How do I find out who's using all my memory?

The most common culprit is what's called a "memory leak". This is when a program running on your PC reserves some of your computer's memory for itself, and then loses track of it. The net effect is that the program loses the ability to release that memory for other programs to use.

And if a program has a memory leak in some operation that it performs regularly, it can slowly eat up more and more of your system's memory until there's little left for any other programs.

In practice the effects of memory leaks are often minimized by the way manages memory by swapping unused memory to disk in the paging or virtual memory file. And memory that has been lost to leakage, while technically "in use" can actually not be accessed since the program that asked for it has lost track of it.

However over time memory leaks can definitely impact system performance. Rebooting resolves it for a while, as does shutting down the program that has the leak. The question is how to identify that program?

We'll start by downloading my most recommended tool: Process Explorer.

Fire up process explorer and you should see something very much like this:

You should see columns labeled Working Set and Virtual Size. If you do not, right click on any column header, click on Select Columns... and in the resulting dialog, click on the Process Memory tab:

Make sure that Virtual Size and Working Set Size are both checked and click OK.

Click on the column header labeled Working Set and all the running processes on your machine will be sorted by decreasing physical memory use. The programs using the most physical memory will be listed at the top:

Here you can see that on my machine as I type this firefox.exe is using the most memory, followed by explorer (the Windows taskbar and UI), Process Explorer itself, and the rest of the programs running on my machine.

Keep this open and watch it as you use your computer. If you see one program that's continually using more and more memory, that could be a sign of a problem with that program.

Now repeat this process, but this time sort by Virtual Size:

Virtual Size include all the memory allocated by each process, including that which has been swapped out to virtual memory or the paging file. As you can see, sorting by this typically results in a different order of programs. In my case one of the instances of svchost.exe has consumed the most virtual memory, followed by process explorer and Window's explorer.exe.

Once again, leave this running as you use your computer for a while and watch for programs that continually grow in their virtual memory allocation.

As your system performance degrades you may see one program with an excessively large physical or virtual memory allocation. What to do next will depend entirely on exactly what that program turns out to be, but at least you'll have identified the potential culprit.