I have been having this problem (I think) on several end-points. I don't remember how long it's been going on, but sometime in the last few months I noticed that the morning after a scheduled scan runs, I see the "Low Memory" warning on the screen. This morning, my laptop had committed the entire paging file (almost 24GB) to the MBAM service. Apparently the monthly scan ran while I was asleep.
I've been searching the forums for a reason and will now try disabling the Ransomware portion of the program on all end-points I control, but it is disappointing to see that this issue is at least as old as October with no resolution. Until it can be resolved, the devs should strongly consider removing it (or disabling it) via a pushed update.
I've not been able to collect data during the leak, but I am confident in saying the leak happens during (or at the end of?) a scheduled scan. The best I can do is the Windows log for you:
Log Name: System
Source: Microsoft-Windows-Resource-Exhaustion-Detector
Date: 11/19/2017 2:20:44 AM
Event ID: 2004
Task Category: Resource Exhaustion Diagnosis Events
Level: Warning
Keywords: Events related to exhaustion of system commit limit (virtual memory).
User: SYSTEM
Computer: xps8500
Description:
Windows successfully diagnosed a low virtual memory condition. The following programs consumed the most virtual memory: MBAMService.exe (3912) consumed 393338880 bytes, svchost.exe (448) consumed 216465408 bytes, and Dropbox.exe (8596) consumed 189644800 bytes.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Resource-Exhaustion-Detector" Guid="{9988748E-C2E8-4054-85F6-0C3E1CAD2470}" />
<EventID>2004</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>3</Task>
<Opcode>33</Opcode>
<Keywords>0x8000000020000000</Keywords>
<TimeCreated SystemTime="2017-11-19T07:20:44.200551400Z" />
<EventRecordID>1598320</EventRecordID>
<Correlation ActivityID="{894CA3D6-A3AD-4FD8-BED3-7BB99A2DAE31}" />
<Execution ProcessID="448" ThreadID="1132" />
<Channel>System</Channel>
<Computer>xps8500</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<MemoryExhaustionInfo xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://www.microsoft.com/Windows/Resource/Exhaustion/Detector/Events">
<SystemInfo>
<SystemCommitLimit>34194026496</SystemCommitLimit>
<SystemCommitCharge>34159607808</SystemCommitCharge>
<ProcessCommitCharge>2856779776</ProcessCommitCharge>
<PagedPoolUsage>548315136</PagedPoolUsage>
<PhysicalMemorySize>8548982784</PhysicalMemorySize>
<PhysicalMemoryUsage>7958437888</PhysicalMemoryUsage>
<NonPagedPoolUsage>214065152</NonPagedPoolUsage>
<Processes>130</Processes>
</SystemInfo>
<ProcessInfo>
<Process_1>
<Name>MBAMService.exe</Name>
<ID>3912</ID>
<CreationTime>2017-11-15T19:05:05.534002600Z</CreationTime>
<CommitCharge>393338880</CommitCharge>
<HandleCount>1619</HandleCount>
<Version>3.1.0.556</Version>
<TypeInfo>1089</TypeInfo>
</Process_1>
<Process_2>
<Name>svchost.exe</Name>
<ID>448</ID>
<CreationTime>2017-11-15T19:04:10.964108000Z</CreationTime>
<CommitCharge>216465408</CommitCharge>
<HandleCount>687</HandleCount>
<Version>6.1.7600.16385</Version>
<TypeInfo>33858</TypeInfo>
</Process_2>
<Process_3>
<Name>Dropbox.exe</Name>
<ID>8596</ID>
<CreationTime>2017-11-15T23:37:02.820596900Z</CreationTime>
<CommitCharge>189644800</CommitCharge>
<HandleCount>3405</HandleCount>
<Version>39.4.49.0</Version>
<TypeInfo>203</TypeInfo>
</Process_3>
<Process_4>
<Name>EXCEL.EXE</Name>
<ID>10380</ID>
<CreationTime>2017-11-17T15:06:09.014808500Z</CreationTime>
<CommitCharge>184197120</CommitCharge>
<HandleCount>1039</HandleCount>
<Version>16.0.8625.2121</Version>
<TypeInfo>144</TypeInfo>
</Process_4>
<Process_5>
<Name>SABnzbd.exe</Name>
<ID>10404</ID>
<CreationTime>2017-11-16T01:56:20.331763200Z</CreationTime>
<CommitCharge>157970432</CommitCharge>
<HandleCount>443</HandleCount>
<Version>2.3.1.0</Version>
<TypeInfo>152</TypeInfo>
</Process_5>
<Process_6>
<Name>
</Name>
<ID>0</ID>
<CreationTime>1601-01-01T00:00:00.000000000Z</CreationTime>
<CommitCharge>0</CommitCharge>
<HandleCount>0</HandleCount>
<Version>0.0.0.0</Version>
<TypeInfo>0</TypeInfo>
</Process_6>
</ProcessInfo>
<PagedPoolInfo>
<Tag_1>
<Name>CM31</Name>
<PoolUsed>235814912</PoolUsed>
</Tag_1>
<Tag_2>
<Name>MmSt</Name>
<PoolUsed>118920592</PoolUsed>
</Tag_2>
<Tag_3>
<Name>Sect</Name>
<PoolUsed>65226256</PoolUsed>
</Tag_3>
</PagedPoolInfo>
<NonPagedPoolInfo>
<Tag_1>
<Name>MmCa</Name>
<PoolUsed>84821328</PoolUsed>
</Tag_1>
<Tag_2>
<Name>SpDN</Name>
<PoolUsed>36188656</PoolUsed>
</Tag_2>
<Tag_3>
<Name>EtwB</Name>
<PoolUsed>9467952</PoolUsed>
</Tag_3>
</NonPagedPoolInfo>
<ExhaustionEventInfo>
<Time>2017-11-19T07:20:45.707531200Z</Time>
</ExhaustionEventInfo>
</MemoryExhaustionInfo>
</UserData>
</Event>
Don't judge my DropBox...lol. I will report back if the next scan causes the same issue even with the Ransomware portion turned off.
