cancel
Showing results for 
Search instead for 
Did you mean: 
fragged
Level 7

McAfee Total Protection, Memory leak in fwpkclnt.sys after update 11.09.2012

Hi,

I have already sent email about this issue to McAfee support, but the first answer was to update my graphics driver, while the issue is clearly related to networking and has nothing to do with my graphics card.

McAfee Total Protection causes a memory leak in fwpkclnt.sys (monitored as Fwpx in poolmon.exe from Windows Driver Kit). I can reproduce this issue on all my 3 PC's running Windows 7 x64 SP1 with latest updates.

The rate of the memory leak is related to amount of network traffic, more traffic, faster the leak. The leak will eventually cause the PC to run out of Nonpaged pool -memory and causes a BSOD (sorry no minidump available, I'm not going to crash my PC again and I accidentaly deleted the first dump I got). Before total crash I am experiencing instability of multiple application. RAMMap.exe from Sysinternals suite wont run, poolmon.exe wont run anymore, Winamp has issues playing back a internet radio stream, etc.

The issue goes away when I remove McAfee Total Protection. I now have removed it from 2 of my 3 PC's and those two are now running as expected.

As you can see from the pictures attached, the kernel nonpaged memory usage has grown from 56 MB (Picture 1) to 525 MB in just 9 minutes (Picture 2) and in less than 10 minutes poolmon.exe wont run anymore and RAMMap.exe wont start either (Picture 3 and 4).

McAfee support has been no help so far so I'm posting this here in hopes that somebody can take this up the support chain.

I can provide any additional information if needed.

0 Kudos
148 Replies
Peacekeeper
Level 20

Re: McAfee Total Protection, Memory leak in fwpkclnt.sys after update 11.09.2012

I have flagged this for the techs. Re the BSOD what number and what was the error message not 3b and the top warning System_service_exception by chance?

I see you have 11.6 I wonder if 12.0 would work better it is available if you use the aussie server to download the program.

Message was edited by: Peacekeeper on 19/09/12 7:29:56 PM
0 Kudos
fragged
Level 7

Re: McAfee Total Protection, Memory leak in fwpkclnt.sys after update 11.09.2012

I'll try to get the last PC I have McAfee installed on to crash and post the minidump for you.

0 Kudos
Peacekeeper
Level 20

Re: McAfee Total Protection, Memory leak in fwpkclnt.sys after update 11.09.2012

Need a pic of the bsod as well if possible the minidump will help the techs but far above this civil engineer

0 Kudos
fragged
Level 7

Re: McAfee Total Protection, Memory leak in fwpkclnt.sys after update 11.09.2012

Sorry I can't do that right now as I'm on a remote connection

0 Kudos
Peacekeeper
Level 20

Re: McAfee Total Protection, Memory leak in fwpkclnt.sys after update 11.09.2012

That is ok I am off to sleep now so whenever you can would be helpful

0 Kudos
exbrit
Level 21

Re: McAfee Total Protection, Memory leak in fwpkclnt.sys after update 11.09.2012

I know it's small consolation but this particular BSOD is an issue that seems to have been going on for years with fwpkclnt.sys which belongs to Windows Firewall I believe.   I Googled fwpkclnt.sys by itself and came up with many hits.

The nearest I got to a solution was a hotfix from Microsoft which may or may not work, but nothing positive.   I'll keep looking.

0 Kudos
fragged
Level 7

Re: McAfee Total Protection, Memory leak in fwpkclnt.sys after update 11.09.2012

Issue is not with Windows Firewall. Things work right when I uninstall McAfee and enable Windows Firewall again. Like I said in the topic, issues started around the 11.09.2012 update for Total Protection.

@Hayton

I found the entry for the only BSOD I have experienced (only time I let the memory to go all out). Sadly I deleted the actual minidump file before checking it out.

The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000007e (0xffffffffc0000005, 0xfffff8800f53a532, 0xfffff8800abc6338, 0xfffff8800abc5b90). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 091512-31683-01.

Message was edited by: fragged on 9/19/12 7:04:06 AM CDT
0 Kudos
Hayton
Level 18

Re: McAfee Total Protection, Memory leak in fwpkclnt.sys after update 11.09.2012

Tech Support may need to work with you to get to the bottom of this. If it started after an update they'll need to isolate the specific component that's causing the problem, and you seem pretty clued-up so you're probably the best person to help them do this.

As for the single crash that you had : 0x7E BSODs are often caused by problems with drivers or anti-virus programs according to all the threads I've found elsewhere but the relevant information is in the exception code part of the bugcheck information. Nirsoft's BlueScreenView is a useful program to highlight the probable cause of a BSOD, so you might want to have it in your toolbox in case you get another dump file  - see http://www.nirsoft.net/utils/blue_screen_view.html

Without knowing exactly how the memory leak comes about (I'll leave that to Tech Support to look into) the best I can do is point you to some threads where the 0x7e stop code is discussed. There's useful information and suggestions in there, although some of them relate to Vista not Win7.

Generic info on resolving BSODs in Win7 :

http://windows.microsoft.com/en-US/windows7/Resolving-stop-blue-screen-errors-in-Windows-7

Forum threads -

0x7E (and others) on Win7

0x7E on Win7

0x7E on Vista

0x7E on Vista (2)

We'll make sure that the tech people know about this, which is about the most that we can do. I hope between you you can find the underlying cause so whatever it is that's doing it can be fixed.

Edit - I amended that last sentence slightly. Since we're not seeing a spate of posts about this then the cause is a conflict between McAfee and something on your system, so running through the checks suggested in those threads (memtest, File Verifier, chkdsk and the rest) is a good idea before you talk to Tech Support. They'll have to do those anyway. As there isn't a generic fix for this the best thing to do is to contact Support using the option in Useful Links (near the top of the page).

Message was edited by: Hayton on 19/09/12 14:16:38 IST
0 Kudos
Hayton
Level 18

Re: McAfee Total Protection, Memory leak in fwpkclnt.sys after update 11.09.2012

Hi fragged,

  Someone posted on forums.techguy.org recently about this. I'm assuming that was you? There were a couple of Microsoft links but one that might be relevant wasn't there - that's a Hotfix for a specific problem on Win7 which looks similar to yours. Usual advice in these situations, of course : check that this is the right Hotfix for your problem before applying it.

See http://support.microsoft.com/kb/976658

"The memory of the nonpaged pool may leak when you enable IPsec on a computer that is running Windows Server 2008 R2 or Windows 7"

When you enable Internet Protocol security (IPsec) for the network communication on a computer that is running Windows Server 2008 R2 or Windows 7, the memory of the nonpaged pool may leak. This memory leak can cause the computer to stop responding. Therefore, you may have to restart the computer. Additionally, the following event may be logged in the Application log:

Event Type: Error

Event Source: Application Popup

Event Category: Srv

Event ID: 2019

Have you checked your Event Logs?

Message was edited by: Hayton on 19/09/12 12:58:53 IST
0 Kudos