This issue is killing me. svchost.exe is sucking up all my memory and I'm helpless

[hamunaptra]

In your screenshot, I only see one app referencing Avast and it uses 2 MB. I have never seen an antivirus that runs on so little memory, and I have used Avast. Shouldn't take too much time to do an uninstall and take a look.

Just because the avast executive is using a tiny portion of RAM, doesnt mean its driver isnt malfunctioning and causing a huge use of RAM. Also every AV's product of on access scanning is different, some are betters other are worse...this determines a AV's IO overhead.

 

[hamunaptra]

What I would do, is in ur services tab image you posted. Under each one of those service listed, select stop for applicable services. If all of them stop and RAM usage is not affected.
Then its most likely the windows foundation driver service .. meaning you for sure have a user mode driver that is eating your RAM like crazy.

To see the usermode drivers installed on your machine go to run
type msinfo32
go to Software Environment -> System Drivers
This list will show a column labeled 'type' sort by type and look for anything indicating a user mode driver.
Report back.

 

[iamgenius]

Did you guys miss the line where I said that I already tried stopping all services under that instance of svchost.exe and I was able to stop all of them except windows driver foundation, and RAM usage didn't decrease at all?

It is windows driver foundation by the looks of it. I'll follow the tips posted here and see what I can do.

hmailserver is there doing nothing currently, so I can uninstall but I don't think it is the reason. Bigant is a LAN instant messaging app, which is supposedly light.

And you guys say ASC is useless? It is got some good reviews in some websites!

 

[hamunaptra]

any tuneup type utility for windows is absolute garbage regardless of websites say. Dont use them .. PERIOD
please follow the steps I outlined in my previous post.

 

[mikeymikec]

Did you guys miss the line where I said that I already tried stopping all services under that instance of svchost.exe and I was able to stop all of them except windows driver foundation, and RAM usage didn't decrease at all?

I guess I did miss that! Sorry.

And you guys say ASC is useless? It is got some good reviews in some websites!

Reviews that were most likely paid for, IMO. The thing about performance tweaking is that the person/program doing the tweaking needs to know what the machine is used for, and therefore what's needed and what isn't. There's not a lot of valid universal assumptions to be made. Such programs like to come out with analyses such as "your computer has 614 registry errors!"... err, no it hasn't. If there was one the registry wouldn't load. Call it an incorrect registry setting if you must, but that doesn't sound half as sales'y as a scary sounding registry error.

It's also odd how such packages generally load every time the computer starts up... what, someone's computer needs cleaning out every day? Why is there a resident process on your machine? Wouldn't a process starting every time the computer starts up be counter-productive to performance, or is the greater priority for the software maker to get you to see this wonderful bit of software "actively protecting you"?

Performance tweaking customers' computers is a large part of what I do for a living. Usually after the first visit, even if I don't see the customer for another year, their computer doesn't need much work the next time I see it, because most people don't make such a mess of their computer to require a program running all the time to counter the deluge of crap.

Another amusing one I've seen from such software is "your mouse/monitor driver is out of date, it's making your computer run slowly". Hopefully 'nuff said.

The icing on the cake however is when one goes to uninstall this sort of program is the "but wait, there are still 1600 errors on your system" message. Hopefully, also, 'nuff said.

 

[hamunaptra]

yeah, what he said =P .. and I previously summed it up as such... all 'optimization / utility / cleaning software' is crap.

 

[iamgenius]

This is my sys info shot. The only driver that is a user mode driver is the one before the last as you can see in the image. But, this wasn't written under the type column. Anyways, what's next?

Should I disable windows driver foundation in services and restart the computer?

And regarding ASC, it is a shame to see some good websites doing good reviews for snake oil software like you described it.

Thanks.

 

[iamgenius]

Because it can't be stopped, I disabled windows driver foundation service and restarted the computer. Now I'll see if the issue will come back. And hopefully this wouldn't affect my computer functionality.

Thanks.

 

[iamgenius]

It is just crazy. Windows driver foundation is disabled, however, ram usage still reached 82% after two days and it is stuck there. I'm pulling my hair, I don't know what's the culprit!

 

[Bubbaleone]

It is just crazy. Windows driver foundation is disabled, however, ram usage still reached 82% after two days and it is stuck there. I'm pulling my hair, I don't know what's the culprit!

You've been struggling with this issue for six days now. Two situations that will definitely eat huge amounts of resources are rootkits and a damaged operating system. By first eliminating the possibility that you're infected you can then safely take the steps to repair your system.

Since rootkits are undetectable by normal AV scans, aren't visible as a Windows process, and can do a large amount of damage to critical system files and registry entries as they rewrite code, I have two suggestions: Kaspersky's anti-rootkit utility; TDSSKiller will take care of any possible rootkits. On that page click "1. How to disinfect a compromised system" and you'll find the download link for tdsskiller.exe. Read all the info on that page so you understand how to use it. When TDSSKiller has finished its work it's time to repair your Windows installation.

