Nonpaged Pool Memory Leak

[riccasto]

Hi all,

 

I'm having problem with Immunet 3.0.6.x and 3.0.8.9025 (older ones not tested) running on some Windows 2008R2 x64 SP1, the servers are hosting a heavily used SQL2008 streaming databases populated by a couple of services that picks up file from other servers in the local area network, so high disk and network I/O.

 

After a few hours I can see that the nonpaged pool memory grow from 30 to 150 MB while the agent.exe used memory remain around 12/15MB. If I stop Immunet the nonpaged pool does not decrease and when I start it again the nonpaged pool start to grow too.

 

I've tried to exclude files and folders (and the whole drives too) and to disable scanning options such as protection options, detection engines options and other things up to disable almost all Immunet features.

 

All the servers behaves as such, with poolmon.exe I can see that all nonpaged pool memory is consumed by Immunet drivers as ImmunetProtect.sys and ImmunetSelfProtect.sys.

 

I'll send Immunet Support Tool data via email.

 

Thanks

[nwarshawski@sourcefire.com]

Hi riccasto,

 

Thanks for the submission. We've received the Support Tool and are looking into this, and will get back to you ASAP.

 

Nick

[Rob.T]

Hi Riccasto, I'm working on reproducing this - would you mind sending a screenshot of your poolmon usage to support@immunet.com? Also, can you tell me how you're stopping & restarting Immunet?