Is there any tangible solution to fixing application RAM buildup?
svchost.exe is now taking up over 400 megs and my comp has been on for
a couple days. Firefox does the same thing, but firefox I can
fortunately restart, svchost I can't without restarting the whole OS.

Industrial One wrote:
> Is there any tangible solution to fixing application RAM buildup?
> svchost.exe is now taking up over 400 megs and my comp has been on for
> a couple days. Firefox does the same thing, but firefox I can
> fortunately restart, svchost I can't without restarting the whole OS.

If your symptoms match this, for the time being, disable the
update function.

"Windows XP: High memory usage for svchost+wuauclt"
http://forums.cnet.com/5208-6142_102...hreadID=408643

http://social.answers.microsoft.com/...4-8ce618f3e939

"visit http://update.microsoft.com/microsoftupdate

click Change Settings on the left

Scroll down and DISABLE MICROSOFT UPDATE"

Perhaps that will help, until Microsoft issues a fix.

Paul

On Sep 18, 10:05 pm, Paul <nos...@needed.com> wrote:
> Industrial One wrote:
> > Is there any tangible solution to fixing application RAM buildup?
> > svchost.exe is now taking up over 400 megs and my comp has been on for
> > a couple days. Firefox does the same thing, but firefox I can
> > fortunately restart, svchost I can't without restarting the whole OS.
>
> If your symptoms match this, for the time being, disable the
> update function.
>
> "Windows XP: High memory usage for svchost+wuauclt"http://forums.cnet.com/5208-6142_102-0.html?threadID=408643
>
> http://social.answers.microsoft.com/...hread/c41d2ef2...
>
> "visithttp://update.microsoft.com/microsoftupdate
>
> click Change Settings on the left
>
> Scroll down and DISABLE MICROSOFT UPDATE"
>
> Perhaps that will help, until Microsoft issues a fix.
>
> Paul

My Automatic updates are already turned off... I don't trust M$'s so-
called "security fixes."

Industrial One wrote:
> On Sep 18, 10:05 pm, Paul <nos...@needed.com> wrote:
>> Industrial One wrote:
>>> Is there any tangible solution to fixing application RAM buildup?
>>> svchost.exe is now taking up over 400 megs and my comp has been on for
>>> a couple days. Firefox does the same thing, but firefox I can
>>> fortunately restart, svchost I can't without restarting the whole OS.
>> If your symptoms match this, for the time being, disable the
>> update function.
>>
>> "Windows XP: High memory usage for svchost+wuauclt"http://forums.cnet.com/5208-6142_102-0.html?threadID=408643
>>
>> http://social.answers.microsoft.com/...hread/c41d2ef2...
>>
>> "visithttp://update.microsoft.com/microsoftupdate
>>
>> click Change Settings on the left
>>
>> Scroll down and DISABLE MICROSOFT UPDATE"
>>
>> Perhaps that will help, until Microsoft issues a fix.
>>
>> Paul
>
> My Automatic updates are already turned off... I don't trust M$'s so-
> called "security fixes."

The only other thing I can suggest, if you have WinXP Pro, is
go to command prompt and do

tasklist /svc

which will list the contents of each service host. Maybe that
will tell you what the svchost is doing, which is using so much RAM.

These are my svchost entries:

svchost.exe 1228 DcomLaunch, TermService
svchost.exe 1316 RpcSs
svchost.exe 1440 AudioSrv, CryptSvc, Dhcp, dmserver, ERSvc,
EventSystem, FastUserSwitchingCompatibility,
helpsvc, Irmon, LanmanServer,
lanmanworkstation, Netman, Nla, RasMan,
Schedule, seclogon, SENS, SharedAccess,
ShellHWDetection, srservice, TapiSrv,
Themes, TrkWks, W32Time, winmgmt, wscsvc,
wuauserv, WZCSVC
svchost.exe 1540 Dnscache
svchost.exe 1652 Alerter, LmHosts, RemoteRegistry, SSDPSRV
svchost.exe 592 WebClient
svchost.exe 860 stisvc

My svchost PID 1440 is using 22MB of RAM, the others around 4MB or so each.

If you have WinXP Home, you can use Process Explorer to list the same
kind of info. In fact, with Process Explorer, you can at least get
a text string for each of those services, so you can get a better idea
as to what they are.

http://technet.microsoft.com/en-ca/s.../bb896653.aspx

So far, I can't find a utility that will give a breakdown of the resources
used by each item inside a svchost. That would be useful info, as the
other debugging method (shutting down services one by one), is dangerous
and time consuming. Never shut down a service, without seeing what other
services depend on it first.

