ok...I found this in the knowledge base;
If you suspect a memory leak, monitor Memory\Available Bytes and Memory\Committed Bytes to observe memory behavior and monitor Process\Private Bytes, Process\Working Set, and Process\Handle Count for processes you think might be leaking memory. Also monitor Memory\Pool Nonpaged Bytes, Memory\Pool Nonpaged Allocs, and Process(process_name)\Pool Nonpaged Bytes if you suspect that a kernel-mode process is causing the leak...
also, there's a way to get the taskmanager to list the processes in decending order for amount of memory used, But I forgot how to use it...anyway, you can see the memory usage just by hitting the processes tab.
Personally, try the sustem restore first, maybe that'll save alot of effort...unless of course, you're curious about this issue...if so, try to solve the problem