Still experiencing memory leak - look for help

[Cyberdude]

I am experiencing a memory leak, and I need help with figuring out what

to do. Is there something I can run to try and identify the culprit?

Once of the svchost.exe images generally starts at around 29,256K.
The longer I leave my PC up, the more it just keeps growing. I went
away on vacation for a week, and the process had grown to 300,000+K.


Using TaskList /svc, this is what shows
Image Name: svchost.exe
Services:
AudioSrv, CryptSvc, Dhcp, dmserver,
EventSystem, helpsvc, lanmanserver,
lanmanworkstation, Netman, Nla, RasMan,
seclogon, SENS, ShellHWDetection, srservice,
TapiSrv, Themes, uploadmgr, W32Time,
winmgmt, wuauserv, WZCSVC


Is there anything obvious?


Can anyone help me or suggest how to locate the problem?

Cyberdude

 

[Guest]

This particular instance of svchost.exe contains Windows services that run
underneath it.

For a certain diagnosis you can try stopping each of the underlying
services, then check the Processes tabs in Task Manager to see if it goes
away. I'm not familiar with uploadmgr - so I'd try that first.

But, since these are Windows services, I'm suspicious that there may be a
malware infection. I'd suggest that you go to
http://housecall.trendmicro.com/ for a free, online scan of your system.

 

[cdearborn]

I am experiencing this as well. My tasklist /svc looks similar:

AudioSrv, BITS, CryptSvc, Dhcp, dmserver,
ERSvc, EventSystem, helpsvc, lanmanserver,
lanmanworkstation, Netman, Nla, RasMan,
Schedule, seclogon, SENS, ShellHWDetection,
TapiSrv, Themes, TrkWks, W32Time, winmgmt,
wuauserv, WZCSVC

I've found that just killing the offending svchost.exe process is a
nice work around versus restarting the entire pc. This pc has trend
micro officescan installed and appears to be clean.

Here's what tasklist /svc looks like after killing the process, and
it's restarted itself:
BITS, EventSystem, helpsvc, Schedule, SENS,
Themes, winmgmt

At this point (after the kill), svchost.exe is using 11,208 K mem and
it's VM size is 6,672 K

 

[DatabaseBen]

maybe a download called autoruns by sysinternals.com can help you
drill down a possible problem.

to use it, find an undesired entry
uncheck it then double click the file name to disable it in the registry.
see if this helps. you can reverse the disabling by checking
the line item in autoruns then double clicking the filename.
you can also delete the entry in autorun after you are sure
it is disabled in the registry.

then try to see if you have any of those rootkit malwares. there are
a couple of rootkit cleaners.

another freeware is called active monitor processes which
may be able to give you details of that specific svchost process that
is running....