Paul

On Sep 19, 1:14*am, Paul <nos...@needed.com> wrote:
> Industrial One wrote:
> > On Sep 18, 10:05 pm, Paul <nos...@needed.com> wrote:
> >> Industrial One wrote:
> >>> Is there any tangible solution to fixing application RAM buildup?
> >>> svchost.exe is now taking up over 400 megs and my comp has been on for
> >>> a couple days. Firefox does the same thing, but firefox I can
> >>> fortunately restart, svchost I can't without restarting the whole OS.
> >> If your symptoms match this, for the time being, disable the
> >> update function.
>
> >> "Windows XP: High memory usage for svchost+wuauclt"http://forums.cnet.com/5208-6142_102-0.html?threadID=408643
>
> >>http://social.answers.microsoft.com/...hread/c41d2ef2....
>
> >> * *"visithttp://update.microsoft.com/microsoftupdate
>
> >> * * click Change Settings on the left
>
> >> * * Scroll down and DISABLE MICROSOFT UPDATE"
>
> >> Perhaps that will help, until Microsoft issues a fix.
>
> >> * * Paul
>
> > My Automatic updates are already turned off... I don't trust M$'s so-
> > called "security fixes."
>
> The only other thing I can suggest, if you have WinXP Pro, is
> go to command prompt and do
>
> * * tasklist /svc
>
> which will list the contents of each service host. Maybe that
> will tell you what the svchost is doing, which is using so much RAM.
>
> These are my svchost entries:
>
> svchost.exe * * * * * * * * 1228 DcomLaunch, TermService
> svchost.exe * * * * * * * * 1316 RpcSs
> svchost.exe * * * * * * * * 1440 AudioSrv, CryptSvc, Dhcp, dmserver, ERSvc,
> * * * * * * * * * * * * * * * * * EventSystem, FastUserSwitchingCompatibility,
> * * * * * * * * * * * * * * * * * helpsvc, Irmon, LanmanServer,
> * * * * * * * * * * * * * * * * * lanmanworkstation, Netman, Nla, RasMan,
> * * * * * * * * * * * * * * * * * Schedule, seclogon, SENS, SharedAccess,
> * * * * * * * * * * * * * * * * * ShellHWDetection, srservice, TapiSrv,
> * * * * * * * * * * * * * * * * * Themes, TrkWks, W32Time, winmgmt, wscsvc,
> * * * * * * * * * * * * * * * * * wuauserv, WZCSVC
> svchost.exe * * * * * * * * 1540 Dnscache
> svchost.exe * * * * * * * * 1652 Alerter, LmHosts, RemoteRegistry, SSDPSRV
> svchost.exe * * * * * * * * *592 WebClient
> svchost.exe * * * * * * * * *860 stisvc
>
> My svchost PID 1440 is using 22MB of RAM, the others around 4MB or so each.
>
> If you have WinXP Home, you can use Process Explorer to list the same
> kind of info. In fact, with Process Explorer, you can at least get
> a text string for each of those services, so you can get a better idea
> as to what they are.
>
> http://technet.microsoft.com/en-ca/s.../bb896653.aspx
>
> So far, I can't find a utility that will give a breakdown of the resources
> used by each item inside a svchost. That would be useful info, as the
> other debugging method (shutting down services one by one), is dangerous
> and time consuming. Never shut down a service, without seeing what other
> services depend on it first.
>
> * * Paul

How exactly will this tell me who the memory-hungry ****er is? Here's
a list of services run by svchost, not that it will tell anyone
anything:


I:\WINDDWS\system32\svchost.exe
Services:
Automatic Updates [wuauserv]
Background Intelligent Transfer Service [BITS]
CDM+ Event System [EventSystem]
Computer Browser [Browser]
Cryptographic Services [CryptSvc]
DHCP Client [Dhcp]
Distributed Link Tracking Client [TrkWks]
Fast User Switching Compatibility [FastUserSwitchingCompatibiIity]
Help and Support [helpsvc]
HID Input Service [HidServ]
Logical Disk Manager [dmserver]
Network Connections [Netman]
Network Location Awareness [NI..A] [Nla]
Flemote Access Connection Manager [FIasMan]
Secondary Logon [seclogon]
Security Center [wscsvc]
Server [Ianmanserver]
Shell Hardware Detection [SheIIHWDetection]
System Event Notification [SENS]
System Flestore Service [srservice]
Task Scheduler [Schedule]
Telephony [TapiSrv]
Themes [Themes]
Windows Audio [AudioSrv]
Windows FirewaII.··'Internet Connection Sharing [ICS] [SharedAccess]
Windows Management Instrumentation [winmgmt]
Windows Time [w32time]
Wireless Zero Configuration [WZCS\·"C]
Workstation [Ianmanworkstation]

