50% Memory Usage While Idling

[OGFreeze]

Hey guys, my computer has been running super sluggish so I opened up task manager on a fresh start and my computer is using 50% memory (8GB) while idling. A few months back I had 4 different viruses on my computer. Two were Rootkit.Fileless.MTGen. One was a registry value and the other a registry key. The other two, Trojan.Fileless.MTGen. One being a registry value and the other a file. This is going to sound crazy and I'm not sure if it's even possible but I believe they came from an old webcam I attached to my computer.

Once I discovered the viruses, I decided to completely wipe my computer clean. Deleted partitions and everything. Fresh install. The computer was still sluggish after that but no viruses detected. I did another complete wipe and it seemed to be much better. It's been about 3 months now and I have not had any sluggish episodes happen until today. Also a few times in those 3 months the computer would completely turn on by itself a few times. One time I returned to the computer after 100% shutting it off to find it back on with the cursor hovering over file explorer in the start menu.

So my question is, is this virus STILL on my computer somehow running in the background undetected causing the memory to be so high? I'm still pretty new to computers so I didn't even check memory usage when I had the virus so I'm not sure if it was the same case a few months back. I use Kaspersky Total Security and it is not finding anything in safe mode scans. I'm providing screenshots of the task manager process and performance tabs from a fresh start. Any help is appreciated. Thanks!

PC Specs
i7-4790k
MSI Z97 gaming
Evga GTX 970
G.Skill Ripjaws X 16gb 2133


http://imgur.com/N17wh1l
http://imgur.com/c95GXEL

 

[lakimens]

Try Resource Monitor at the bottom of the Performance tab in Task Manager, see what that tells you.
If you completely emptied the HDD and reinstalled Windows, there is no way that the virus would stay and be still be active.

 

[OGFreeze]

Try Resource Monitor at the bottom of the Performance tab in Task Manager, see what that tells you.
If you completely emptied the HDD and reinstalled Windows, there is no way that the virus would stay and be still be active.

Not sure what I'm looking for so I got a screenshot of it.
http://imgur.com/4ztVmp7

 

[lakimens]

This seems like a solution.

what is paged/non-paged pool if i might ask?

Essentially, and this is how it was explained to me some time ago, the paged pool is the section of RAM that's available as and when. When you load up task manager or resource monitor or anything like that, the running processes and threads, they use this pool.

Drivers and key system processes use the non-paged pool. The main difference between the two is that the paged pool can go down, as things stop using it - the non-paged pool doesn't. It gets reserved and stays reserved, so that something important won't suddenly find itself without an allocated space.

From the looks of it, you have a memory leak. A driver or something similar is drawing large amounts of RAM and reserving it, meaning that with every increment what you have available is technically lower.

This would also explain why on some restarts this happens - if the driver kicks in immediately, then it will start to draw that RAM straight away.

The hard part, technically speaking, is identifying the driver in question that's causing this. It could be an old USB device plugged in a year ago, it could be the graphics driver, it could be the keyboard or mluse - there is a handy guide for identifying whether this is the case here:

http://blogs.technet.com/b/markrussinovich/archive/2009/03/26/3211216.aspx

It should be fully compatible with Windows 10, so long as you make use of the WDK driver kit.

To be completely honest, though, you could spend a whole day following those instructions to the letter and only succeed in identifying the driver; I'd never recommend deleting it straight from explorer so unless there's an updated version you'd need to use some form of uninstaller to make sure it's completely gone.

If I were in this position, I would consider a full re-installation of Windows, fresh to 10 - naturally, though, this can also be more trouble than it's worth.

Before making any decision though, have you tried booting into safe mode? Give that a go, and see if the leak is still present. Only core drivers are loaded, so that should at least narrow it down to non-Windows as the culprit.

Or put us back to square one, unfortunately.

Booting to Safe Mode:

http://www.tenforums.com/tutorials/2304-safe-mode-start-windows-10-a.html

Source: http://www.tomshardware.co.uk/answers/id-2760871/ram-usage-idle.html

 

[OGFreeze]

This seems like a solution.

what is paged/non-paged pool if i might ask?

Essentially, and this is how it was explained to me some time ago, the paged pool is the section of RAM that's available as and when. When you load up task manager or resource monitor or anything like that, the running processes and threads, they use this pool.

Drivers and key system processes use the non-paged pool. The main difference between the two is that the paged pool can go down, as things stop using it - the non-paged pool doesn't. It gets reserved and stays reserved, so that something important won't suddenly find itself without an allocated space.

From the looks of it, you have a memory leak. A driver or something similar is drawing large amounts of RAM and reserving it, meaning that with every increment what you have available is technically lower.

This would also explain why on some restarts this happens - if the driver kicks in immediately, then it will start to draw that RAM straight away.

The hard part, technically speaking, is identifying the driver in question that's causing this. It could be an old USB device plugged in a year ago, it could be the graphics driver, it could be the keyboard or mluse - there is a handy guide for identifying whether this is the case here:

http://blogs.technet.com/b/markrussinovich/archive/2009/03/26/3211216.aspx

It should be fully compatible with Windows 10, so long as you make use of the WDK driver kit.

To be completely honest, though, you could spend a whole day following those instructions to the letter and only succeed in identifying the driver; I'd never recommend deleting it straight from explorer so unless there's an updated version you'd need to use some form of uninstaller to make sure it's completely gone.

If I were in this position, I would consider a full re-installation of Windows, fresh to 10 - naturally, though, this can also be more trouble than it's worth.

Before making any decision though, have you tried booting into safe mode? Give that a go, and see if the leak is still present. Only core drivers are loaded, so that should at least narrow it down to non-Windows as the culprit.

Or put us back to square one, unfortunately.

Booting to Safe Mode:

http://www.tenforums.com/tutorials/2304-safe-mode-start-windows-10-a.html

Source: http://www.tomshardware.co.uk/answers/id-2760871/ram-usage-idle.html

Started it up in safe mode and it was at 4% memory usage. Ran another full scan of the computer while in safe mode. Started the computer back up now I'm at only 10% memory usage??

 

[lakimens]

Seems like problem solved. Scanning in safe mode is always better, because Windows is the only thing running.