This issue is killing me. svchost.exe is sucking up all my memory and I'm helpless

[iamgenius]

Hello folks.

I'm sure you have seen this somewhere. It is when svchost.exe eats up most of your memory. I've got few PC's in a workgroup network with 8 GB of RAM, which is plenty for what the PC's are used for. Very often, it happens that about 89% of RAM is used and the computer becomes little unresponsive and when I check what is using it, it is always svchost. I go check the services and find that most of them are important for windows. When I end svchost.exe process, the RAM is freed and windows continue to work fine with no problems whatsoever, which is weird because if they are important it should somehow affect windows. Also, if they are important and are regular services found running in every PC, why are they taking too much RAM?

I actually stopped some of the services, but it didn't really help. PC's are viruses free and malware free.

I'm puzzled, and I can't solve this. I'll post a screen shot in few minutes.


Thanks.

 

[iamgenius]

Here is the shot:

 

[ViRGE]

Each instance of svchost will be running several services at once. So you're going to need to stop the services it's hosting one-by-one until your memory usage comes under control. Once you've isolated the misbehaving service you can start doing research into what's going on.

 

[MrChad]

Process Explorer may give you some more information about what's running under svchost.exe.

 

[Ketchup]

One example is the later versions of AVG. If you look in the Processes tab, it would seem the AVG program is hardly using any memory, until you find the huge svchost application attached to it.

 

[iamgenius]

Each instance of svchost will be running several services at once. So you're going to need to stop the services it's hosting one-by-one until your memory usage comes under control. Once you've isolated the misbehaving service you can start doing research into what's going on.

Okay, I'll try this tomorrow and see.

 

[hamunaptra]

use the process explorer program previously linked in this thread. It shows you what services are running within each instance of svchost.exe
Using the threads tab on the given service eating up all the RAM, you might be able to figure out a bit more info after finding the thread representing the service and its mem consumption, then look at its stack info and it may give you a possible idea as to why.

 

[SimMike2]

You don't mention which OS you are using, which is a critical piece of information.

 

[Ketchup]

You don't mention which OS you are using, which is a critical piece of information.

Looks like 7 to me.

 

[Ketchup]

iamgenius, if Process Explorer doesn't clear it up for you, post a screenshot of your processes tab.

 

[iamgenius]

Okay, I'll try this tomorrow and see.

I stopped the services one by one to see which one will drop the RAM usage. Strangely enough, no service I stopped affected the RAM consumption. Only one service, which is windows driver foundation, couldn't be stopped because the stop button was grayed out. What does that really mean? Shouldn't closing services svchost.exe is hosting lower the RAM consumed by svchost.exe? Or is windows driver foundation is the suspect?

I'll come back in few minutes.

 

[Ketchup]

How do you know svchost.exe is using all your memory? It is normal to have several instances running on a PC.

If you don't want to upload a pic, can you tell us what memory numbers are you seeing on the processes tab?

 

[iamgenius]

How do you know svchost.exe is using all your memory? It is normal to have several instances running on a PC.

I know. Only one of the instances is eating up about 6800 MB of my 8 GB. And it is this one that is hosting all the services I showed you above. I'll post a shot as soon as I get to the computer with the problem. I'm away now.

If you don't want to upload a pic, can you tell us what memory numbers are you seeing on the processes tab?

The svchost.exe in question is taking about 6800 MB. I'll post a photo soon.

You don't mention which OS you are using, which is a critical piece of information.

I'm sorry, it is 7 ultimate.

use the process explorer program previously linked in this thread. It shows you what services are running within each instance of svchost.exe
Using the threads tab on the given service eating up all the RAM, you might be able to figure out a bit more info after finding the thread representing the service and its mem consumption, then look at its stack info and it may give you a possible idea as to why.

Okay okay, I'll do this and post my findings. Please give me some time.

And thanks to all.

 

[hamunaptra]

Just a heads up if windows driver foundation is the offending hosted service... you most likely have a driver installed,probably a software driver if I had to guess, thats causing the issue. In this case it can be anything from backup software to antivirus to viruses...causing it.