Excuse the spelling errors, ProcessXP produced that as a picture, so I
used OCR. Btw, I disabled automatic updates in the services right
after seeing that there, and svchost.exe is still growing, so you can
be assured it's not the culprit.

Industrial One wrote:
> On Sep 19, 1:14 am, Paul <nos...@needed.com> wrote:
>> Industrial One wrote:
>>> On Sep 18, 10:05 pm, Paul <nos...@needed.com> wrote:
>>>> Industrial One wrote:
>>>>> Is there any tangible solution to fixing application RAM buildup?
>>>>> svchost.exe is now taking up over 400 megs and my comp has been on for
>>>>> a couple days. Firefox does the same thing, but firefox I can
>>>>> fortunately restart, svchost I can't without restarting the whole OS.
>>>> If your symptoms match this, for the time being, disable the
>>>> update function.
>>>> "Windows XP: High memory usage for svchost+wuauclt"http://forums.cnet.com/5208-6142_102-0.html?threadID=408643
>>>> http://social.answers.microsoft.com/...hread/c41d2ef2...
>>>> "visithttp://update.microsoft.com/microsoftupdate
>>>> click Change Settings on the left
>>>> Scroll down and DISABLE MICROSOFT UPDATE"
>>>> Perhaps that will help, until Microsoft issues a fix.
>>>> Paul
>>> My Automatic updates are already turned off... I don't trust M$'s so-
>>> called "security fixes."
>> The only other thing I can suggest, if you have WinXP Pro, is
>> go to command prompt and do
>>
>> tasklist /svc
>>
>> which will list the contents of each service host. Maybe that
>> will tell you what the svchost is doing, which is using so much RAM.
>>
>> These are my svchost entries:
>>
>> svchost.exe 1228 DcomLaunch, TermService
>> svchost.exe 1316 RpcSs
>> svchost.exe 1440 AudioSrv, CryptSvc, Dhcp, dmserver, ERSvc,
>> EventSystem, FastUserSwitchingCompatibility,
>> helpsvc, Irmon, LanmanServer,
>> lanmanworkstation, Netman, Nla, RasMan,
>> Schedule, seclogon, SENS, SharedAccess,
>> ShellHWDetection, srservice, TapiSrv,
>> Themes, TrkWks, W32Time, winmgmt, wscsvc,
>> wuauserv, WZCSVC
>> svchost.exe 1540 Dnscache
>> svchost.exe 1652 Alerter, LmHosts, RemoteRegistry, SSDPSRV
>> svchost.exe 592 WebClient
>> svchost.exe 860 stisvc
>>
>> My svchost PID 1440 is using 22MB of RAM, the others around 4MB or so each.
>>
>> If you have WinXP Home, you can use Process Explorer to list the same
>> kind of info. In fact, with Process Explorer, you can at least get
>> a text string for each of those services, so you can get a better idea
>> as to what they are.
>>
>> http://technet.microsoft.com/en-ca/s.../bb896653.aspx
>>
>> So far, I can't find a utility that will give a breakdown of the resources
>> used by each item inside a svchost. That would be useful info, as the
>> other debugging method (shutting down services one by one), is dangerous
>> and time consuming. Never shut down a service, without seeing what other
>> services depend on it first.
>>
>> Paul
>
> How exactly will this tell me who the memory-hungry ****er is? Here's
> a list of services run by svchost, not that it will tell anyone
> anything:
>
>
> I:\WINDDWS\system32\svchost.exe
> Services:
> Automatic Updates [wuauserv]
> Background Intelligent Transfer Service [BITS]
> CDM+ Event System [EventSystem]
> Computer Browser [Browser]
> Cryptographic Services [CryptSvc]
> DHCP Client [Dhcp]
> Distributed Link Tracking Client [TrkWks]
> Fast User Switching Compatibility [FastUserSwitchingCompatibiIity]
> Help and Support [helpsvc]
> HID Input Service [HidServ]
> Logical Disk Manager [dmserver]
> Network Connections [Netman]
> Network Location Awareness [NI..A] [Nla]
> Flemote Access Connection Manager [FIasMan]
> Secondary Logon [seclogon]
> Security Center [wscsvc]
> Server [Ianmanserver]
> Shell Hardware Detection [SheIIHWDetection]
> System Event Notification [SENS]
> System Flestore Service [srservice]
> Task Scheduler [Schedule]
> Telephony [TapiSrv]
> Themes [Themes]
> Windows Audio [AudioSrv]
> Windows FirewaII.··'Internet Connection Sharing [ICS] [SharedAccess]
> Windows Management Instrumentation [winmgmt]
> Windows Time [w32time]
> Wireless Zero Configuration [WZCS\·"C]
> Workstation [Ianmanworkstation]
>
> Excuse the spelling errors, ProcessXP produced that as a picture, so I
> used OCR. Btw, I disabled automatic updates in the services right
> after seeing that there, and svchost.exe is still growing, so you can
> be assured it's not the culprit.

