Unknown massive memory usage

[sirbow2]

my problem is that i see more used memory than it should be for the running programs (see pic). yes, i know you have to take into account shared mem etc, but this is crazy.

A while ago i made an image of my computer for restoring right after i installed windows and installed all of my programs. i had to restore it recently and it worked out fine in terms of memory usage. now, i have noticed that i get a lot of memory usage and my computer is sluggish in general (cant play a 4gb video off my INTERNAL HDD without buffering in vlc). i thought it was my hdd going bad, but then i looked over at my memory usage monitor. so im guessing virus? any opinions?

and a second pic is of the resource monitor with more details on mem.

 

[TollhouseFrank]

try running resmon.exe.

That should show you your memory commitments, even for services. I'm willing to bet you will find your svchost is going crazy, which usually indicates spyware of some sort.

 

[sirbow2]

its in the second pic. would you define that as going crazy?

i did a restart and it dropped to 40% (2.4GB) with the same apps open. still a little high, imo.

 

[TollhouseFrank]

do you have prefetch turned on? I'm assuming you do. Turn off prefetch and see if it lowers your RAM usage. I leave it turned on for my machine (i have 16gb of ram, though, so i don't notice when prefetch has 2-3gb loaded up).

here is what prefetch is and how to disable it as per Microsft:

EWF performance can sometimes be improved by disabling Prefetch. Prefetch is a utility that is intended to improve Windows and application startup performance by loading application data into memory before it is demanded. When using EWF with a RAM overly to protect the boot volume, Prefetch is unable to persist its data from startup to startup. Under these conditions, Prefetch will attempt compute and save new data files each time the system starts up consuming EWF resources with, potentially, no benefit.
To disable prefetch
Update the EnablePrefetcher registry key in your run-time image:
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters
Name: EnablePrefetcher
Type: REG_DWORD
Value: 0
The EnablePrefetcher key has the following values:
0 = Disabled
1 = Application launch prefetching enabled
2 = Boot prefetching enabled
3 = Application launch and boot enabled
To disable Prefetch, set the value to 0.

 

[Automata]

If you just restored an old image, it is probably doing updates (plus other tasks) in the background. How long have you let it sit?

 

[wingman99]

You could check and see if your disc activity light is flashing steady on the PC case, that would tell you your PC is busy.

Or look at performance monitor.

 

[Culbrelai]

Go to Services and disable Superfetch.

It says it improves performance but it really doesn't. I disabled it and now my RAM usage is down by around 1-1.5GB