mingano
asked on
Out of resources, but which ones?
XP Pro system in a domained environment, Dell Dimension 2400, P-4 2.4GHz with 1Gb RAM
This is a recurring problem that has persisted for well over 9 months, at times it is worse than others.
5.1.2600 SP2 build 2600
The current uptime of the system is just under 6 days (5d 22h 26m to be exact)
Current environment:
18241 Handles, 711 Threads, 61 Processes
Commit Charge (K)
Total 656044 Limit 2520256 Peak 929564
Physical memory
Total 1046528 Available 395324 System Cache 503244
Kerne Memory (K)
Total 96176 Paged 75656 Nonpaged 20520
Commit Charge: 633M/2461M
In this instant the system is behaving as if there is no available memory: I am unable to open any applications (Adobe Acrobat Reader, for example), or in another example, unable to create a new email in Outlook or a new tab in Firefox.
At times I am unable to open a folder window in My Computer until I close some other open application (any open application, apparently to free up system memory).
When I reboot the system will function normally for some period of time, possibly one day, possibly six then the problem will return until the next reboot.
The system is as free from viruses, worms, trojans and other exploits as it can be, as detected by Norton Antivirus, the most recent version of MS Antispyware (or whatever they are calling it these days), Hijack this, and various online scanners.
It appears that the system is short on -some- system resource, but I have no idea -which- resource it might be.
This is a recurring problem that has persisted for well over 9 months, at times it is worse than others.
5.1.2600 SP2 build 2600
The current uptime of the system is just under 6 days (5d 22h 26m to be exact)
Current environment:
18241 Handles, 711 Threads, 61 Processes
Commit Charge (K)
Total 656044 Limit 2520256 Peak 929564
Physical memory
Total 1046528 Available 395324 System Cache 503244
Kerne Memory (K)
Total 96176 Paged 75656 Nonpaged 20520
Commit Charge: 633M/2461M
In this instant the system is behaving as if there is no available memory: I am unable to open any applications (Adobe Acrobat Reader, for example), or in another example, unable to create a new email in Outlook or a new tab in Firefox.
At times I am unable to open a folder window in My Computer until I close some other open application (any open application, apparently to free up system memory).
When I reboot the system will function normally for some period of time, possibly one day, possibly six then the problem will return until the next reboot.
The system is as free from viruses, worms, trojans and other exploits as it can be, as detected by Norton Antivirus, the most recent version of MS Antispyware (or whatever they are calling it these days), Hijack this, and various online scanners.
It appears that the system is short on -some- system resource, but I have no idea -which- resource it might be.
You more than likely have a leaky system app. No easy way to determine which one. You can also check your settings for performance and page file size. Here http://support.microsoft.com/?kbid=308417 is a good tutorial on how to check and change those settings.
Right-click the Taskbar and hit Task Manager when this ocurrs.
On the Performance tab, look at the Total under Commit Charge. If that is getting higher than the amount of ram you have, then it will cause major slowdowns. If it gets near the number for Limit, then you won't be open anything new without closing others. You can try looking on the processes tab to see which processes are using up large amounts of memory.
If you aren't seriously stressing the system with multiple running progams, most like the cause is a memory leak in some running program or device driver. Finding out which can be a pain, but looking at the processes in Task Manager is a good start.
On the Performance tab, look at the Total under Commit Charge. If that is getting higher than the amount of ram you have, then it will cause major slowdowns. If it gets near the number for Limit, then you won't be open anything new without closing others. You can try looking on the processes tab to see which processes are using up large amounts of memory.
If you aren't seriously stressing the system with multiple running progams, most like the cause is a memory leak in some running program or device driver. Finding out which can be a pain, but looking at the processes in Task Manager is a good start.
ASKER
I've never gotten the commit charge above 60% of actual physical memory (1 Gb) and peak has never been noted to equal physical memory. In this instance the numbers were:
Commit Charge (K)
Total 656044 Limit 2520256 Peak 929564
Commit Charge (K)
Total 656044 Limit 2520256 Peak 929564
Guess I could have read that information from the initial post, it's amazing how blind I can be at times. Well at one point Commit Charge was close to the amount of physical RAM then (Peak is equal to the highest value Commit Charge has been since the last reboot), however while it has gotten high enough to slow the system down at times, it doesn't look high enough to run out of resources. It is pushing it a little bit though, I wouldn't want my peak getting that close to the phyiscal amount very often, and even the current commit charge of 656mb is a little high. With those numbers I probably would recommend adding some more memory even without the resources issue.
But back to the issue at hand....sounds like it might be a GDI resource problem. In Task Manager, go to the Processes Tab. Hit View|Select Columns....
