Windows explorer.exe Memory Leak

To whoever assists me, I would like to express my appreciation for your time reading through this post and assisting me. I apologize for the length of this as I try to explain everything I have done to research, learn, and try and troubleshoot myself. I really believe I have done my due diligence with research to resolve this myself before reaching out via Tech Forums.

I have multiple PC's and the leak seems to be only on PC's with AMD chipsets (with CPU / GPU combo ). Restarting the shell Explorer.exe or clearing the working memory set in VMMAP will clear the ram.

- I have tried updating Windows to the latest. I have tried updating AMD drivers to the latest.
- I have also ran "sfc /scannow" and "DISM.exe /Online /Cleanup-image /Restorehealth"
- I have gone into Windows performance mode under advanced settings.
- I have recently uninstalled all instances of Microsoft VBA C++ Distros and reinstalled the latest versions of the Distros. The reason for doing this is there have been reports of issues with Distros and AMD Chipset Drivers.
- I have disabled any services that are not being used, and even some Windows services while I troubleshoot which have been known to cause issues with performance like superfetch (sysmain), NDU (setting to 4 in the registry, which I believe disables it), indexing, windows search and windows experience. Anything that would be classified as unnecessary overhead while trying to troubleshoot.
- I have run a WPR multiple times, but locating the issue is difficult due to it taking a fair amount of time to accumulate. I can't run WPR for a long amount of time due to the file size it creates. ie "wpr -stop ReferenceSet C:\handle.etl" Also, I'll admit I am not 100% sure what I am looking for but nothing stands out.
- I have also added an entry for Multi-Plane Overlay in the registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Dwm - Entry OverlayTestMode DWORD Value of 00000005. I did this as DWM also gets mildly high but I am not sure if it's normal and does not get even close to the 1-4GB that explorer.exe reaches. Also, MPO has been known to cause issues with AMD display drivers with flickering and memory (I have recently enabled this and am unsure if this has yet to have an effect).
- I have checked through poolmon to see if there were any 3rd party drivers causing the issue.

I can not pinpoint the leak to a specific driver or handle within Explorer. I do note that Explorer does seem to have a handle leak. I have found something extremely odd in the handle report where Explorer sets a commit of about 3.27MB periodically for Section Handle that I can not identify. If I estimate how many of these handles are under the type "Section" it roughly equals the overage in with working set memory. Reaching critical mass takes a few days to a week, restarting Explorer clears the working set memory, and RAM usage goes back to about 48% (normal). This makes me believe there is a handle leak but I can't find the cause.

I have removed any 3rd party handles inclusive of Microsoft EDGE PDF preview dll. There seems to be a commit charge constantly and Explorer will eventually reach 1-4GB in working memory in a week depending on how long I let it go. I am wondering if anyone can assist in locating this issue. I have all the tools however I do not have a lot of experience in dissecting memory and or processes to this extent. I have done a lot of reading and troubleshooting before coming to these forums.

As for memory check, I can do it on one of the PCs but it's difficult as these PCs don't often get restarted and run the same applications at all times. Please note this has been the normal process for these PC's with absolutely no issues until this chipset. I did not suspect faulty memory as the issue is occurring on multiple PCs with the same chipset. The likelihood of faulty memory on all the PCs is extremely remote. The non-Microsoft applications that are running on them are clean and running on hundreds of Intel-based PC's that we have. We have found memory leaks on some of the Intel-based PCs, but we were able to pinpoint the raid controllers causing the issues by using my troubleshooting described below, which were fixed via a driver update.


I had to reset explorer.exe on all the PC's last night before I decided to reach out here because they were at critical mass and I can't have these PC's lock up.

Here are the tools I have acquired through my extensive research on these forums and elsewhere which I have been using to try and locate the leak.

poolmon
processexplorer
RAMMap
VMMap
WPR
Shexview-x64 ( to disable and non-Microsoft handles )
Recently found ProcessHacker 2 ( combines a lot of these tools into one UI )
I used xperf in the past and might go back to trying to view those logs again but I feel I'm going in circles at this point.

