Charge (K)
Total 656044   Limit 2520256    Peak 929564
Guess I could have read that information from the initial post, it's amazing how blind I can be at times. Well at one point Commit Charge was close to the amount of physical RAM then (Peak is equal to the highest value Commit Charge has been since the last reboot), however while it has gotten high enough to slow the system down at times, it doesn't look high enough to run out of resources. It is pushing it a little bit though, I wouldn't want my peak getting that close to the phyiscal amount very often, and even the current commit charge of 656mb is a little high. With those numbers I probably would recommend adding some more memory even without the resources issue.

But back to the issue at hand....sounds like it might be a GDI resource problem. In Task Manager, go to the Processes Tab. Hit View|Select Columns....
Select GDI Objects.
Now look through the running processes for anything with an extraordinarily high amount of GDI Objects.
Wouldn't hurt to select User Objects as well ad GDI objects.
minganoAuthor Commented:
The problem happens to be showing up in this very instant.  Among other (typical) symptoms - double clicks to open a subfolder are ignored until I close two tabs of Firefox.

GDI Objects:
Explorer.exe 879
Outlook.exe 374
brctrcen.exe 296
MASACui.exe 293
WindowsSearch.exe 219
taskmgr.exe 105
CCAPP.exe 99
Firefox.exe 86
gaim.exe 83
ctfmon.exe 82
WISPTIS.exe 52
winlogon.exe 48
MMDiag.exe 39
mim.exe 36
and several others, all with about 20 or fewer

User objects:

explorer.exe 2896
masscui.exe 339
outlook.exe 256
taskmgr.exe 117
ccapp.exe 107
and all of the others all under 100

Handles: 16135  Threads: 656  Processes: 56

Commit Charge total: 605728   Limit: 2520256   Peak: 878672

Physical Memory: 1046528   Available: 423560   System Cache: 535432

Kernel Memory Total: 95152  Paged: 79948  Nonpaged 15204
Wow, Explorer is using way more GDI and User objects than it should be.
For example, if I open 5 Explorer windows, my User objects still only gets to 639, and GDI to 705. During normal use, neither usually gets much above 300.
So how many Explorer windows do you have open? Do you have any custom toolbars etc installed?

Also, to see for sure if it's explorer.exe (or something like a toolbar etc. running under its context) do an End Process on it in task manager and see if you can open programs again. If explorer doesn't start back up automatically to give you the start menu etc back, just to to File|Net Task in task manager and type explorer.
minganoAuthor Commented:
I hardly use MSIE for anything... Firefox for almost everything and MSIE for a handful of sites that require.

Isn't explorer.exe used as the local OS and iexplore.exe the browser?  In this instant with MSIE (7 beta) closed explorer.exe has 566 GDI objects and iexplore.exe does not appear.  I open MSIE and iexplore appears with 390 GDIo while explore remains steady at 566.  I close MSIE and iexplore disappears and explorer.exe still doesn't change.

Exploring this has called my attention to something I hadn't noticed before: I have Windows Desktop Search installed on my system.  Every time I do a search the GDI object count for explorer.exe goes up quite a bit and when I close the search results window it goes back down, but never as low as it was before.

For example:
Starting with GDIo 572 I use WDS to look for the word 'house', the results window appears and GDIo is up to 658.  I close the search results window and GDIo is at 574.  I search for 'car' and GDIo is up to 658, close the results window and I am at 575.

However, I was having this problem for several months before I ever installed windows desktop search - there may be a problem with WDS that contributes but it isn't the only problem.
Explorer.exe is the Windows Shell. I wasn't talking about IE at all, when I said Explorer windows, I was talking about Windows Explorer, not Internet Explorer.
Explorer.exe includes all Windows Explorer windows, the taskbar, start menu etc etc etc. However, due to the way IE is integrated into the system, some things installed into IE can affect explorer even when IE is not open. Most notably, some things like Google toolbar and other add-ons have been known to cause some problems with explorer as well.

It's not the GDI that has me curious, it's the User objects mostly. 2896 User objects is extremely high.

Most likely you have some program that uses a shell or explorer extension, and is leaking user objects.
One way to get an idea of what all is running under explorer.exe it to download Process Explorer from....
After extracting it, run it then select Explorer.exe in its window.
Then go to View|Lower Pane View and change it to DLLs

In the bottom window, you should now see a list of all dll extensions explorer.exe is running. Mostly I'd look for any non Microsoft Corporation dlls.
Most likely it's going to be one of those dlls that is leaking user objects, and hopefully with the information it gives you, you can narrow it down to some possible programs to try uninstalling.

For examples of what a user object and gdi object leaks are like check out...
In my experience I've seen them caused by all sorts of different programs, from computer manufacturer utilities, to poorly written virus scanners and so on.
I do see some running processes that I don't recognize, such as MASACui.exe. And just because a process doesn't have high usage, doesn't mean that it doesn't have hooks into explorer.exe that are causing explorer to leak, so it could be any of those.

Process Explorer should at least give you an idea of what is there. If you want, you can list the non-Microsoft dlls, and I can try to help point to things I think are most likely to be culprits.
minganoAuthor Commented:
The following entries have no company name


From Adobe Systems, Inc

From Intel

From Logitech

From Safer Networking Limited

What version of Spybot are you running?
You might try uninstalling it, or turning off SDHelper (It's the browser helper found in the Immunize section).
If that stops the problem and you still want to have SDHelper running, make sure you have the latest version and have downloaded all updates.
Other than that, the processes under explorer look normal. What anti-virus are you running? A bug in it could cause explorer to leak resources as well.
Also might not hurt to post a hijakthis log...
And get the log analyzed at a site like http://hjt.networktechs.com/

I don't think it's a hijack, but it will give me a good list of processes etc. to look for anything that might cause it.
minganoAuthor Commented:
SpyBot 1.3 (I've updated and will watch to see if that makes a difference).

I'm running Norton 2006.

I reran Hijack This! and ran it through the parser which didn't find anything.  I'd paste a copy of the output but it includes all of the details and is a pain to read (like this entry below)

Running processes:
What is it?
Session Manager SubSystem - smss.exe

What does it do?
smss.exe - This is the session manager subsystem, which is responsible for starting the user session. This process is initiated by the system thread and is responsible for various activities, including launching the Winlogon and Win32 (Csrss.exe) processes and setting system variables. After it has launched these processes, it waits for either Winlogon or Csrss to end. If this happens "normally," the system shuts down; if it happens unexpectedly, Smss.exe causes the system to stop responding (hang).

Additional Reading:
Smss.exe does not resolve forward references in environment

You will not be able to end this through task manager!

More info

Virus Precaution:

The smss.exe which is from Microsoft is located at c:windowsSystem32smss.exe . We've been able to find several viruses that run as smss to trick you.

Adware.Advision - Symantec Corporation
Adware.DreamAd - Symantec Corporation
Backdoor.IRC.Aladinz.O - Symantec Corporation
Backdoor.IRC.Flood.F - Symantec Corporation
W32.Dalbug.Worm - Symantec Corporation
W32.Resdoc - Symantec Corporation
minganoAuthor Commented:
I ended up deleting it.  My system is clean (for now) and I can always reinstall if the need arises.  I'll have to watch it for a few days to see if/when it happens again.

Can I set an alarm that notifies me when those two counts get too high?
If you still have the problem (as I did) see the solution here that DOES work: http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Windows/XP/Q_23466385.html
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.