svchost.exe

[Ben]

Why does svchost.exe use 28MB of RAM on my system? I turn on my PC, let it
boot, login, start task manager and after about 10 mintues svchost.exe is
using 28MB of RAM. Why?

Thanks,

 

[Gerry Cornell]

Ben

Download Process Explorer.

For further information about Process Explorer see here:
http://www.sysinternals.com/ntw2k/freeware/procexp.shtml


To ascertain which service is causing the problem select the svchost
producing the high CPU usage, right click,
select Properties, Services. Note there are the full names and
some explanation of what each service does.


You will find further information on Services here:
http://majorgeeks.com/page.php?id=12


To trace the particular Service involved you need to turn off each
service in turn and then restore it noting what effect it has on CPU
usage. However, you need to take care and watch what other Services are
dependent on that service. When you click on the Dependencies tab allow
it a little time to display the information.



--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[JS]

From Ramesh's web site: http://windowsxp.mvps.org/svchost.htm
Also: http://support.microsoft.com/?kbid=314056

To find out more about Svchost.exe entries try Process Explorer:
http://www.sysinternals.com/Utilities/ProcessExplorer.html

Once you have Process Explorer installed and running:
In the taskbar select View and check 'Show Process Tree' and 'Show Lower
Pane' options.
(This will provide the detailed info you need)
Next click/Expand the Svchost.exe process that you are interest in.
Then highlight one of the process listed under Svchost, right click and from
the options listed select: google
This should display what out there on the web about that process.

JS

 

[Ben]

Why does svchost.exe use 28MB of RAM on my system? I turn on my PC, let
it boot, login, start task manager and after about 10 mintues svchost.exe
is using 28MB of RAM. Why?

Thanks,

Ok I ran Tasklist /SVC and this was the list:

svchost.exe 772 DcomLaunch, TermService
svchost.exe 856 RpcSs
svchost.exe 920 AudioSrv, Dhcp, dmserver, ERSvc,
EventSystem, Netman, Nla, Schedule,
seclogon, SENS, SharedAccess,
ShellHWDetection, Themes, TrkWks, W32Time,
winmgmt, wscsvc, wuauserv
svchost.exe 964 Dnscache

So I gave my PC a static IP and disabled DHCP client and DNS client
services. I also disabled terminal services and Network Location Awareness
(NLA). I set the task scheduler to manual. I set Security Center (wscsvc)
to manual as my anti-virus software updates itself and I always apply MS
patches within 24 hours of release. I also set W32time to manual. I
rebooted my PC and everything is OK so far. After all of this svchost is
using 15.5MB. Here is an updated list:

svchost.exe 784 DcomLaunch
svchost.exe 884 RpcSs
svchost.exe 944 AudioSrv, dmserver, ERSvc, EventSystem,
Netman, seclogon, SENS, SharedAccess,
ShellHWDetection, Themes, TrkWks, winmgmt,
wuauserv

Here is what I have learned so far about the rest:

DcomLaunch is needed for the firewall
SharedAccess is needed for the firewall

RpcSs cannot be shutoff

AudioSrv is needed for sound
dmserver is needed
ERSvc I like so I leave it on
EventSystem I also like so I leave it on
Netman is needed
SENS is System Event Notification Service and is needed
ShellHWDetection is needed or bootup and login take 5 minutes.
Themes I prefer the way windows looks with this on. It is ugly with it off.
TrkWks is probably needed as it is Distributed Link Tracking Client.
winmgmt is needed
Wuauserv is windows automatic update. Can't disable or microsoftupdate
stops working.

Secondary Logon might or might not be needed. I am a little confused. I
have found conflicting reports on the web about this service. Does
Secondary Logon control the services that use alternate accounts (i.e. Local
System, Local Service, and Network service)? If so then this should
probably stay automatic.

Thanks,

 

[Gerry Cornell]

Ben

You are supposed to investigate one running svchost.exe not every one!
The one
using CPU when it is not anticipated!

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~