I have tried to run WinDbg but I don't think you can run this on the shell without running a remote server which is not possible in these situations.

Below I have included some screenshots of my troubleshooting journey and diving into logs.

Explorer in task manager:


VMMap before explorer task restart:


VMMap after explorer restart:


Process Hacker 2 Images:
General:


Memory:


Handles:


Threads:



SYSTEM INFO:
System Information report written at: 05/04/23 09:57:11
System Name:
[System Summary]

Item Value
OS Name Microsoft Windows 10 Pro
Version 10.0.19045 Build 19045
Other OS Description Not Available
OS Manufacturer Microsoft Corporation
System Name
System Manufacturer ASUS
System Model System Product Name
System Type x64-based PC
System SKU SKU
Processor AMD Ryzen 5 4600G with Radeon Graphics, 3701 Mhz, 6 Core(s), 12 Logical Processor(s)
BIOS Version/Date American Megatrends Inc. 0305, 4/15/2021
SMBIOS Version 3.3
Embedded Controller Version 255.255
BIOS Mode UEFI
BaseBoard Manufacturer ASUSTeK COMPUTER INC.
BaseBoard Product Pro A520M-C II
BaseBoard Version Rev X.0x
Platform Role Desktop
Secure Boot State Off
PCR7 Configuration Elevation Required to View
Windows Directory C:\Windows
System Directory C:\Windows\system32
Boot Device \Device\HarddiskVolume1
Locale United States
Hardware Abstraction Layer Version = "10.0.19041.2728"
User Name \admin
Time Zone Pacific Daylight Time
Installed Physical Memory (RAM) 8.00 GB
Total Physical Memory 7.30 GB
Available Physical Memory 3.78 GB
Total Virtual Memory 23.4 GB
Available Virtual Memory 17.8 GB
Page File Space 16.1 GB
Page File C:\pagefile.sys
Kernel DMA Protection Off
Virtualization-based security Not enabled
Device Encryption Support Elevation Required to View
Hyper-V - VM Monitor Mode Extensions Yes
Hyper-V - Second Level Address Translation Extensions Yes
Hyper-V - Virtualization Enabled in Firmware No
Hyper-V - Data Execution Protection Yes

[Hardware Resources]



[Conflicts/Sharing]

Resource Device
I/O Port 0x00000000-0x000003AF PCI Express Root Complex
I/O Port 0x00000000-0x000003AF Direct memory access controller

Memory Address 0xFCC00000-0xFCFFFFFF PCI-to-PCI Bridge
Memory Address 0xFCC00000-0xFCFFFFFF AMD USB 3.10 eXtensible Host Controller - 1.10 (Microsoft)

Memory Address 0xFC9FB000-0xFC9FBFFF AX99100 PCIe to High Speed Serial Port (COM2)
Memory Address 0xFC9FB000-0xFC9FBFFF AX99100 PCIe to Multifunction Peripheral Controller

Memory Address 0xFC9F8000-0xFC9F8FFF AX99100 PCIe to Multifunction Peripheral Controller
Memory Address 0xFC9F8000-0xFC9F8FFF AX99100 PCIe to High Speed Serial Port (COM1)

Memory Address 0xFC9FA000-0xFC9FAFFF AX99100 PCIe to High Speed Serial Port (COM2)
Memory Address 0xFC9FA000-0xFC9FAFFF AX99100 PCIe to Multifunction Peripheral Controller

I/O Port 0x0000E000-0x0000E0FF Realtek PCIe GBE Family Controller
I/O Port 0x0000E000-0x0000E0FF PCI-to-PCI Bridge

Memory Address 0xFC9FF000-0xFC9FFFFF AX99100 PCIe to High Speed Serial Port (COM4)
Memory Address 0xFC9FF000-0xFC9FFFFF AX99100 PCIe to Multifunction Peripheral Controller

IRQ 36 AX99100 PCIe to High Speed Serial Port (COM2)
IRQ 36 High Definition Audio Controller
IRQ 36 AX99100 PCIe to Multifunction Peripheral Controller

