Bitdefender Windows Xp Non Paged Kernel Memory Leak

The Professor

Cant see where to submit bug reports so I have posted it here.

I have much more comprehensive info about this bug which I can post to

someone at Bitdefender if asked.

This bug may affect just me but I have posted symptoms below plus how to detect it. So if you think Bitdefender could be causing you problems try this first before assuming the worst. A temporary fix is also recommended that wont compromise your security.

Otherwise I find Bitdefender to be much much better than the other antiviruses simply because it uses much less resources which is perfect for old systems.

As for anybody who suggests upgrading to another operating system this system is perfect for what it is used for which is in a sound studio and is generally not connected to the internet.

Bitdefender Version

Antivirus Free Edition
1.0.21.1109
02/03/2016

System

Microsoft Windows XP Professional Version 2002 Service Pack 3

Bug

On my installation of Windows XP after about 3 days the system runs out of non paged kernel memory and starts to misbehave.

Note my system has 2 GBs of memory. On systems with less memory or heavier usage this bug may exhibit bad behaviour sooner.

Symptoms

Warnings messages start to pop up warning of system files not being saved amongst other warnings.

The system may also crash suddenly.

There may or may not be this message in the event log.
“The server was unable to allocate from the system nonpaged pool because the pool was empty“.

At worse data can be lost from unsaved applications and some system files may be corrupted.

Cause

Bitdefender doesn't free IoCompletion packets from non paged kernel memory after scanning files either "On Demand" or during "AutoScan"

How to determine if the bug affects your system

Note this only applies for Windows XP which presently is the only confirmed operating system that may have this bug.

If you don't understand what's below there's more info and some pretty pictures in the "More Info" links below.

1. Open Bitdefender window from Bitdefender icon on taskbar notification bar (system tray)
2. Slide "AutoScan" switch to "OFF"
3. Reboot
4. Start up Windows Task Manager (Ctrl Alt Delete)
5. Select Performance tab
6. Write down the size of the "Nonpaged" "Kernel Memory". Note this generally fluctuates as the system runs so just pick the lowest value.
7. Open Windows Explorer.
8. Right click on your "Windows" directory (generally C:\Windows) and select "Properties".
9. Write down how many files this directory contains. Lets call this value WinFiles.
10. In Windows Explorer right click on your "Windows" directory (generally C:\Windows) and select "Scan with Bitdefender".
11. Wait till the scan is finished (Very important!). This will be reported in the Bitdefender window in the "On Demand Scanner" section.
12. Recheck the size of the "Nonpaged" "Kernel Memory" as outlined above and write it down.
13. Calculate the difference in the "Nonpaged" "Kernel Memory" before and after the scan. Lets call this value MemDiff.
14. If MemDiff is approximately equal to WinFiles * 40 / 1024 you have this problem.
15. If you don't have this problem re-enable the Bitdefender AutoScan.
16. If you do have this problem report it on the page that this was originally posted and give details including your operating system version and installed memory. Somebody may or may ask you for more details but they probably have enough info from me already.

Temporary Fix till bug is fixed

Turn off Bitdefender AutoScan and don't manually scan directories with lots of files. Bitdefender will still scan all files you execute so you will remain safe.

Other Notes

Non paged kernel memory is limited by the size of the installed memory. Non paged kernel memory starts at 128MB on a system
with 512MB and goes up to 256MB for a system with a little over 1GB or more.

More Info

Symptoms of running out of NonPaged memory and how to check this
https://kb.plesk.com/en/1675

More info on detecting this
https://www.simple-talk.com/sysadmin/general/troubleshooting-nonpaged-and-paged-pool-errors-in-windows/

How to use Proces###plorer to get Nonpaged Limit
https://blogs.technet.microsoft.com/markrussinovich/2009/03/10/pushing-the-limits-of-windows-paged-and-nonpaged-pool/

The Professor

Note: According to forum rules once this bug has been fixed Bitdefender will probably delete this message and all sub messages as there's no sense in panicking people about a bug that has already been fixed.

Sorin G.

Hello,

Thank you for your time in submitting your feedback.

If I may, the issue is not that the system is working perfect or not it is the fact that it is outdated and does not support the most latest technologies.

The Professor

Hi Ban,

Thanks for your prompt response.

It's important to note your software is advertised as follows.

http://www.bitdefender.com.au/solutions/free.html

• Minimum system requirements

  Operating system: Windows XP SP3 32-bit, Windows Vista (SP2), Microsoft Windows 7 (SP1), Microsoft Windows 8

  RAM: 512MB

  Hard disk space: 700 MB

• Recommended system requirements

  Operating system: Windows XP SP3 32-bit, Windows Vista (SP2), Microsoft Windows 7 (SP1), Microsoft Windows 8

  RAM: 1 GB

  Hard disk space: 1 GB

You may of missed also my comment that this computer is used in a sound studio and unfortunately Windows Vista,7,8,10 (whatever happened to 9?) don't support the older programs and hardware that drives some of my studio equipment and associated musical instruments that our audience and clients love (remember vinyl and the old 80's disco and new wave sounds and 90's techno?). Hence there is significant market for security software that supports old mission critical systems as I'm sure your company is aware of. Notably such systems should be kept away from the internet and virus infected media (CDs/USB drives etc) but mistakes do happen despite the best precautions.

I do note that all antivirus software needs to be occasionally connected to the internet for virus signature updates or cloud checking but I also note that firewall restrictions can limit such connections to the antivirus provider and other trusted addresses.

In any case my investigations have revealed this is a simple bug with no doubt a simple fix. As I said I'm happy to send somebody in your organization more comprehensive details but I'm unwilling to post these on the forum as it would compromise the security of my computer systems and your software.

As I said in my last post Bitdefender by far is the best antivirus for old systems because of its low resource usage and this bug is only a slight blip on that score.

Cheers

Andy

Sorin G.

Hello,

I believe you misunderstood my comment, it was in regards to a "windows upgrade suggestion" unrelated to the product's compatibility.

Please follow the steps in the article bellow to generate a Bitdefender Support Tool log as we were unable to reproduce the reported issue, afterwards send the tool to bitsy@bitdefender.com with all the details from this thread. This will open a ticket with our support team.

http://www.bitdefender.com/support/what-to-do-when-encountering-a-technical-issue-(how-to-generate-a-support-tool-log)-1168.html

The Professor

Thanks Ban,

I agree with you in its best to upgrade when you can. Only as Windows XP is no longer supported by Microsoft and hence insecure.

Will now follow the directions in your link.

Cheers

Andy

Sorin G.

Hello,

Thank you for understanding.

Please also provide me with the generated ticket number.