svchost.exe using excessive memory
OS Windows XP Home Edition SP3Ram 1GB (just upgrade from 512MB)Atitvirus Zone Alarm Secruity Suite Firewall/Anti-virusInternet Browser - IE8During a typical computer session the svchost.exe process (System User), when viewed in the Windows Task Manager, will continually increase its memory consumption to the point that my computer slows to a crawl. I've increased the RAM to 1GB to compensate and now amseeing an even greater use of memory by the process - up to 250MB! I've tried ending the task and restarting the essential processes that svchost manages but have been unable to isolate the subtask that is causing the excess memory consumption. This does have the benefit of reducing the RAM consuption temporarily but in a half hour or so the memory consumption is way up again.I've repeatedly run anti-virus scans by Zone Alarm (currently updated), Malwarebytes 'Anti-malware' , Spybot 'Search and Destroy' and SuperAntiSpyWare 4.9 to no avail. I have IE8 configured to prevent pop-ups and have blocked most cookies.What can I do to manage the svchost process to stop the runaway memory usage?1 person got this answerI do too
June 20th, 2010 8:05pm

Your win is updated with Important updates via MS Update?If you boot in safe mode, all is OK?If in normal mode you start msconfig, disable all startups, reboot, excepting the msconfig warning, how does it then function?
Free Windows Admin Tool Kit Click here and download it now
June 21st, 2010 1:03am

OS Windows XP Home Edition SP3Ram 1GB (just upgrade from 512MB)Atitvirus Zone Alarm Secruity Suite Firewall/Anti-virusInternet Browser - IE8During a typical computer session the svchost.exe process (System User), when viewed in the Windows Task Manager, will continually increase its memory consumption to the point that my computer slows to a crawl. I've increased the RAM to 1GB to compensate and now amseeing an even greater use of memory by the process - up to 250MB! I've tried ending the task and restarting the essential processes that svchost manages but have been unable to isolate the subtask that is causing the excess memory consumption. This does have the benefit of reducing the RAM consuption temporarily but in a half hour or so the memory consumption is way up again.I've repeatedly run anti-virus scans by Zone Alarm (currently updated), Malwarebytes 'Anti-malware' , Spybot 'Search and Destroy' and SuperAntiSpyWare 4.9 to no avail. I have IE8 configured to prevent pop-ups and have blocked most cookies.What can I do to manage the svchost process to stop the runaway memory usage?Just to make sure your machine is clean from viruses try to scan from another vendor!Download Avast Cleaner (offline scanner) from here:http://www.avast.com/eng/avast-virus-cleaner.htmlComodo BOClean : Anti-Malware Version 4.27http://www.comodo.com/boclean/boclean.htmlThe Svchost.exe process is a generic host process name for services that run from dynamic-link libraries (DLLs) as the name say it does host other services. The Svchost.exe file is located in the C:\Windows\System32 folder. It can happen if your network having excessive usage. Or there is an Memory leak which can be a headache to figure out.Use either of the Porcmon or Dependency walker to figure out what can be the causer of the surge in the Svchost.exe processor uage.A description of Svchost.exe in Windows XP Professional Editionhttp://support.microsoft.com/kb/314056http://www.bleepingcomputer.com/blogs/mowgreen/index.php?showentry=1071Process Monitor v2.91http://technet.microsoft.com/en-us/sysinternals/bb896645.aspxDependency Walkerhttp://www.dependencywalker.com/nass -- http://www.nasstec.co.uk
June 21st, 2010 1:40am

I did find something that might help - The PID for the svchost service in task manager is 192 - but I don't what the 192 process is or how to determine it. Can you help with that? Also, I've run all the current MS updates and used the current version Malicious Software Removal tool. I'll try other anti-virus as well.
Free Windows Admin Tool Kit Click here and download it now
June 21st, 2010 3:07am

Hi, The PID is the process ID this is an identifer which you can use in a program like Process Explorer Available at: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx. Using a program like Process Explorer and the PID you can see what your process is undertaking in the system, its performance, its threads, its strings, environments and so on.
June 21st, 2010 3:13am

Last night I ran several anti-virus 'Deep" or 'Full' scans including ZoneAlarm, Malwarebytes 'Anti-malware', Super Anti-Sypware and Sybot 'Search and Destroy' with all reporting no infections. The task manager showed that the svchost process was using 344MB of memory so I ran the Process manager to view the properties of the svchost process that was consuming the memory. I check the .dlls for each process and they all were dated the same which was the day I install SP3. There was one apparent discrepancy - the Service 'Windows Management Instrumentation' showed the path as 'c:\windows\ system32\wbem\WMlsvc.dll. Thre is no file WMlsvc.dll in that or any other Windows directory. There is a file 'wmisvc.dll' . The discrepancy is the third letter of the filename - the Process Manager path points to the filename that has a 'l' not an 'i'. The following is a list the sub-processes :1. BITS - Background Intelligent Transfer Service2. Browser - Computer Browser3. Cryptsvc - Crytographic Services4. Dhcp - DHCP Client5. ERSvc - Error Reporting Service6. FastUser SwitchingCompatibility - Fast User Switching Compatibility7. helpsvc - Help and Support8. lanmanserver - Server9. lanmanworkstation - Workstation10. netman - Network Connections11. NLA - Network Location Awareness (NLA)12. RasMan - Remote Access Connection manager13. seclogon - Secondary Logon14. SENS - System Event Notification15. SharedAccess - Window Firewall/Internet Connection Sharing (ICS)16. ShellHWDection - Shell Hardware Detection17. Tapi - Telephony18. winmgmt - Window Management Instrumentation19. wscsvc - Security Center20. wuauserv - Automatic UpdatesIs there any way to check the performance of these process individually for memory usage?
Free Windows Admin Tool Kit Click here and download it now
June 21st, 2010 5:28pm