 

[seepy83]

Just a heads up if windows driver foundation is the offending hosted service... you most likely have a driver installed,probably a software driver if I had to guess, thats causing the issue. In this case it can be anything from backup software to antivirus to viruses...causing it.

I was basically going to post exactly this. Based on the info in this thread so far, it appears the OP may have a User Mode Driver that's causing the problem.

OP - You said you have a few PCs in a workgroup that have this problem, and you thought 8GB of RAM was plenty for what the PCs are doing. Do you have any specific hardware or software running on these machines that is relatively unique to them? What are the PCs used for?

 

[iamgenius]

Here is processes shot:




The machines are similar, so a driver software causing the issue is a big possibility. Will come back in few minutes.

 

[mikeymikec]

I'll put my money on Windows Update / BITS

 

[Ketchup]

I'll put my money on Avast (if I had any).
Uninstall Avast on one of the machines and see what happens.

 

[iamgenius]

I'll put my money on Windows Update / BITS

What exactly do you mean?

I'll put my money on Avast (if I had any).
Uninstall Avast on one of the machines and see what happens.

Why avast? I have been using avast in my laptop and in my PC's at home for years with no problems whatsoever. Also, I actually did remove it on some of the machines due to another reason and installed MSE instead but it still didn't help so it is not avast unless it is more complicated than this.

 

[iamgenius]

Fore more info, here are process explorer screenshots:










How do I know how much RAM each service is using?

 

[Ketchup]

Why avast? I have been using avast in my laptop and in my PC's at home for years with no problems whatsoever. Also, I actually did remove it on some of the machines due to another reason and installed MSE instead but it still didn't help so it is not avast unless it is more complicated than this.

In your screenshot, I only see one app referencing Avast and it uses 2 MB. I have never seen an antivirus that runs on so little memory, and I have used Avast. Shouldn't take too much time to do an uninstall and take a look.

 

[iamgenius]

In your screenshot, I only see one app referencing Avast and it uses 2 MB. I have never seen an antivirus that runs on so little memory, and I have used Avast. Shouldn't take too much time to do an uninstall and take a look.

I already said that I uninstalled Avast and put MSE on some of the machines but the issue is still happening. Of course when you restart the PC or start from a cold boot, things are fine, but it will gradually reach 89% Ram usage after some time.

For those who asked what I'm doing with the PC's:

1- Word Processing(MS word)
2- Presentations(MS powerpoint)
3- Two machines are also using google earth and ArcGIS.

that's about it. Nothing special.

 

[mikeymikec]

Fore more info, here are process explorer screenshots:

Ok, you've narrowed down the list of possible misbehaving services considerably.

What I would do next is start up a command prompt with admin privs (search for 'command prompt' in the start menu, right-click, run as admin).

Do:

NET STOP <servicename>
(without the greater/less than symbols)

for each service name (left hand column from your screenshot) you've got for that instance of svchost. Keep an eye on process explorer to find out when RAM usage drops considerably. If a service requires another service to be stopped, do it.

I was wrong about it being due to Windows Update or BITS by the looks of things.

Tip: Uninstall "Advanced System Care", it's snake-oil ware.

 

[seepy83]

For those who asked what I'm doing with the PC's:

1- Word Processing(MS word)
2- Presentations(MS powerpoint)
3- Two machines are also using google earth and ArcGIS.

that's about it. Nothing special.

Your screenshot also shows it running some kind of Instant Messenger (BigAnt) and a Mail Server (hMailServer). If the assumption is that the offending service is wudfsvc, and some software installed a User-Mode driver that is causing the problem, then either of those could also be the cause.

 

[dawks]

I suspect a poorly coded Driver as well.
Get Autoruns.exe from TechNet/Sysinternals. This will allow you to see a list of drivers loaded on boot. You can then uncheck each one and reboot to see if that helps the problem.

If you're not using HomeGroup for filesharing with other local Windows Machines, I recommend disabling that Service as well. (I like to kill services I'm not using for security and slight performance reasons).