svchost.exe constantly increasing in RAM use - then XP crashes

[tradmusic]

Hi,

We've been having this problem for a while now. Tracey has posted before,
but despite following several useful leads and ideas, we're still
experiencing the same problem. Here goes:

We boot up XP, which loads fine. Once it's loaded, we noticed the machine
gets slow after about an hour's use.

Ctrl+Alt+Del and we notice in the Task Manager that svchost.exe is sat and
something like 600,000 K!
Re-boot. Then we Ctrl+Alt+Del again, and we notice that one occurence of
svchost.exe (marked as LOCAL_SERVICE) is basically increasing in Memory
use - slowly - but surely!

This goes on and on until, as I say, everything freezes, and the memory
can't cope with it. What is happening?

We've got (totally up to date versions of): PestPatrol, AdAware, McAfee (and
more!) running, and nothing picks it up as trojan, spyware etc? We've
looked into msconfig and shut down anything that we didn't recognise (we saw
a thing called cler.exe in msconfig shut it down, but svchost is still
motoring away!).

Any help and advice would be greatly appreciated.
Thanks.
nath.

 

[Guest]

I have the same problem. Just last night, I alleviated it by ending the svchost.exe process that was marked as a local service. Have you tried that? Just highlight it in task manager and click on end process. I really don't know if that will have any adverse effects and I know that it does not get to the root of the problem, but it seems to be a temporary fix, at least

Now, if you don't mind, let's see what else we can figure out about this anomaly. Here are some of the things I've noticed. Let me know if you have seen the same things or noticed anything additional

1. In my computer, the memory allocated to the paging file increases by 1 MB every 5 seconds
2. I searched for svchost.exe in windows explorer and found two instances of the file. One appeared to have properties that matched the other windows files. But, there is a folder I have, windows/prefetch/, that has a number of files in it, one of which is called svchost.exe-564OFT34.pf (the numbers and letters I gave you in that file name are not accurate, but you get the idea). Everything in that directory is an executable file followed by the suffix, hyphen, random numbers and letters, and then a ".pf." The file in the directory that corresponds to the svchost process is dated Jan. 4 for its creation and modification. Suspicious, I think
3. I've had some problems with IE that at least chronologically correspond with these memory problems

I really suspect that we are victims of a very new virus that has no fix, yet. So, keep posting. Have you messaged the McAfee people

 

[Guest]

I have a thread that I started yesterday called "paging file - whoa" that has received some reponses. You can check it out for more details. I am copying one of the latest responses here

svchost.exe should only be found in the system32 folder

Prefetch is in the windows folder,it is very possiable
that you have a virus.Do you have an anti-virus program
that is current and updated

Svchost (1) Svchost.ex
Microsoft) Service Host - Generic Host Process for Win32
Services. Windows 2000/XP/2003 only. SVCHOST is a
generic process which acts as a host for processes that
run from DLLs rather than EXEs. At startup SVCHOST
checks the Services portion of the Registry to construct
a list of DLL-based services that it needs to load, and
then loads them. There can be many instances of SVCHOST
running, as there will be one instance of SVCHOST for
every DLL-based service or grouping of services (the
grouping of services is determined by the programmers who
wrote the services in question). Under Windows XP
Professional and Windows 2003 you can find out what DLL
based services SVCHOST is running by typing Tasklist /SVC
at a Command/MS-DOS Prompt (this command is not available
in Windows XP Home), while under Windows 2000 you need to
use the TLIST -s command from a Command Prompt (MS-DOS
Prompt)

Recommendation :
An integral part of the operating system, leave alone -
multiple instances of SVCHOST is a normal occurrence. If
you experience SVCHOST errors, the problem is most likely
not with SVCHOST but with the DLLs it is hosting


Svchost (2) SVCHOST.EX
(???) Many viruses masquerade themselves as SVCHOST to
escape detection. Some have names that are similar, such
as SCCHOST, while others actually drop a program file
called SVCHOST in the Windows or Windows System directory

Recommendation :
The first recommendation is a simple one : always have a
good antivirus product which is regularly updated
(automatically preferably) and always renew your updates
subscription when it expires. To detect if you have a
virus that calls itself SVCHOST, first see if it shows up
in The Ultimate Troubleshooter - if it does, then it is
almost certain you have a virus. Secondly, if you have
Windows 95/98/ME rather than WinNT4/2000/XP, then it is
almost certain you have a virus. Thirdly, go to "Control
Panel \ Administrative Tools \ Services" and look for any
of the following services - if you find any of them, then
you probably have a virus :

 

[tradmusic]

Hi Parish, thanks for the input.

Yeah, we had sussed that we could just "end process" on it - but we don't
really want to have to do that every time we boot up our machine. It does
sound like we have the same problem which is slightly re-assuring (up to
this point, NOBODY was having these problems).

All anti-virus, anti-trojan are up-to-date - none of them picking this up!

I'm pretty sure that it is indeed one of these DLL's - problem is, we have
XP home so we can't run the command Tasklist/SVC!! I'll give TLIST -s a try
though.

The last recommendation was to go to Admin Tools > Services and look for the
following services....

What did the rest of that post say Parish?

Thanks again for your help. Hopefully we'll get rid of this swine of a
thing sometime soon.

Nath.

I have a thread that I started yesterday called "paging file - whoa" that

has received some reponses. You can check it out for more details. I am
copying one of the latest responses here:

 

[Guest]

In don't think I left anything out of that post I copied. Also, if you do a search of these forums for svchost, you will find that other shave ahd at least similar problems.

Have you checked that prefetch directory?

 

[Guest]

Hello tradmusic.....your problem is almost word for word the same as mine. After boot up, my svchost.exe ....local services clocks up ram at a slow but steady pace. eventually using all of my ram and moving into the virtual ram and the computer slows to a crawl. This happened to me about a year ago and i reformatted and the problem went away, but now it is back, exactly as before. I am very sure it is a fixable problem without reloading but so far have not found a way. I am very sure it is NOT virus related. Any imput from anyone would be very appreciated.

 

[tradmusic]

Exactly HAL...then we sometimes get an "Out of Virtual Memory" error
message. Once that appears then we know it's close to freezing.

Re-assuring to know that this is perhaps not virus related. Also
re-assuring to know that someone else is experiencing this!

Anyway, aren't you meant to be the most powerful computer ever made HAL?
Whenever we try to fix the problem on our machine, it starts singing
"Daisy...D..ais...y...I'm afraid Dave".

Any advice would be greatly appreciated. Thanks.
Nath.

Hello tradmusic.....your problem is almost word for word the same as mine.

After boot up, my svchost.exe ....local services clocks up ram at a slow but
steady pace. eventually using all of my ram and moving into the virtual ram
and the computer slows to a crawl. This happened to me about a year ago and
i reformatted and the problem went away, but now it is back, exactly as
before. I am very sure it is a fixable problem without reloading but so far
have not found a way. I am very sure it is NOT virus related. Any imput from
anyone would be very appreciated.