I shut down each of the above process one at a time to see what, if any, impact they had on the svchost memory usage as displayed in the Task Manager. I could not discern any significant change for any individial process. The svchost (username System) showed CPU suage at 50% and memory usasge at 140MB and slowly increasing. (After I ran the anti-virus scans last night, I re-booted which reduced the memory usage from a high of 344MB to the current 140MB).The only exception was with the Telephony process which I cound not stop. In the 'Dependancies' section it showed two instances of 'RPC' .Is it possible that a process is running that the Process Manager can't recognize? Is there a way to monitor each of the svchost sub-process for memory/cpu usage? Is it possible that a 'virus' is running and consuming the memory/cpu and can't be detected my any of the Anti-virus software, including the MSRT?Still looking for help. Thanks
June 21st, 2010 6:02pm

Just thought I'd update in case anyone has some insight. One of my svchost.exe (system) programs continues to consume excessive memory - up to 580MB! I compensated by adding more RAM but it just seems to consume more. The only solution I've found that works, temporarily at least, is to stop that particular instance of svchost.exe. When I do, I lose Windows Audio and Windows Workstation services. I can restart them from the Control Panel/Amdinistrative Tools/Services (now a shortcut), and regain their functionality. I need to do this every several hours as the svchost.exe (System) file eventually consumes in excess of 250MB RAM in about 2-3 hours. Surely, my computer is not th only one that has this problem. This has just recently occured after an Upgrade to SP3 (May 2010) and IE8 (also May). I have several Anti-Virus/Malware programs doing full scans nightly (including the most up-to-date versions of Zone Alarm and MalwareBytes Anti-Malware), as well as running the most cUrrent version of Microsft's malicious sorftware removal tool - all to no avail (at least for this issue). Any reasonable suggestions would be welcomed.
Free Windows Admin Tool Kit Click here and download it now
July 11th, 2010 6:58pm

You might try the following, this trial version managed to pick up and delete a TDL3 varient (A.K.A. Alureon) that the above scanners missed. It was using the svchost for it's little "Deeds". You may have a different strand or type of the above mentioned virus.Hitman Pro is a second opinion scanner, designed to rescue your computer from malware(viruses, trojans, rootkits, etc.) that have infected your computer despite all the securitymeasures you have taken (such as anti virus software, firewalls, etc.).http://www.surfright.nl/en/hitmanpro Although... from what I can see, it looks like a memory leak. Those can be hard to figure out >.<.Try the above. EDIT:LOOK WHAT I FOUND!!!http://support.microsoft.com/kb/309615Look familiar?It has to do with your little "RPC" issueMeh... don't download the fix it's a Win. 2000 version >.<I'll continue researching >.< EDIT2:Try the following articles, to see if they relate to your problems.They ALL have Hotfixes, I guess select the one that's most relevent.http://support.microsoft.com/kb/838884http://support.microsoft.com/kb/932494 You ALSO may want to try the following forum post, his issue seems to be related to yours.http://social.technet.microsoft.com/Forums/en-US/itproxpsp/thread/256fb675-7f26-4337-bc24-1ce7788f8698Young and learning...Have mercy - ChaosIf this post resolves your issue, please click the "Mark as Answer" or "Helpful" buttons. This helps other users with similar problems find the answer faster.
July 11th, 2010 7:19pm

Chaos_Edit,Evidently you were correct. I downloaded the latest version of MS MSRT last Thursday (v 3.9.3901.0) and it discovered the Alureon virus. It 'partially' removed it and recommended I run a complete scan using anti-virus software. I ran my Checkpoint/Zone Alarm Anti-virus - super-scan and it finally detected and quaranteed the virus. Since then my svchost.exe program has stayed at around 25MB memory usage.What intrigues me (or bugs me depending on my mood) is that this virus has evidentlly been around since 2006 and yet my Checkpoint/Zone Alarm Anti-virus, Malwaretytes Anti-Malware and SuperAntiSpyware all failed to find it. I've run super/deep scans using the latest versions of each of these software products every night for the last month. My ZA product is set to check for and download their updates nightly before the deep scan.By the way, I started to download HitmanPro only to discover that it wanted to maintain a live link to my computer. Probably not in my best interest.
Free Windows Admin Tool Kit Click here and download it now
July 18th, 2010 10:35pm

YEs, but it gets rid of anything regardless.Anyway, glad I can help.Young and learning...Have mercy - ChaosIf this post resolves your issue, please click the "Mark as Answer" or "Helpful" buttons. This helps other users with similar problems find the answer faster.
July 19th, 2010 1:12am

Hay if you figure this one out I would be interested as well. "svchost" is a usage hog as well.
Free Windows Admin Tool Kit Click here and download it now
September 12th, 2010 4:34am

This is brilliant as it refers exactly to my situation. However, how do i download the MS MSRT that you refer to please? Thank you
December 5th, 2010 7:26am

He is referring to the Microsoft Malicious Software Removal Tool. Here is a link. http://www.microsoft.com/security/malwareremove/default.aspx
Free Windows Admin Tool Kit Click here and download it now
December 9th, 2010 2:19pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics