svchost.exe getting bigger

Questions and Answers : Windows : svchost.exe getting bigger
Message board moderation

To post messages, you must log in.

AuthorMessage
Profile SirionStig

Send message
Joined: 9 Oct 02
Posts: 30
Credit: 128,470
RAC: 0
United Kingdom
Message 1198276 - Posted: 21 Feb 2012, 16:53:02 UTC

this exe runs often on behalf of other services.
i have one instance of it that gets bigger and bigger until i hard reboot. 3.5Gb today.
i have researched this on the web.
is there ANY possibility that boinc/seti has a memory leakage problem?

anyone else had a problem with ever expanding svchost.exe? maybe unrelated to boinc/seti?
eventually i get a windows error and crash with a message something along the lines of "out of virtual memory"....

might not be boinc/seti though....
ID: 1198276 · Report as offensive
Profile arkayn
Volunteer tester
Avatar

Send message
Joined: 14 May 99
Posts: 4438
Credit: 55,006,323
RAC: 0
United States
Message 1198336 - Posted: 22 Feb 2012, 0:04:32 UTC

I do not have it running on my system at all.

ID: 1198336 · Report as offensive
Profile Gatekeeper
Avatar

Send message
Joined: 14 Jul 04
Posts: 887
Credit: 176,479,616
RAC: 0
United States
Message 1198345 - Posted: 22 Feb 2012, 0:37:46 UTC
Last modified: 22 Feb 2012, 0:39:46 UTC

If you've researched it on the web, you've no doubt noticed that the most likely explanation for the increasing size is a malware/trojan infection. I'd consider doing a system repair re-install of Windows to try and correct this.

EDIT: Like arkayn, I don't have it running on any of my 3 systems either.
ID: 1198345 · Report as offensive
OzzFan Crowdfunding Project Donor*Special Project $75 donorSpecial Project $250 donor
Volunteer tester
Avatar

Send message
Joined: 9 Apr 02
Posts: 15691
Credit: 84,761,841
RAC: 28
United States
Message 1198360 - Posted: 22 Feb 2012, 1:42:21 UTC

I find it very hard to believe that SVCHOST.EXE is not running on systems running Windows. SVCHOST.EXE is an important system process required for many functions including loading .DLL files and some network communication handling. Every system of mine dating back to Windows 2000 has had SVCHOST.EXE running in some fashion.

Right now I have 12 SVCHOST.EXE's running in my Task Manager, the largest consuming 233MB of RAM. If you are experiencing a process of SVCHOST.EXE consuming large amounts of RAM, and by proxy causing lots of paging to occur due to lack of memory, and ultimately leading to system instability, you probably have an errant process. It could be caused by a virus, but it could also be caused by a sub-routine in an application stuck in a loop (which would explain it's continually increasing size).

The only two ways I can think of to troubleshoot this is to run an AV program (simply to eliminate this as a possibility) and then to start shutting down applications/services until you find the culprit.

You can read more about SVCHOST.EXE here.

Hope that helps and good luck!
ID: 1198360 · Report as offensive
John McLeod VII
Volunteer developer
Volunteer tester
Avatar

Send message
Joined: 15 Jul 99
Posts: 24806
Credit: 790,712
RAC: 0
United States
Message 1198395 - Posted: 22 Feb 2012, 3:25:16 UTC

In Vista and above, you have to show processes from all users to see svchost.exe.

On the machine on which I am typing this there are currently 7 copies running.


BOINC WIKI
ID: 1198395 · Report as offensive
Profile Jord
Volunteer tester
Avatar

Send message
Joined: 9 Jun 99
Posts: 15184
Credit: 4,362,181
RAC: 3
Netherlands
Message 1198446 - Posted: 22 Feb 2012, 9:31:43 UTC

Using Process Explorer you can check which services are running from that svchost (service host) file.

As for possible spyware & virus problems, aside from running your normal AV and As software, do a run with Superantispyware and with Sophos Anti-Rootkit. These latter are stealthy viruses that run undetected by most AV scanners and can even survive a full Windows reinstall.
ID: 1198446 · Report as offensive
Profile SirionStig

Send message
Joined: 9 Oct 02
Posts: 30
Credit: 128,470
RAC: 0
United Kingdom
Message 1198645 - Posted: 23 Feb 2012, 0:19:11 UTC

Thanks to all for your help thus far.

