LogonUI.exe is calling for more RAM then is available to the system (8 GB)

Question

I am receiving low memory warnings and freezes on a regular basis while idling. I've gone through most of the google recommend trouble shooting steps and I'm stuck with a weird recurring error in the event log. I have run a virus scan with malwarebytes... no hits.

I understand LogonUI.exe is part of windows. This is not normal windows 8.1 behavior. Why is LogonUI.exe trying to use more memory than what is available to my system? Is there any chance this is a hardware issue or does it have to be software?

OS: windows 8.1 pro RAM: 8 GB Event Log in question:

Event 2004, Resource Exhaustion-Detector Windows successfully diagnosed a low virtual memory condition. The following programs consumed the most virtual memory: LogonUI.exe (864) consumed 32235184128 bytes, sqlservr.exe (2104) consumed 279404544 bytes, and explorer.exe (4572) consumed 81514496 bytes.

• UserData

  • MemoryExhaustionInfo

  • SystemInfo

  SystemCommitLimit 34259742720

  SystemCommitCharge 34128162816

  ProcessCommitCharge 33293537280

  PagedPoolUsage 178769920

  PhysicalMemorySize 8489938944

  PhysicalMemoryUsage 7547469824

  NonPagedPoolUsage 122601472

  Processes 83

  • ProcessInfo

  • Process_1

  Name LogonUI.exe

  ID 864

  CreationTime 2014-07-23T22:01:16.872125000Z

  CommitCharge 32235184128

  HandleCount 552

  Version 6.3.9600.16384

  TypeInfo 65

  • Process_2

  Name sqlservr.exe

  ID 2104

  CreationTime 2014-07-23T22:01:25.153577000Z

  CommitCharge 279404544

  HandleCount 603

  Version 2011.110.5058.0

  TypeInfo 66

  • Process_3

  Name explorer.exe

  ID 4572

  CreationTime 2014-07-23T22:04:16.077400500Z

  CommitCharge 81514496

  HandleCount 1637

  Version 6.3.9600.17039

  TypeInfo 67

  • Process_4

  Name

  ID 0

  CreationTime 1601-01-01T00:00:00.000000000Z

  CommitCharge 0

  HandleCount 0

  Version 0.0.0.0

  TypeInfo 0

  • Process_5

  Name

  ID 0

  CreationTime 1601-01-01T00:00:00.000000000Z

  CommitCharge 0

  HandleCount 0

  Version 0.0.0.0

  TypeInfo 0

  • Process_6

  Name

  ID 0

  CreationTime 1601-01-01T00:00:00.000000000Z

  CommitCharge 0

  HandleCount 0

  Version 0.0.0.0

  TypeInfo 0

  • PagedPoolInfo

  • Tag_1

  Name CM31

  PoolUsed 83005440

  • Tag_2

  Name CM25

  PoolUsed 10817536

  • Tag_3

  Name MmSt

  PoolUsed 8911840

  • NonPagedPoolInfo

  • Tag_1

  Name ismc

  PoolUsed 34213888

  • Tag_2

  Name ConT

  PoolUsed 11255808

  • Tag_3

  Name VoSm

  PoolUsed 3680544

  • ExhaustionEventInfo

  Time 2014-07-24T01:55:48.057782000Z

Solution 1

Three days with no issues so far. It appears my Windows files got corrupted somehow and using these commands restored it...

sfc /scannow

dism /online /cleanup-image /restorehealth

sfc /scannow

You can read about those commands here:

http://support.microsoft.com/kb/929833 http://technet.microsoft.com/en-us/library/hh824869.aspx

Solution 2

Uninstalling "HP Simple Pass" from programs and features solved the problem for me.

I found the solution for it here: technet forum

In the previously posted screen shots of ProcessExplorer you can see a dll called OmniPassCredProv. Mine showed the same and the dll lives in c:\Program Files\Hewlett Packard\SimplePass.

That software appears to be for the finger print scanner which I don't use so I uninstalled it and now LoginUI no longer gobbles memory.

Comments

[Xavierjazz]

"Why is it eating so much of my RAM?" is asking for opinions and probably will be closed. Can you phrase it better? :)

[Eugen Rieck]

Additionally, a question about abusrdly high resource consumption on Win8 looks like an excellent starting point for a rant or flamewar! I like it.

[Ramhound]

Does this happen when you boot into a minimal configuration? 32,235,184,128 bytes isn't 8GB thats closer to 32GB ( 34,359,738,368 bytes would be 32GB ).

[abaldwin99]

Good point I should have caught the byte to GB conversion. I will report back after doing a clean boot. I'm not trying to start a flame or opinion thread here. Do you have a recommendation on phrasing this differently than the new edit?

[and31415]

Do you get the same issue if you start Windows in Safe Mode?