SVCHOST memory leak?

[KenB]

After doing updates from June and July, a few of my machines in the
following configuration are throwing up messages about low virtual memory.

Pentium 4 2.0GHz machine
256 mb ram
Windows XP Pro, sp2

The shell has been modified to be one of our home-grown MS Access databases.

Looking in the Task Manager reveals the following processes at the top of
the list, sorted by memory usage:

image name user cpu mem usage vm size
svchost.exe system 99 103,956 100428
wuauclt.exe system 00 11,976 7,996
mcshield.exe system 00 11,132 26,628
msaccess.exe shopuse 00 8848 11132


The following are the svchost processes, when sorted by image name:
svchost.exe system 00 1504
2988
svchost.exe Network Service 00 1344 2088
svchost.exe system 99 101848
105652
svchost.exe Network Service 00 732
1524
svchost.exe Local Service 00 640
1908

The svchost.exe taking over 100MB hasn't done that in the past, and it
started recently... is there any fix to this?... or that I can track down
exactly what is causing the svchost to take that much memory? I know it's
not just one funky computer--it's doing it on like 10 machines now.

Any help would be greatly appreciated!

TIA

Ken

 

[ginolard]

It could be one of so many different things. SVCHOST is just a host
process for different services and/or processes.

However, we had a similar problem and tracked it down to the Webclient
service. Disable it and reboot and see if it happens again

 

[JS]

Try Process Explorer to narrow down the culprit:
http://www.sysinternals.com/Utilities/ProcessExplorer.html

JS

 

[KenB]

Hrmm..

Tried disabling the WebClient service, but that didn't seem to help it. I
increased the paging file from 384mb to 1024mb (1GB). Nobody really 'uses'
the computers per se'--they just sit in Access all day with a barcode reader
waiting for someone to swipe their card for attendance purposes, so an
increased page file shouldn't impact performance (too much at least)

Any other ideas/solutions would be greatly appreciated

Ken

 

[DanS]

Try Process Explorer to narrow down the culprit:
http://www.sysinternals.com/Utilities/ProcessExplorer.html

JS

To expand on this, with Process Explorer, dbl-click the svchost that is
jamming on the CPU and there is a tab called 'Services' in the property
box. Click that and it will show what that particular svchost.exe is
hosting.

DanS