The only technique I've been able to find so far, is to look at
the svchost with the "appetite" for RAM, look at the list of
services it hosts, and disable the services one at a time. I
can't find any mention of a tool that can view heap, stack,
memory allocations or anything else, for the services inside
a svchost. There must be a way to do that, and yet I can't find
any evidence the information exists. Maybe one of the
fancy debuggers makes the information available. If anyone possesses
the skills to make this possible, it would be the guy at Sysinternals,
who does more to make capabilities available to end users, than anyone
else at Microsoft.

I just tried this one, and while I was able to tell it to display
info for my PID 1440 svchost, there still seems to be no way to
connect "private data" consumption, to the associated DLL. You
can see where the actual DLL image is stored, but that isn't going
to help you.

"VMMap v2.62"
http://technet.microsoft.com/en-ca/s.../dd535533.aspx

The only "fun" function the tool has, is in the Edit menu. There
is an option to run "strings" and look for printable strings
within the object you select from the table. Only a few memory
areas so far, have had printable contents. Right now, that's the
only thing of value I see there.

I have a copy of windbg here, but I still can't get it to do anything.
I guess it needs to be "attached" to some process, in order to work.

Paul

Industrial One wrote:
> On Sep 18, 10:05 pm, Paul <nos...@needed.com> wrote:
>> Industrial One wrote:
>>> Is there any tangible solution to fixing application RAM buildup?
>>> svchost.exe is now taking up over 400 megs and my comp has been on
>>> for a couple days. Firefox does the same thing, but firefox I can
>>> fortunately restart, svchost I can't without restarting the whole
>>> OS.
>>
>> If your symptoms match this, for the time being, disable the
>> update function.
>>
>> "Windows XP: High memory usage for
>> svchost+wuauclt"http://forums.cnet.com/5208-6142_102-0.html?threadID=408643
>>
>> http://social.answers.microsoft.com/...hread/c41d2ef2...
>>
>> "visithttp://update.microsoft.com/microsoftupdate
>>
>> click Change Settings on the left
>>
>> Scroll down and DISABLE MICROSOFT UPDATE"
>>
>> Perhaps that will help, until Microsoft issues a fix.
>>
>> Paul
>
> My Automatic updates are already turned off... I don't trust M$'s so-
> called "security fixes."

If your XP system (which has so many security holes) is not patched,
then the most probable cause of your svchost problem is malware. What is
the malware status of your PC?

If you have no malware, you can always configure a Clean Boot and then
methodically re-enable the different programs/processes you disabled
until you discover the one causing the issue. See:

http://support.microsoft.com/kb/310353

Industrial One wrote:

>>> My Automatic updates are already turned off...

> Here's a list of services run by svchost, not that it will tell anyone
> anything:

> Automatic Updates [wuauserv]

So, in fact, it was not turned off. ;-)

> Btw, I disabled automatic updates in the services right
> after seeing that there, and svchost.exe is still growing,
> so you can be assured it's not the culprit.

I'm not convinced it's fully turned off. I still would follow the advice
Paul gave you to opt out of Microsoft Update (reverting to the default
Windows Update does infact resolve the problem Paul mentioned).

But as I stated in my other post, if this is not your issue, the most
probable cause is malware, and you must rule that out first. Also, if
you choose not to run Automatic Updates, you should regularly go the
Windows Update website and download and install all the security patches
(not the other updates, which have been known to cause problems!).
Current malware is making its way into systems these days primarily
through XP's security holes.

