Windows Memory

Extract from The Guardian article windows-pc-running-out-of-memory

I have a four-year-old Windows desktop that frequently runs really slowly with Task Manager showing that 80-90% of the physical memory is being used even when I’m not running any applications. Svchost.exe seems to be the culprit, and sometimes RapportService.exe *32. I did a software spring clean as your column suggested but it didn’t help.

My PC is an HP CQ5307UK desktop, with a 2.90GHz AMD Athlon II X3 435 processor and 3GB of memory running Microsoft Windows 7 and Norton Internet Security. I use Microsoft Office Pro and Mailwasher. Judith

Modern versions of Windows – the ones that followed Windows XP – are designed to use all your PC’s physical memory: that’s what it’s there for. Either way, 3GB of memory plus a 4GB swapfile (a hidden file called pagefile.sys) is more than enough for the software you’re running.

Windows could be running slowly because a program or device driver is leaking memory, because you don’t have enough disk space, because a rogue process is running your processor at close to 100%, because your PC is overheating, or because of a virus or other malware.

Since you’ve asked about memory use, I’ll concentrate on that. However, make sure you have at least 5GB of free hard disk space, in case Windows needs to expand its swapfile. Also, run a quick scan with the free Malwarebytes Anti-Malware (MBAM) as a one-off check to make sure nothing has got past your anti-virus software. (Click here to view Malwarebytes Wikipedia article.)

Free memory

Windows Task Manager is not a reliable guide to how much memory is free. Happily, Windows 7 has Performance Monitor. You can find PerfMon by typing pe or perf into the run box at the bottom of the Start menu. After you run it, click “Resource monitor” to get the readout below.

An even better guide is Mark Russinovich’s free RAMMap, which you can download from the Windows Sysinternals section of Microsoft’s website. (Russinovich’s tools were so good that Microsoft bought the company.)

As mentioned, recent versions of Windows try to fill your PC’s memory: a program called SuperFetch looks for any free memory, and loads something into it. SuperFetch knows which programs you use, and silently preloads them. It’s much quicker to run things from memory than to fetch them from the hard drive.

This makes it hard to answer the question about how much “free” memory you have at any given time. However, PerfMon and RAMMap do give you a reasonable answer in the form of “Available memory”.

In the example shown here, I have about 2GB in use and more than 800MB available. This PC is running Firefox, Chrome and Internet Explorer as well as Microsoft Word, PerfMon, RAMMap and the Freecell card game.

Reboot your PC and see how much memory is available. Don’t run anything else for 15-30 minutes to see if that changes: you may have a “memory leak” (ie a program keeps taking more memory and not giving it back).

After that, load your programs one at a time to see how much memory each one takes, and whether your PC slows down. If a program creates the problem, uninstall it. If you can’t manage without it, re-install it and hope it behaves itself in future.

Memory by the page

PerfMon shows that Windows uses pages of memory in many different ways. The main ones are Active (ie running programs), Modified, Standby, and Free memory. RAMMap provides a fuller picture by including Zeroed memory, and by showing how much memory is used for different purposes.

Basically, most memory is free unless it’s in active use. If Windows needs more memory, it can instantly use Zeroed pages: these are blank. After that it can instantly use Standby pages, which may have been loaded by SuperFetch or left behind after you’ve closed a program. (These pages are not zeroed so if you restart the program, it will load very quickly. But they don’t need to be saved.) Next, Windows can use Modified pages, after saving them. Having to write data to disk slows the process, so this is not listed as available memory. However, it is still available if you need it.

Need more? Windows can start “trimming” pages that programs have reserved for active use. It can decide to use that memory for more urgent purposes.

Some memory isn’t available. There are the Page Tables (Windows’ index of pages of memory), a “Nonpaged Pool” (pages that can’t be saved to disk and must stay in RAM), Driver Locked memory (probably locked by a virtual machine, such as Hyper-V or VMware), and AWE (usually, memory being managed by SQL Server).

On my five-year-old laptop running Windows 7, the Page Table is 37MB, the Nonpaged Pool is 180MB, and Driver Locked is 42MB. PCs obviously vary. However, large values could indicate problems that hurt Windows’ performance.

You can use RAMMap to save and compare snapshots. For example, you can take a snapshot of memory when your PC is running well, and compare it with one where it is running slowly.

Problem software

You mention Svchost.exe and RapportService.exe *32 as programs that consume a lot of resources. Svchost.exe is short for “service host”, and your PC is running multiple instances of svchost to host different services. If you download and run Sysinternals’ Process Explorer– another of Russinovich’s tools, and a good replacement for Task Manager – this should show lots of svchosts (perhaps eight or 10) and the various Windows services they are running.

If a particular instance of svchost is a repeat offender, search for help about the service(s) it is hosting. Sometimes you can repair services via a Windows Update or system refresh, or change the way they work. Type local into the run box and select “View local services” to see which ones your PC is running, and whether they start automatically.

RapportService.exe *32 comes from Trusteer, an IBM company, and is usually installed with banking software. Rapport is a small program and should not have any impact on your CPU or RAM. If you don’t bank online, you can uninstall it.

Both svchost.exe and RapportService.exe are names that could be used by malware to hide their nefarious purposes, so don’t forget to run MBAM.

The Windows Indexing Service – which can be turned off – and Norton can also cause PCs to slow down.

Upgrade or refresh?

It’s always better to have more memory. Unfortunately, your HP/Compaq only allows 4GB, so expanding from 3GB is not an economical option.

According to HP, you could also upgrade the AMD Athlon II X3 435 (Passmark 2,496), but none of the Phenom II alternatives looks fast enough to be worth the cost or the effort.

That leaves you trying to find the errant software, rogue process or leaky driver that is slowing your PC, or trying alternative solutions. One would be to upgrade all your drivers. Another would be to use the PC’s recovery partition (I assume it has one) to refresh or re-install Windows 7. That’s not much fun with an old system, because Windows Update will have to reinstall four years’ worth of patches. Based on my experience, this should go smoothly, but involves about a dozen restarts spread over two or three days.

The drawback is that you will also have to re-install all your applications and restore your backed-up data.

If you do this, take a full back-up of your hard drive first, so that you can restore your PC to its current state if something goes wrong. And when you’ve finished, take another full hard drive backup so that you never have to repeat the whole process.

** End of article