Major excessive non-paged pool problem

Topic

New Reply

I’ve been struggling with a major non-paged pool problem for the past several weeks and I now strongly suspect KB5022834 (released Feb 14, 2023) caused the problem. However, I have no evidence.

FWIW, I confirmed my PC memory is A-OK by running repeated passes of Memtest86+ overnight with no faults found. Reviewing reliability monitor and event viewer revealed nothing other than many crashes and bugchecks which were symptoms of physical memory (32GB) being at 98-99% and non-paged pool exceeding 30GB (normally 300-400MB immediately after a system restart).

Normally I use 25-35% of physical memory.

So, my next move is to remove KB5022834 from my system.

What is the procedure to uninstall KB5022834?

I’m running Win 10 Pro 21H2 OS build 19044.2604.

Any advice and/or comments welcomed!

Reply | Quote

Replies

Settings\Update & Security\Windows Update\View Update History
At the top, there is a link “Uninstall updates”
That is actually a list of the installed updates.
Highlight the update – if it can be uninstalled, you will have the choice to uninstall/change.

You cannot uninstall SSUs

Reply | Quote

Thanks for the reply.

Unfortunately, KB5022834 is not eligible for removal. See attachment.

 

Reply | Quote

Did you ask for a procedure and then not follow it?

(The error message is from WuMgr?)

Windows 11 Pro version 22H2 build 22621.2359 + Microsoft 365 + Edge

Reply | Quote

Best to diagnose which process is consuming memory by running Window’s task manager and Process Explorer. Although a Windows Update might trigger the problem, the cause might be elsewhere.  Were any drivers updated along with Windows Update?

Windows 10 22H2 desktops & laptops on Dell, HP, ASUS; No servers, no domain.

1 user thanked author for this post.

satrow

Reply | Quote

Add PoolMon to the list; Use PoolMon to find a kernel-mode memory leak

Reply | Quote

b wrote:

Did you ask for a procedure and then not follow it?

(The error message is from WuMgr?)

I cannot follow the procedure as described by PKCano.

I have WuMgr installed which replaces Windows Update (via Settings).

In any case, the result is the same.

Reply | Quote

unbob wrote:

I have WuMgr installed

No, you don’t. WUmgr is a portable app. No install/uninstall.

Reply | Quote

oldfry wrote:

Best to diagnose which process is consuming memory by running Window’s task manager and Process Explorer. Although a Windows Update might trigger the problem, the cause might be elsewhere.  Were any drivers updated along with Windows Update?

Thanks, but I long ago tried that and quickly determined this is not a process problem but rather a driver problem.

Using Poolmon, I identified the culprit as a driver with a pooltag of “HalB” (see attachment image) using ~23.5GB of physical memory (non-paged pool) of 32GB total installed. I’ve observed it exceeding 30GB!! before hanging the system. But I’m currently stumped because I’ve been unable to further identify the driver – ie, driver device, driver name, driver vendor/company, etc?

Unfortunately, “HalB” is not listed in Microsoft’s pooltag.txt so no help there.

I found this thread https://social.msdn.microsoft.com/Forums/machinelearning/en-US/a9244f43-5190-4d25-ad5c-11182f56ba69/what-process-owns-nonpaged-pooltag-halb?forum=wptk_v4 but “HalB” was not identified.

Anyone who can tell me what the “HalB” driver actually is and who the author/owner is will definitely be my hero!

Reply | Quote

Are you running a remote workforce?

https://kb.parallels.com/en/123607

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

1 user thanked author for this post.

satrow

Reply | Quote

Alex5723 wrote:

unbob wrote:

I have WuMgr installed

No, you don’t. WUmgr is a portable app. No install/uninstall.

Okay, you got me there. Technically not “installed” – it’s a portable app.

Reply | Quote

geekdom wrote:

Are you running a remote workforce?

https://kb.parallels.com/en/123607

No. Not running a remote workforce.

I’m just a retired at-home Win10 user.

Re “HAL”, I’m assuming it’s something to do with Hardware Abstraction Layer but that’s just a wild guess.

https://duckduckgo.com/?t=ffab&q=intel+Hardware+Abstraction+Layer&ia=duckassist

Reply | Quote

unbob wrote:

So, my next move is to remove KB5022834 from my system.

unbob wrote:

Unfortunately, KB5022834 is not eligible for removal.

If you want to remove the LCU

To remove the LCU after installing the combined SSU and LCU package, use the DISM/Remove-Package command line option with the LCU package name as the argument. You can find the package name by using this command: DISM /online /get-packages.

Running Windows Update Standalone Installer (wusa.exe) with the /uninstall switch on the combined package will not work because the combined package contains the SSU. You cannot remove the SSU from the system after installation.

February 14, 2023—KB5022834 (OS Builds 19042.2604, 19044.2604, and 19045.2604)

Windows 11 Pro version 22H2 build 22621.2359 + Microsoft 365 + Edge

Reply | Quote

This link:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/147a2db6-6701-4caf-a34d-4f345ecff0f5/what-process-owns-nonpaged-pooltag-halb?forum=winserver8gen
includes the following statement:

“I re-searched for HalB in system32\drivers and found no .sys files that contain references to it. I did find three .dll files in system32 that do: bcdsrv, hal, and PSHED.”

bcdsrc.dll = Boot Configuration Data COM Server
hal.dll = Hardware Abstraction Layer
pshed.dll = Platform Specific Hardware Error Driver

Does the memory leak happen in safe mode?
Make, model, age, BIOS version, of Windows machine?
Last [good] image backup?
Any errors (red) when running Device Manager?

Another related link:
https://learn.microsoft.com/en-us/answers/questions/224471/memory-leak-trying-to-figure-out-whats-causing-it

Video driver info?

Windows 10 22H2 desktops & laptops on Dell, HP, ASUS; No servers, no domain.

Reply | Quote