The simplest method of completely restoring your system without losing any installed programs, settings, and personal data is by performing Win7′s no-reformat, nondestructive reinstall. It's simple, but familiarize yourself with the procedure before you begin.

 

[cheez]

OP, I have similar issue as well, but slightly different. My Svchost service takes up 50% CPU utilization, but takes a small amount of RAM. When I run benchmark it doesn't seem to make any difference whether it was ran with or without the service.

I still don't like the fact that service pops up at random time... Killing it would do no good as it comes back an hour later.


The programmers at Microsoft are slobs.


cheez

 

[iamgenius]

You've been struggling with this issue for six days now. Two situations that will definitely eat huge amounts of resources are rootkits and a damaged operating system. By first eliminating the possibility that you're infected you can then safely take the steps to repair your system.

Since rootkits are undetectable by normal AV scans, aren't visible as a Windows process, and can do a large amount of damage to critical system files and registry entries as they rewrite code, I have two suggestions: Kaspersky's anti-rootkit utility; TDSSKiller will take care of any possible rootkits. On that page click "1. How to disinfect a compromised system" and you'll find the download link for tdsskiller.exe. Read all the info on that page so you understand how to use it. When TDSSKiller has finished its work it's time to repair your Windows installation.

The simplest method of completely restoring your system without losing any installed programs, settings, and personal data is by performing Win7′s no-reformat, nondestructive reinstall. It's simple, but familiarize yourself with the procedure before you begin.

Tdsskiller didn't find anything. However, when I clicked on change parameters and selected the additional options (Verify file digital sig & detect TDLFS file system) and ran the scan again, it found some unsigned stuff. That shouldn't be harmful so I just skipped them.

It is not rootkits I guess. And regarding the possibility of a damaged OS, I actually did format one of the PC's and reinstalled windows again but it didn't help.

Told you I'm puzzled!

 

[JackMDS]

Looking at your Process Exploiter output it seems that the thread of svhost that takes the memory involves something called syncappw

Maybe this can Help.

http://www.processlibrary.com/directory/files/syncappw/402768/

To find how syncappw is loading you can try to use this free App.

http://sync-center.com/viewtopic.php?f=5&t=148

http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

 

[hamunaptra]

Just download combofix from bleeping computer and run it =P it will remove nearly all nasty infections if any exist.

 

[iamgenius]

Just download combofix from bleeping computer and run it =P it will remove nearly all nasty infections if any exist.

I have always been hearing good things about combofix, but I remember that it needs some experience in using it. Is it still the case? Hopefully it is just straightforward now.

 

[Bubbaleone]

.....I actually did format one of the PC's and reinstalled windows again but it didn't help.

Told you I'm puzzled!

OK, I'm confused; what do you mean by your above quoted statement? I thought your thread was about one PC you're having trouble with, but apparently not.

Running TDSSKiller was just to eliminate the "possibility" that you're infected, and then to perform the inplace upgrade installation in order to repair the svchost problem.

 

[Ketchup]

Do you have some syncing software installed when you start noticing this (like the one JackMDS mentioned)?

 

[hamunaptra]

yeah combofix is straight forward nowadays. The thing ya gotta know how to take care is when the OS is damaged as a result of whatever combofix fixed / removed etc...
I clean computers all day long of infections and combofix only really messes stuff up like 1% of the time.

 

[iamgenius]

OK, I'm confused; what do you mean by your above quoted statement? I thought your thread was about one PC you're having trouble with, but apparently not.

Running TDSSKiller was just to eliminate the "possibility" that you're infected, and then to perform the inplace upgrade installation in order to repair the svchost problem.

It is actually more than one pc. If you read the OP, you will notice that I mentioned it.

 

[iamgenius]

Looking at your Process Exploiter output it seems that the thread of svhost that takes the memory involves something called syncappw

Maybe this can Help.

http://www.processlibrary.com/directory/files/syncappw/402768/

To find how syncappw is loading you can try to use this free App.

http://sync-center.com/viewtopic.php?f=5&t=148

http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

Do you have some syncing software installed when you start noticing this (like the one JackMDS mentioned)?

I have allwaysync installed on the machine I mainly use. I have a shared drive and allwaysync is there to backup this drive to another one of the same size.
(If you have a better way of doing this, please tell me).

The problem is present in more than one pc, and allwaysync is installed only on one machine. So, even if allwaysync is causing it in this one pc, there should be something else causing in others. Or maybe it is not allwaysync at all.


I will update you guys in few hours.

 

[seepy83]

iamgenius,

You said that you formatted one of the PCs and did a fresh install of Windows. I'm guessing that you Installed windows, and then immediately installed all of your drivers and applications...which was not necessarily the best way to troubleshoot. You should probably do another clean installation of windows, and then install one driver or application at a time (using the PC for a while in between installs) until you find the one that is causing the problem. Obviously some drivers need to be installed immediately for you to be able to use the PC, but you should install any non-essential ones on-by-one.