IRQ 37 AX99100 PCIe to High Speed Serial Port (COM3)
IRQ 37 AX99100 PCIe to Multifunction Peripheral Controller

Memory Address 0xFEE00000-0xFFFFFFFF PCI Express Root Complex
Memory Address 0xFEE00000-0xFFFFFFFF Motherboard resources

IRQ 38 AX99100 PCIe to High Speed Serial Port (COM4)
IRQ 38 AX99100 PCIe to Multifunction Peripheral Controller

Memory Address 0xFC9F9000-0xFC9F9FFF AX99100 PCIe to Multifunction Peripheral Controller
Memory Address 0xFC9F9000-0xFC9F9FFF AX99100 PCIe to High Speed Serial Port (COM1)

Memory Address 0xFC9FD000-0xFC9FDFFF AX99100 PCIe to High Speed Serial Port (COM3)
Memory Address 0xFC9FD000-0xFC9FDFFF AX99100 PCIe to Multifunction Peripheral Controller

I/O Port 0x0000C010-0x0000C017 AX99100 PCIe to High Speed Serial Port (COM3)
I/O Port 0x0000C010-0x0000C017 AX99100 PCIe to Multifunction Peripheral Controller

Memory Address 0xD0000000-0xE01FFFFF PCI-to-PCI Bridge
Memory Address 0xD0000000-0xE01FFFFF PCI Express Root Complex
Memory Address 0xD0000000-0xE01FFFFF AMD Radeon(TM) Graphics

IRQ 39 AX99100 PCIe to Multifunction Peripheral Controller
IRQ 39 High Definition Audio Bus
IRQ 39 AX99100 PCIe to High Speed Serial Port (COM1)

Memory Address 0xFC9FE000-0xFC9FEFFF AX99100 PCIe to High Speed Serial Port (COM4)
Memory Address 0xFC9FE000-0xFC9FEFFF AX99100 PCIe to Multifunction Peripheral Controller

I/O Port 0x0000C030-0x0000C037 AX99100 PCIe to Multifunction Peripheral Controller
I/O Port 0x0000C030-0x0000C037 AX99100 PCIe to High Speed Serial Port (COM1)

Memory Address 0xFC600000-0xFCAFFFFF PCI-to-PCI Bridge
Memory Address 0xFC600000-0xFCAFFFFF PCI-to-PCI Bridge
Memory Address 0xFC600000-0xFCAFFFFF PCI-to-PCI Bridge

Memory Address 0xFCA00000-0xFCA03FFF Realtek PCIe GBE Family Controller
Memory Address 0xFCA00000-0xFCA03FFF PCI-to-PCI Bridge

Memory Address 0xFC9FC000-0xFC9FCFFF AX99100 PCIe to High Speed Serial Port (COM3)
Memory Address 0xFC9FC000-0xFC9FCFFF AX99100 PCIe to Multifunction Peripheral Controller

I/O Port 0x0000C000-0x0000C007 AX99100 PCIe to High Speed Serial Port (COM4)
I/O Port 0x0000C000-0x0000C007 PCI-to-PCI Bridge
I/O Port 0x0000C000-0x0000C007 PCI-to-PCI Bridge
I/O Port 0x0000C000-0x0000C007 AX99100 PCIe to Multifunction Peripheral Controller
I/O Port 0x0000C000-0x0000C007 PCI-to-PCI Bridge

IRQ 0 High precision event timer
IRQ 0 System timer

I/O Port 0x0000C020-0x0000C027 AX99100 PCIe to High Speed Serial Port (COM2)
I/O Port 0x0000C020-0x0000C027 AX99100 PCIe to Multifunction Peripheral Controller


[DMA]

Resource Device Status
Channel 4 Direct memory access controller OK

[Forced Hardware]

Device PNP Device ID

[I/O]

