SVCHOST.EXE taking up >500MB of RAM?

[SwampSurvivor]

I think this computer is infected with something. After running for about 20 minutes, SVCHOST.EXE (or a process named as such) gets running and taking up >500 MB. Not sure what's going on.

I have run combofix and Kaspersky malware removal. Neither of which find anything.

Any thoughts?

 

[Shannow]

You might have the ITunes virus.

When mine plays up, I kill ITunes, and the computer CPU and memory usage drop to almost nothing.

 

[NateDN10]

svchost is used in Windows to run background services. In more unixy operating system, each of these services would get their own process; on Windows process creation is more expensive, so just a few svchost processes get spawned, each with many threads running the individual services.

Is it using a lot of CPU? How much RAM do you have? Are there any other symptoms pointing toward virus? Just taking up 500MB of RAM isn't necessarily a warning flag - there could be 20 services running on this one process.

 

[tinmanSC]

Try to disable windows update. ( right click My Computer, or just "computer" depending on OS => manage => services => windows update/automatic update => right click stop then DISABLE the service. Reboot windows. Watch it for a few hours under normal use. If that fixes the problem you have a corrupted win update staging files directory.) 3 times out of 5 this is the problem.

 

[SwampSurvivor]

In my experience, once it starts pulling in that much RAM, there's something else going on.

There are also 3 or 4, and I can kill them through task manager. Shouldn't be able to do that.

The computer has 2GB of ram. It's not using any CPU, but it causes the computer to start paging. At that point, it can't display netflix properly.

 

[Subdued]

What OS?

 

[Rand]

fresh install of windows ?

 

[Subdued]

All of the advice here is wrong if this is windows vista or newer. Superfetch is a memory management service that runs through svchost that can use a large chunk of ram. Superfetcch caches oft used programs into memory and can significantly speed up the computer.

It also releases ram as needed so it's functionality is transparent.

Shut down the superfetch service and if the ram is released you have your answer. Do not disable this service - it isn't hurting you at all.

As an aside, people have all this ram and freak out when it's actually being used. Old way of thinking. Get with the times.

 

[Rand]

I have 24GB of ram. and 19GB is cached information. my svchost is The OP's computer using 500MB+ is not normal

Originally Posted By: Subdued
All of the advice here is wrong if this is windows vista or newer. Superfetch is a memory management service that runs through svchost that can use a large chunk of ram. Superfetcch caches oft used programs into memory and can significantly speed up the computer.

It also releases ram as needed so it's functionality is transparent.

Shut down the superfetch service and if the ram is released you have your answer. Do not disable this service - it isn't hurting you at all.

As an aside, people have all this ram and freak out when it's actually being used. Old way of thinking. Get with the times.

 

[Subdued]

Meanwhile my vista laptop with 2gb ram has svchost at 450 on a fresh boot, and the install is pretty new.

As usual, your mileage may vary.

If svchost was steadily increasing over time and not releasing anything, then there is cause for concern. Steady at 500mb with no ill effects observed isn't exactly earth shattering.

 

[Rand]

how much is svchost using after 30min?

 

[Subdued]

Dropped to 400

again there would be more concern if it climbs steadily or there's some other symptom. (heavy IO or network traffic, for example)

 

[sleddriver]

Dwnld Process Explorer, then install. It'll allow you to see everything running, how much memory it uses, cpu cycles, etc. You can also 'see down into' the various threads and processes running under a SVCHOST.exe.

Process Monitor may also be of use.

Both by Sysinternals.

 

[Subdued]

^^ Excellent program, I forgot about it

 

[Triple_Se7en]

Originally Posted By: sleddriver
Dwnld Process Explorer, then install. It'll allow you to see everything running, how much memory it uses, cpu cycles, etc. You can also 'see down into' the various threads and processes running under a SVCHOST.exe.

Process Monitor may also be of use.

Both by Sysinternals.


Do you need to be an intermediate-level computer user to "see down into it"?

Does it break down each "host' into plain English categories of the System, so unused ones can be shut down or disabled?

 

[SwampSurvivor]

It looks like it's related to silverlight.

I used it all day yesterday, played a few DVDs, watched some youtube on it and it was fine.

As soon as I start watching netflix, it starts a SVCHOST.EXE and that process will run up until I kill it.

OS is Windows 7 64 bit.

Closest thing I have to compare is my work computer. It is also windows 7 64 bit and it runs continually. Currently it has been running for 20 days and there are a few processes titled SVCHOST but they add up to around 200MB

 

[Triple_Se7en]

Why are you using Silverlight? For Business or Mobile apps?
Both of my Windows computers have Adobe Flashplayer as it's default player. I once had to load Silverlight to get something to play. After it played, I disabled Silverlight in Firefox Tools/Add Ons.

 

[Subdued]

Netflix requires silverlight.

Makes sense since that Vista machine I referenced earlier is only used to stream Netflix to a TV

 

[Triple_Se7en]

I get my Netflix thru a ROKU player (Living room TV) and a Sony DVD Player (basement TV).

I also stream and have done-away with cable and satellite TV subscriptions. Everything streamed comes thru Adobe Flashplayer /or various attached 2nd parties attached to Flashplayer. None of the 2nd parties require a computer downloads. I only notice the differing video names by right-clicking on my mouse during a video.

 

[SwampSurvivor]

Originally Posted By: Triple_Se7en
Why are you using Silverlight? For Business or Mobile apps?
Both of my Windows computers have Adobe Flashplayer as it's default player. I once had to load Silverlight to get something to play. After it played, I disabled Silverlight in Firefox Tools/Add Ons.


Silverlight for netflix. That is this laptop's only purpose. Hooked up to the TV and used for DVD / Netflix


Originally Posted By: Subdued
Netflix requires silverlight.

Makes sense since that Vista machine I referenced earlier is only used to stream Netflix to a TV


The strange thing is, my other laptop (Windows 7 32 bit) doesn't have a problem with SVCHOST taking up a lot of memory when the silverlight plugin is running.