SVCHOST process using 17gig of RAM

[Phaetos]

I have a 2008 R2 server in a VM on ESXi 5.5. It's allocated 32GB of RAM. It started getting really sluggish and upon looking at the processes, I see that 1 of the svchost.exe processes is using 17,656,448k Private bytes and 17,660,700k Working Set. So it's using 17GB of the 32 available RAM. And if I'm reading it correctly, it is using 23 threads and 16% of the CPU. Wtf?!

I am running ProcessExplorer, but it gives way too much info at one time that I don't understand. How can I tell WHY it's using so much RAM and resources?

 

[Berryracer]

Please run a scan with Malwarebytes anti-malware then run another scan with AdwCleaner

 

[Ketchup]

Running tasklist might be helpful. Full description here:
http://www.bleepingcomputer.com/tutorials/list-services-running-under-svchostexe-process/

But I am with berryracer in that the app using that much memory could very well be some type of malware hiding under that name.

 

[Phaetos]

I'll give it a shot and see what transpires.

ETA: Ran both MWB and Adwcleaner. Neither found any malware, but did find a couple PUP's. ADW demanded an involuntary reboot after it got done, so I'm waiting for it to come back up and see if the RAM usage starts going back up.

ETA 2: Nothing seems amiss after a reboot. only 2.5GB of RAM is in use now. Any other ideas what could've caused it?

 

[Dahak]

ETA 2: Nothing seems amiss after a reboot. only 2.5GB of RAM is in use now. Any other ideas what could've caused it?

Depends on what service is spawned. Usually the svchost process calls other windows services.

In process explorer, if you hold your mouse over the svchost it will list what services are calling it and then you could see what could be the possible culprit

 

[JackMDS]

Maybe this can Help.

http://www.wintips.org/how-to-fix-svchost-exe-netsvcs-memory-leak-or-high-cpu-usage-problems/