Re: Wyciek alokacji pamięci nietablicowanej w DC W2000

Oto kawalek snapshota posortowany po Diff
Na starcie serwera procesy McOp i McFN mają wartości Diff około 32000.
Chyba mamy zwycięzcę - Anti-Virus Mini-Firewall Driver w wersji 8.0 od
Network Associates, Inc
Czyli krótko mówiąc Virus Scan Enterprise 8.0
Dziękuję za zainteresowanie tematem.
Zaczynam walkę z NAI.
Pozdrawiam

Robert

 Memory: 1048048K Avail: 462348K PageFlts: 177 InRam Krnl: 1892K
P:40632K
 Commit: 443028K Limit:2521984K Peak: 446156K Pool N:37692K
P:40788K
 System pool information
 Tag Type Allocs Frees Diff Bytes Per
Alloc

 McOp Nonp 95060 ( 4) 970 ( 0) 94090 9032640 ( 384)
96
 McFN Nonp 99297 ( 4) 5220 ( 0) 94077 11921696 ( 256)
126
 File Nonp 899923 ( 185) 894310 ( 188) 5613 959904 ( -480)
171
 Ntfr Nonp 14323 ( 0) 9106 ( 0) 5217 334880 ( 0)
64
 Vad Nonp 146455 ( 13) 142681 ( 13) 3774 241536 ( 0)
64
 NtFs Nonp 38904 ( 0) 35191 ( 0) 3713 238240 ( 0)
64
 Ntfn Nonp 20352 ( 0) 16640 ( 0) 3712 238208 ( 0)
64
 Even Nonp 1460313097 (345623) 1460309614 (345626) 3483 222912
  -192) 64
 FSfm Nonp 13547 ( 1) 10364 ( 0) 3183 203712 ( 64)
64
 MmCa Nonp 63062 ( 5) 60051 ( 4) 3011 381696 ( 128)
126
 Mdl Nonp 117612 ( 0) 115488 ( 72) 2124 271872 ( -9216)
128
 ReEv Nonp 5739 ( 0) 3835 ( 0) 1904 60928 ( 0)
32

Oto kawałek snapshota ze startu serwera. Razem z tagami

 Tag Type Allocs Frees Diff Bytes Per Alloc
Mapped_Driver

 McOp Nonp 30858 213 30645 2941920 96 Unknown
Driver
 McFN Nonp 32209 1576 30633 3673120 119
[mvstdi5x]
 Ntfr Nonp 9667 2494 7173 460064 64
[ntfs][ntfs.sys - ERESOURCE]
 File Nonp 325424 318616 6808 1181856 173
[<unknown> - File objects]
 Ntfn Nonp 11301 6079 5222 334848 64
[ntfs][ntfs.sys - SCB_NONPAGED]
 NtFs Nonp 21530 16317 5213 334240 64
[ntfs][ntfs.sys - StrucSup.c]
 MmSt Paged 9795 4953 4842 5545408 1145
[nt!mm - Mm section object prototype ptes]
 FSfm Nonp 7157 2478 4679 299456 64
[nt!fsrtl - File System Run Time Fast Mutex Lookaside List]
 FSim Paged 7027 2479 4548 582144 128
[nt!fsrtl - File System Run Time Mcb Initial Mapping Lookas
 MmCa Nonp 16803 12500 4303 547072 127
[nt!mm - Mm control areas for mapped files]
 MmSm Paged 8186 3998 4188 268032 64
 [nt!mm - segments used to map data files]
 Vad Nonp 22104 18558 3546 226944 64
[nt!mm - Mm virtual address descriptors]
 NtfF Paged 7483 4113 3370 3343040 992
[ntfs.sys - FCB_INDEX]
 Ntfo Paged 11856 8501 3355 371200 110
[ntfs][ntfs.sys - SCB_INDEX normalized named buffer]
 Even Nonp 155625618 155622356 3262 208768 64
[<unknown> - Event objects]
Received on Thu Dec 9 09:55:27 2004