Questions and Answers :
Windows :
svchost.exe getting bigger
Message board moderation
Author | Message |
---|---|
SirionStig Send message Joined: 9 Oct 02 Posts: 30 Credit: 128,470 RAC: 0 |
this exe runs often on behalf of other services. i have one instance of it that gets bigger and bigger until i hard reboot. 3.5Gb today. i have researched this on the web. is there ANY possibility that boinc/seti has a memory leakage problem? anyone else had a problem with ever expanding svchost.exe? maybe unrelated to boinc/seti? eventually i get a windows error and crash with a message something along the lines of "out of virtual memory".... might not be boinc/seti though.... |
arkayn Send message Joined: 14 May 99 Posts: 4438 Credit: 55,006,323 RAC: 0 |
|
Gatekeeper Send message Joined: 14 Jul 04 Posts: 887 Credit: 176,479,616 RAC: 0 |
If you've researched it on the web, you've no doubt noticed that the most likely explanation for the increasing size is a malware/trojan infection. I'd consider doing a system repair re-install of Windows to try and correct this. EDIT: Like arkayn, I don't have it running on any of my 3 systems either. |
OzzFan Send message Joined: 9 Apr 02 Posts: 15691 Credit: 84,761,841 RAC: 28 |
I find it very hard to believe that SVCHOST.EXE is not running on systems running Windows. SVCHOST.EXE is an important system process required for many functions including loading .DLL files and some network communication handling. Every system of mine dating back to Windows 2000 has had SVCHOST.EXE running in some fashion. Right now I have 12 SVCHOST.EXE's running in my Task Manager, the largest consuming 233MB of RAM. If you are experiencing a process of SVCHOST.EXE consuming large amounts of RAM, and by proxy causing lots of paging to occur due to lack of memory, and ultimately leading to system instability, you probably have an errant process. It could be caused by a virus, but it could also be caused by a sub-routine in an application stuck in a loop (which would explain it's continually increasing size). The only two ways I can think of to troubleshoot this is to run an AV program (simply to eliminate this as a possibility) and then to start shutting down applications/services until you find the culprit. You can read more about SVCHOST.EXE here. Hope that helps and good luck! |
John McLeod VII Send message Joined: 15 Jul 99 Posts: 24806 Credit: 790,712 RAC: 0 |
In Vista and above, you have to show processes from all users to see svchost.exe. On the machine on which I am typing this there are currently 7 copies running. BOINC WIKI |
Jord Send message Joined: 9 Jun 99 Posts: 15184 Credit: 4,362,181 RAC: 3 |
Using Process Explorer you can check which services are running from that svchost (service host) file. As for possible spyware & virus problems, aside from running your normal AV and As software, do a run with Superantispyware and with Sophos Anti-Rootkit. These latter are stealthy viruses that run undetected by most AV scanners and can even survive a full Windows reinstall. |
SirionStig Send message Joined: 9 Oct 02 Posts: 30 Credit: 128,470 RAC: 0 |
Thanks to all for your help thus far. Perhaps I should have defined a few things: Windows 7 64 bit; full 64 bit platform hardware; 8Gb RAM on 2 matched DDR3's; 8Gb Paging file; Norton 360 v5.2.0.13; FULL norton systen scan ever night, if on; run Malwarebytes regularly; run SpyBot regularly. The size of one particular svchost.exe gets to about 2.5Gb within about 6 hours from hardboot, and, occasionaly gets to 3.5Gb. I have had 2 "out of memory" events in 6 months. Any further help would be appreciated, including "no big deal, just reboot..." if i am worrying over something trivial. I am particualrly concerned when the size of this .exe takes the overal ram in use ABOVE half my ram, as I believe this stops the motherboard/ram dual channelling, and hence slows the system down; Am I misunderstanding dual speed effect of dual channel ram/motherboard? |
John McLeod VII Send message Joined: 15 Jul 99 Posts: 24806 Credit: 790,712 RAC: 0 |
Thanks to all for your help thus far. Use process explorer available at http://technet.microsoft.com/en-us/sysinternals/bb896653 to determine what that particular svchost is hosting. BOINC WIKI |
BilBg Send message Joined: 27 May 07 Posts: 3720 Credit: 9,385,827 RAC: 0 |
As already noted every svchost.exe process is container for many modules, so you have to look at this info: (and try to spot something you installed around the time this memory leakage problem started): Hit Alt+Enter and look which part of it have high CPU and ContextSwitch Delta: Â - ALF - "Find out what you don't do well ..... then don't do it!" :) Â |
John McLeod VII Send message Joined: 15 Jul 99 Posts: 24806 Credit: 790,712 RAC: 0 |
An article about wmiprvse.exe http://www.wmiprvse.com/ Managed applications never give memory back on their own, they wait for the garbage collection built into the managed code manager to free memory. What all .NET applications do you have running? BOINC WIKI |
SirionStig Send message Joined: 9 Oct 02 Posts: 30 Credit: 128,470 RAC: 0 |
Ok, thanks to all. I need to analyze the output from process explorer, so will get back to you all as soon as i can. |
©2024 University of California
SETI@home and Astropulse are funded by grants from the National Science Foundation, NASA, and donations from SETI@home volunteers. AstroPulse is funded in part by the NSF through grant AST-0307956.