On Sep 19, 7:54 am, "Daave" <da...@example.com> wrote:
> Industrial One wrote:
> > On Sep 18, 10:05 pm, Paul <nos...@needed.com> wrote:
> >> Industrial One wrote:
> >>> Is there any tangible solution to fixing application RAM buildup?
> >>> svchost.exe is now taking up over 400 megs and my comp has been on
> >>> for a couple days. Firefox does the same thing, but firefox I can
> >>> fortunately restart, svchost I can't without restarting the whole
> >>> OS.
>
> >> If your symptoms match this, for the time being, disable the
> >> update function.
>
> >> "Windows XP: High memory usage for
> >> svchost+wuauclt"http://forums.cnet.com/5208-6142_102-0.html?threadID=408643
>
> >>http://social.answers.microsoft.com/...hread/c41d2ef2...
>
> >> "visithttp://update.microsoft.com/microsoftupdate
>
> >> click Change Settings on the left
>
> >> Scroll down and DISABLE MICROSOFT UPDATE"
>
> >> Perhaps that will help, until Microsoft issues a fix.
>
> >> Paul
>
> > My Automatic updates are already turned off... I don't trust M$'s so-
> > called "security fixes."
>
> If your XP system (which has so many security holes) is not patched,
> then the most probable cause of your svchost problem is malware. What is
> the malware status of your PC?

My PC is clean.

> If you have no malware, you can always configure a Clean Boot and then
> methodically re-enable the different programs/processes you disabled
> until you discover the one causing the issue. See:
>
> http://support.microsoft.com/kb/310353

That link assumes user has SP3, I have SP2.

On Sep 19, 8:02 am, "Daave" <da...@example.com> wrote:
> Industrial One wrote:
> >>> My Automatic updates are already turned off...
> > Here's a list of services run by svchost, not that it will tell anyone
> > anything:
> > Automatic Updates [wuauserv]
>
> So, in fact, it was not turned off. ;-)

.... It was turned off in the control panel, but still enabled in
services. Personally I don't know the difference. I turned it off
there too, so should be good. If not, let me hear the 47 other places
I forgot to turn it off in.

> > Btw, I disabled automatic updates in the services right
> > after seeing that there, and svchost.exe is still growing,
> > so you can be assured it's not the culprit.
>
> I'm not convinced it's fully turned off. I still would follow the advice
> Paul gave you to opt out of Microsoft Update (reverting to the default
> Windows Update does infact resolve the problem Paul mentioned).

Problem with that link is that it requests I use Internet Explorer,
which I'd rather stick a cactus up my ass than use that unreliable
piece of ****. Furthermore, I got confused the first time I looked at
it because it was giving me instructions to turn auto updates ON.

Thank you for your interest in obtaining updates from our site.

To use this site, you must be running Microsoft Internet Explorer 5 or
later.

To upgrade to the latest version of the browser, go to the Internet
Explorer Downloads website.

If you prefer to use a different web browser, you can obtain updates
from the Microsoft Download Center or you can stay up to date with the
latest critical and security updates by using Automatic Updates. To
turn on Automatic Updates:

1. Click Start, and then click Control Panel.
2. Depending on which Control Panel view you use, Classic or
Category, do one of the following:
* Click System, and then click the Automatic Updates tab.
* Click Performance and Maintenance, click System, and then
click the Automatic Updates tab.
3. Click the option that you want. Make sure Automatic Updates is
not turned off.


> But as I stated in my other post, if this is not your issue, the most
> probable cause is malware, and you must rule that out first. Also, if
> you choose not to run Automatic Updates, you should regularly go the
> Windows Update website and download and install all the security patches
> (not the other updates, which have been known to cause problems!).
> Current malware is making its way into systems these days primarily
> through XP's security holes.

The only security holes I'm aware of is the easy spoofing of the admin
account and thus getting control of the entire machine. Sadly I don't
have all the l33t tools I used to have back in the day where I'd
virtually barracade my computer inside out, but I think I'm good.

Whatever, I'll go download the security fixes.

On Sep 19, 8:26*am, Industrial One <industrial_...@hotmail.com> wrote:
> Whatever, I'll go download the security fixes.

Wow, Microsoft is still not letting me browse their site with Firefox.
Can someone provide a mirror link for the security patch?