Resource Device Status
0x00000290-0x0000029F Motherboard resources OK
0x00000200-0x0000021F Motherboard resources OK
0x00000378-0x0000037F Printer Port (LPT1) OK
0x0000C020-0x0000C027 AX99100 PCIe to High Speed Serial Port (COM2) OK
0x0000C020-0x0000C027 AX99100 PCIe to Multifunction Peripheral Controller OK
0x0000C030-0x0000C037 AX99100 PCIe to Multifunction Peripheral Controller OK
0x0000C030-0x0000C037 AX99100 PCIe to High Speed Serial Port (COM1) OK
0x0000F000-0x0000FFFF PCI-to-PCI Bridge OK
0x0000C010-0x0000C017 AX99100 PCIe to High Speed Serial Port (COM3) OK
0x0000C010-0x0000C017 AX99100 PCIe to Multifunction Peripheral Controller OK
0x00000070-0x00000071 System CMOS/real time clock OK
0x00000020-0x00000021 Programmable interrupt controller OK
0x000000A0-0x000000A1 Programmable interrupt controller OK
0x0000C000-0x0000C007 AX99100 PCIe to High Speed Serial Port (COM4) OK
0x0000C000-0x0000C007 PCI-to-PCI Bridge OK
0x0000C000-0x0000C007 PCI-to-PCI Bridge OK
0x0000C000-0x0000C007 AX99100 PCIe to Multifunction Peripheral Controller OK
0x0000C000-0x0000C007 PCI-to-PCI Bridge OK
0x0000E000-0x0000E0FF Realtek PCIe GBE Family Controller OK
0x0000E000-0x0000E0FF PCI-to-PCI Bridge OK
0x00000000-0x000003AF PCI Express Root Complex OK
0x00000000-0x000003AF Direct memory access controller OK
0x000003E0-0x00000CF7 PCI Express Root Complex OK
0x000003B0-0x000003DF PCI Express Root Complex OK
0x00000D00-0x0000FFFF PCI Express Root Complex OK
0x00000081-0x00000083 Direct memory access controller OK
0x00000087-0x00000087 Direct memory access controller OK
0x00000089-0x0000008B Direct memory access controller OK
0x0000008F-0x0000008F Direct memory access controller OK
0x000000C0-0x000000DF Direct memory access controller OK
0x0000D000-0x0000DFFF PCI-to-PCI Bridge OK
0x00000061-0x00000061 System speaker OK
0x00000010-0x0000001F Motherboard resources OK
0x00000022-0x0000003F Motherboard resources OK
0x00000063-0x00000063 Motherboard resources OK
0x00000065-0x00000065 Motherboard resources OK
0x00000067-0x0000006F Motherboard resources OK
0x00000072-0x0000007F Motherboard resources OK
0x00000080-0x00000080 Motherboard resources OK
0x00000084-0x00000086 Motherboard resources OK
0x00000088-0x00000088 Motherboard resources OK
0x0000008C-0x0000008E Motherboard resources OK
0x00000090-0x0000009F Motherboard resources OK
0x000000A2-0x000000BF Motherboard resources OK
0x000000B1-0x000000B1 Motherboard resources OK
0x000000E0-0x000000EF Motherboard resources OK
0x000004D0-0x000004D1 Motherboard resources OK
0x0000040B-0x0000040B Motherboard resources OK
0x000004D6-0x000004D6 Motherboard resources OK
0x00000C00-0x00000C01 Motherboard resources OK
0x00000C14-0x00000C14 Motherboard resources OK
0x00000C50-0x00000C51 Motherboard resources OK
0x00000C52-0x00000C52 Motherboard resources OK
0x00000C6C-0x00000C6C Motherboard resources OK
0x00000C6F-0x00000C6F Motherboard resources OK
0x00000CD8-0x00000CDF Motherboard resources OK
0x00000800-0x0000089F Motherboard resources OK
0x00000B00-0x00000B0F Motherboard resources OK
0x00000B20-0x00000B3F Motherboard resources OK
0x00000900-0x0000090F Motherboard resources OK
0x00000910-0x0000091F Motherboard resources OK
0x00000040-0x00000043 System timer OK

Rick