Perhaps I should have defined a few things:
Windows 7 64 bit;
full 64 bit platform hardware;
8Gb RAM on 2 matched DDR3's;
8Gb Paging file;
Norton 360 v5.2.0.13;
FULL norton systen scan ever night, if on;
run Malwarebytes regularly;
run SpyBot regularly.

The size of one particular svchost.exe gets to about 2.5Gb within about 6 hours from hardboot, and, occasionaly gets to 3.5Gb. I have had 2 "out of memory" events in 6 months.

Any further help would be appreciated, including "no big deal, just reboot..." if i am worrying over something trivial.

I am particualrly concerned when the size of this .exe takes the overal ram in use ABOVE half my ram, as I believe this stops the motherboard/ram dual channelling, and hence slows the system down; Am I misunderstanding dual speed effect of dual channel ram/motherboard?
ID: 1198645 · Report as offensive
John McLeod VII
Volunteer developer
Volunteer tester
Avatar

Send message
Joined: 15 Jul 99
Posts: 24806
Credit: 790,712
RAC: 0
United States
Message 1198650 - Posted: 23 Feb 2012, 0:52:18 UTC - in response to Message 1198645.  
Last modified: 23 Feb 2012, 0:54:43 UTC

Thanks to all for your help thus far.

Perhaps I should have defined a few things:
Windows 7 64 bit;
full 64 bit platform hardware;
8Gb RAM on 2 matched DDR3's;
8Gb Paging file;
Norton 360 v5.2.0.13;
FULL norton systen scan ever night, if on;
run Malwarebytes regularly;
run SpyBot regularly.

The size of one particular svchost.exe gets to about 2.5Gb within about 6 hours from hardboot, and, occasionaly gets to 3.5Gb. I have had 2 "out of memory" events in 6 months.

Any further help would be appreciated, including "no big deal, just reboot..." if i am worrying over something trivial.

I am particualrly concerned when the size of this .exe takes the overal ram in use ABOVE half my ram, as I believe this stops the motherboard/ram dual channelling, and hence slows the system down; Am I misunderstanding dual speed effect of dual channel ram/motherboard?

Use process explorer available at http://technet.microsoft.com/en-us/sysinternals/bb896653 to determine what that particular svchost is hosting.


BOINC WIKI
ID: 1198650 · Report as offensive
Profile BilBg
Volunteer tester
Avatar

Send message
Joined: 27 May 07
Posts: 3720
Credit: 9,385,827
RAC: 0
Bulgaria
Message 1199889 - Posted: 26 Feb 2012, 7:48:51 UTC - in response to Message 1198645.  


As already noted every svchost.exe process is container for many modules, so you have to look at this info:
(and try to spot something you installed around the time this memory leakage problem started):






Hit Alt+Enter and look which part of it have high CPU and ContextSwitch Delta:





 


- ALF - "Find out what you don't do well ..... then don't do it!" :)
 
ID: 1199889 · Report as offensive
John McLeod VII
Volunteer developer
Volunteer tester
Avatar

Send message
Joined: 15 Jul 99
Posts: 24806
Credit: 790,712
RAC: 0
United States
Message 1200497 - Posted: 28 Feb 2012, 0:00:09 UTC

An article about wmiprvse.exe

http://www.wmiprvse.com/

Managed applications never give memory back on their own, they wait for the garbage collection built into the managed code manager to free memory. What all .NET applications do you have running?


BOINC WIKI
ID: 1200497 · Report as offensive
Profile SirionStig

Send message
Joined: 9 Oct 02
Posts: 30
Credit: 128,470
RAC: 0
United Kingdom
Message 1201551 - Posted: 2 Mar 2012, 1:02:51 UTC - in response to Message 1200497.  

Ok, thanks to all.
I need to analyze the output from process explorer, so will get back to you all as soon as i can.

ID: 1201551 · Report as offensive

Questions and Answers : Windows : svchost.exe getting bigger


 
©2024 University of California
 
SETI@home and Astropulse are funded by grants from the National Science Foundation, NASA, and donations from SETI@home volunteers. AstroPulse is funded in part by the NSF through grant AST-0307956.