Select GDI Objects.
Now look through the running processes for anything with an extraordinarily high amount of GDI Objects.
But back to the issue at hand....sounds like it might be a GDI resource problem. In Task Manager, go to the Processes Tab. Hit View|Select Columns....
Select GDI Objects.
Now look through the running processes for anything with an extraordinarily high amount of GDI Objects.
Wouldn't hurt to select User Objects as well ad GDI objects.
ASKER
The problem happens to be showing up in this very instant. Among other (typical) symptoms - double clicks to open a subfolder are ignored until I close two tabs of Firefox.
GDI Objects:
Explorer.exe 879
Outlook.exe 374
brctrcen.exe 296
MASACui.exe 293
WindowsSearch.exe 219
taskmgr.exe 105
CCAPP.exe 99
Firefox.exe 86
gaim.exe 83
ctfmon.exe 82
WISPTIS.exe 52
winlogon.exe 48
MMDiag.exe 39
mim.exe 36
and several others, all with about 20 or fewer
User objects:
explorer.exe 2896
masscui.exe 339
outlook.exe 256
taskmgr.exe 117
ccapp.exe 107
and all of the others all under 100
Handles: 16135 Threads: 656 Processes: 56
Commit Charge total: 605728 Limit: 2520256 Peak: 878672
Physical Memory: 1046528 Available: 423560 System Cache: 535432
Kernel Memory Total: 95152 Paged: 79948 Nonpaged 15204
GDI Objects:
Explorer.exe 879
Outlook.exe 374
brctrcen.exe 296
MASACui.exe 293
WindowsSearch.exe 219
taskmgr.exe 105
CCAPP.exe 99
Firefox.exe 86
gaim.exe 83
ctfmon.exe 82
WISPTIS.exe 52
winlogon.exe 48
MMDiag.exe 39
mim.exe 36
and several others, all with about 20 or fewer
User objects:
explorer.exe 2896
masscui.exe 339
outlook.exe 256
taskmgr.exe 117
ccapp.exe 107
and all of the others all under 100
Handles: 16135 Threads: 656 Processes: 56
Commit Charge total: 605728 Limit: 2520256 Peak: 878672
Physical Memory: 1046528 Available: 423560 System Cache: 535432
Kernel Memory Total: 95152 Paged: 79948 Nonpaged 15204
Wow, Explorer is using way more GDI and User objects than it should be.
For example, if I open 5 Explorer windows, my User objects still only gets to 639, and GDI to 705. During normal use, neither usually gets much above 300.
So how many Explorer windows do you have open? Do you have any custom toolbars etc installed?
Also, to see for sure if it's explorer.exe (or something like a toolbar etc. running under its context) do an End Process on it in task manager and see if you can open programs again. If explorer doesn't start back up automatically to give you the start menu etc back, just to to File|Net Task in task manager and type explorer.
For example, if I open 5 Explorer windows, my User objects still only gets to 639, and GDI to 705. During normal use, neither usually gets much above 300.
So how many Explorer windows do you have open? Do you have any custom toolbars etc installed?
Also, to see for sure if it's explorer.exe (or something like a toolbar etc. running under its context) do an End Process on it in task manager and see if you can open programs again. If explorer doesn't start back up automatically to give you the start menu etc back, just to to File|Net Task in task manager and type explorer.
ASKER
I hardly use MSIE for anything... Firefox for almost everything and MSIE for a handful of sites that require.
Isn't explorer.exe used as the local OS and iexplore.exe the browser? In this instant with MSIE (7 beta) closed explorer.exe has 566 GDI objects and iexplore.exe does not appear. I open MSIE and iexplore appears with 390 GDIo while explore remains steady at 566. I close MSIE and iexplore disappears and explorer.exe still doesn't change.
Exploring this has called my attention to something I hadn't noticed before: I have Windows Desktop Search installed on my system. Every time I do a search the GDI object count for explorer.exe goes up quite a bit and when I close the search results window it goes back down, but never as low as it was before.
For example:
Starting with GDIo 572 I use WDS to look for the word 'house', the results window appears and GDIo is up to 658. I close the search results window and GDIo is at 574. I search for 'car' and GDIo is up to 658, close the results window and I am at 575.
However, I was having this problem for several months before I ever installed windows desktop search - there may be a problem with WDS that contributes but it isn't the only problem.
Isn't explorer.exe used as the local OS and iexplore.exe the browser? In this instant with MSIE (7 beta) closed explorer.exe has 566 GDI objects and iexplore.exe does not appear. I open MSIE and iexplore appears with 390 GDIo while explore remains steady at 566. I close MSIE and iexplore disappears and explorer.exe still doesn't change.
Exploring this has called my attention to something I hadn't noticed before: I have Windows Desktop Search installed on my system. Every time I do a search the GDI object count for explorer.exe goes up quite a bit and when I close the search results window it goes back down, but never as low as it was before.
For example:
Starting with GDIo 572 I use WDS to look for the word 'house', the results window appears and GDIo is up to 658. I close the search results window and GDIo is at 574. I search for 'car' and GDIo is up to 658, close the results window and I am at 575.
However, I was having this problem for several months before I ever installed windows desktop search - there may be a problem with WDS that contributes but it isn't the only problem.
Explorer.exe is the Windows Shell. I wasn't talking about IE at all, when I said Explorer windows, I was talking about Windows Explorer, not Internet Explorer.
Explorer.exe includes all Windows Explorer windows, the taskbar, start menu etc etc etc. However, due to the way IE is integrated into the system, some things installed into IE can affect explorer even when IE is not open. Most notably, some things like Google toolbar and other add-ons have been known to cause some problems with explorer as well.
It's not the GDI that has me curious, it's the User objects mostly. 2896 User objects is extremely high.
Most likely you have some program that uses a shell or explorer extension, and is leaking user objects.
One way to get an idea of what all is running under explorer.exe it to download Process Explorer from....
http://www.sysinternals.com/Utilities/ProcessExplorer.html
After extracting it, run it then select Explorer.exe in its window.
Then go to View|Lower Pane View and change it to DLLs
In the bottom window, you should now see a list of all dll extensions explorer.exe is running. Mostly I'd look for any non Microsoft Corporation dlls.
Most likely it's going to be one of those dlls that is leaking user objects, and hopefully with the information it gives you, you can narrow it down to some possible programs to try uninstalling.
For examples of what a user object and gdi object leaks are like check out...
http://www.sysinternals.com/Forum/forum_posts.asp?TID=6005&PN=1
http://blogs.msdn.com/jonathanh/archive/2004/07/18/187040.aspx
In my experience I've seen them caused by all sorts of different programs, from computer manufacturer utilities, to poorly written virus scanners and so on.
I do see some running processes that I don't recognize, such as MASACui.exe. And just because a process doesn't have high usage, doesn't mean that it doesn't have hooks into explorer.exe that are causing explorer to leak, so it could be any of those.
Process Explorer should at least give you an idea of what is there. If you want, you can list the non-Microsoft dlls, and I can try to help point to things I think are most likely to be culprits.
Explorer.exe includes all Windows Explorer windows, the taskbar, start menu etc etc etc. However, due to the way IE is integrated into the system, some things installed into IE can affect explorer even when IE is not open. Most notably, some things like Google toolbar and other add-ons have been known to cause some problems with explorer as well.
It's not the GDI that has me curious, it's the User objects mostly. 2896 User objects is extremely high.
Most likely you have some program that uses a shell or explorer extension, and is leaking user objects.
One way to get an idea of what all is running under explorer.exe it to download Process Explorer from....
http://www.sysinternals.com/Utilities/ProcessExplorer.html
After extracting it, run it then select Explorer.exe in its window.
Then go to View|Lower Pane View and change it to DLLs
In the bottom window, you should now see a list of all dll extensions explorer.exe is running. Mostly I'd look for any non Microsoft Corporation dlls.
Most likely it's going to be one of those dlls that is leaking user objects, and hopefully with the information it gives you, you can narrow it down to some possible programs to try uninstalling.
For examples of what a user object and gdi object leaks are like check out...
http://www.sysinternals.com/Forum/forum_posts.asp?TID=6005&PN=1
http://blogs.msdn.com/jonathanh/archive/2004/07/18/187040.aspx
In my experience I've seen them caused by all sorts of different programs, from computer manufacturer utilities, to poorly written virus scanners and so on.
I do see some running processes that I don't recognize, such as MASACui.exe. And just because a process doesn't have high usage, doesn't mean that it doesn't have hooks into explorer.exe that are causing explorer to leak, so it could be any of those.
Process Explorer should at least give you an idea of what is there. If you want, you can list the non-Microsoft dlls, and I can try to help point to things I think are most likely to be culprits.
ASKER
The following entries have no company name
C_28591.NLS
CTYPE.NLS
index.dat
INDEX.DAT
INDEX.DAT
localte.nls
SORTKEY.NLS
sorttbls.nls
UNICODE.NLS
From Adobe Systems, Inc
pdfshell.dll
From Intel
hccutils.dll
igfxdev.dll
igfxpph.dll
igfxres.dll
igfxsrvc.dll
From Logitech
LGMSGHK.DLL
LgWndHk.dll
From Safer Networking Limited
SDHelper.dll
C_28591.NLS
CTYPE.NLS
index.dat
INDEX.DAT
INDEX.DAT
localte.nls
SORTKEY.NLS
sorttbls.nls
UNICODE.NLS
From Adobe Systems, Inc
pdfshell.dll
From Intel
hccutils.dll
igfxdev.dll
igfxpph.dll
igfxres.dll
igfxsrvc.dll
From Logitech
LGMSGHK.DLL
LgWndHk.dll
From Safer Networking Limited
SDHelper.dll
What version of Spybot are you running?
You might try uninstalling it, or turning off SDHelper (It's the browser helper found in the Immunize section).
If that stops the problem and you still want to have SDHelper running, make sure you have the latest version and have downloaded all updates.
You might try uninstalling it, or turning off SDHelper (It's the browser helper found in the Immunize section).
If that stops the problem and you still want to have SDHelper running, make sure you have the latest version and have downloaded all updates.
Other than that, the processes under explorer look normal. What anti-virus are you running? A bug in it could cause explorer to leak resources as well.
Also might not hurt to post a hijakthis log...
http://www.merijn.org/downloads.html
And get the log analyzed at a site like http://hjt.networktechs.com/
I don't think it's a hijack, but it will give me a good list of processes etc. to look for anything that might cause it.
http://www.merijn.org/downloads.html
And get the log analyzed at a site like http://hjt.networktechs.com/
I don't think it's a hijack, but it will give me a good list of processes etc. to look for anything that might cause it.
ASKER
SpyBot 1.3 (I've updated and will watch to see if that makes a difference).
I'm running Norton 2006.
I reran Hijack This! and ran it through the parser which didn't find anything. I'd paste a copy of the output but it includes all of the details and is a pain to read (like this entry below)
Running processes:
C:\WINDOWS\System32\smss.e
Smss.exe
What is it?
Session Manager SubSystem - smss.exe
What does it do?
smss.exe - This is the session manager subsystem, which is responsible for starting the user session. This process is initiated by the system thread and is responsible for various activities, including launching the Winlogon and Win32 (Csrss.exe) processes and setting system variables. After it has launched these processes, it waits for either Winlogon or Csrss to end. If this happens "normally," the system shuts down; if it happens unexpectedly, Smss.exe causes the system to stop responding (hang).
Additional Reading:
Smss.exe does not resolve forward references in environment
You will not be able to end this through task manager!
More info
Virus Precaution:
The smss.exe which is from Microsoft is located at c:windowsSystem32smss.exe . We've been able to find several viruses that run as smss to trick you.
Adware.Advision - Symantec Corporation
Adware.DreamAd - Symantec Corporation
Backdoor.IRC.Aladinz.O - Symantec Corporation
Backdoor.IRC.Flood.F - Symantec Corporation
W32.Dalbug.Worm - Symantec Corporation
W32.Resdoc - Symantec Corporation
I'm running Norton 2006.
I reran Hijack This! and ran it through the parser which didn't find anything. I'd paste a copy of the output but it includes all of the details and is a pain to read (like this entry below)
Running processes:
C:\WINDOWS\System32\smss.e
Smss.exe
What is it?
Session Manager SubSystem - smss.exe
What does it do?
smss.exe - This is the session manager subsystem, which is responsible for starting the user session. This process is initiated by the system thread and is responsible for various activities, including launching the Winlogon and Win32 (Csrss.exe) processes and setting system variables. After it has launched these processes, it waits for either Winlogon or Csrss to end. If this happens "normally," the system shuts down; if it happens unexpectedly, Smss.exe causes the system to stop responding (hang).
Additional Reading:
Smss.exe does not resolve forward references in environment
You will not be able to end this through task manager!
More info
Virus Precaution:
The smss.exe which is from Microsoft is located at c:windowsSystem32smss.exe . We've been able to find several viruses that run as smss to trick you.
Adware.Advision - Symantec Corporation
Adware.DreamAd - Symantec Corporation
Backdoor.IRC.Aladinz.O - Symantec Corporation
Backdoor.IRC.Flood.F - Symantec Corporation
W32.Dalbug.Worm - Symantec Corporation
W32.Resdoc - Symantec Corporation
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I ended up deleting it. My system is clean (for now) and I can always reinstall if the need arises. I'll have to watch it for a few days to see if/when it happens again.
Can I set an alarm that notifies me when those two counts get too high?
Can I set an alarm that notifies me when those two counts get too high?
If you still have the problem (as I did) see the solution here that DOES work: https://www.experts-exchange.com/questions/23466385/Insufficient-Windows-resources-to-open-applications.html