none
svchost.exe

    Question

  • Hi there, dont know if this has been covered but i couldn't find it sorry if it has!!

    i have a major memory leak in one of my instances of svchost.exe, and going through and disabling services that are contained in this host 1 by 1 i have narrowed it down to the DHCP client. unfortunatly disabling this stops any network traffic...

    its a pretty big leak too, its at 274,680k at the mo, growing by about 80k a second, and it grows until it reaches about 1.25Gb and then stops, but all the services that it is hosting stop too, and that includes windows audio, all network connections etc etc (about 30 services in all)

    is there any way to stop this leak? and if not is there any way for me to assign the DHCP client to its own host so i can just end the process when it gets to big and keep my sound?

    Oh, and on a note that makes it relevant to placing it here, it only seems to have started happening since i installed sp3.

    Heres my specs if they are of any help...

    Windows XP Pro 32

    Asus P5KSE

    Intel Core 2 Pentium E2160 1.8GHz @ 3068MHz and 1.4v

    4GB Corsair CMS2-6400 @ 950MHz

    2X 160GB Western Digital/320GB Maxtor/160GB Portable Seagate

    BFG NVidia GeForce 9600 GT 512 700/900 @ 720/950

    Creative Sound Blaster XFi Extreme Audio

    2X Sony Multi Layer DVDRW

    Storm 700W Modular Power Supply

    Thermaltake Bigwater 750 water cooling kit with Aquabay M1


    Cheers

    Chris
    Wednesday, March 19, 2008 12:59 PM

Answers

  •  ChrisTheGeek wrote:
    i cant remember. all i can tell you is that it say's 'service pack 3 v 3244' in my computer. not sure how i find out otherwise...

     

    Chris,

     

    If its said "Service Pack 3, v.3264", you have an older version of SP3. To reconfirm, go to Start --> Run... --> and type "winver" without quotes, and hit the Enter button, an "About Windows" context should shows.

     

    Uninstall SP3 from Add or Remove Programs inside control panel, download the latest SP3 v.3311 from Microsoft website for testing purposes.

     

    1) For English Version of XP - WindowsXP-KB936929-SP3-x86-ENU.exe

    http://www.microsoft.com/downloads/details.aspx?familyid=114f3599-12af-42b2-aab1-b969a62c68a7&displaylang=en&tm

     

    Regards,

    Thomas

    Wednesday, March 19, 2008 9:30 PM
  • all my important stuff i keep backed up on a seperate hdd, so i'm alright.

    anyway, just uninstalled and installed the newer version!

    This seems to have done it thank god. although one of the svchosts are 50+ meg its not getting any bigger, and with 4 gig of ram to roll around in, i'm sure i'll survive!

    Thanks for your help guys! i'll be back if i have another problem i cant fix on my own!
    Wednesday, March 19, 2008 10:49 PM

All replies

  •  ChrisTheGeek wrote:
    i have a major memory leak in one of my instances of svchost.exe, and going through and disabling services that are contained in this host 1 by 1 i have narrowed it down to the DHCP client. unfortunatly disabling this stops any network traffic...

     

    Hi Chris,

     

    To further assist SP3 team to find the cause of memory leak. There are a few free tools to assist you to find the .dll/handle file hooked to svchost.exe.

     

    1) A description of Svchost.exe in Windows XP Professional Edition (link here)

    2) TList by Microsoft (link here)

    3) ProcessExplorer by Sysinternals (link here)

    4) How to debug Windows services (link here)

     

    Regards,

    Thomas

     

     

     

     

     

    Wednesday, March 19, 2008 3:53 PM
  • Hi Chris,

     

    Can you please generate a process memory dump for the instance of svchost you are experiencing the memory leak with.

    Please execute the following command -

    ntsd -p %process ID of svchost.exe% -g -c ".dump /ma /u c:\svchost.dmp"

    Note: Obtain the process ID using taskmgr.

     

    Use shashank<dot>bansal<at>microsoft<dot>com for sharing the dump file.

     

    Looking forward to a reply

     

    Thanks

    Shashank

     

    Wednesday, March 19, 2008 6:55 PM
  • Please do mention the build of SP3 you are experiencing the issue with.

    Wednesday, March 19, 2008 6:57 PM
  • righto

    firstoff, i used the process explorer to find out what services were linked to that particular host so i have that.

    you know i'm not sure what sp3 version i have. i know i installed the beta, but i might have installed the latest release since... i cant remember. all i can tell you is that it say's 'service pack 3 v 3244' in my computer. not sure how i find out otherwise...

    i'll run the dump and send the results to you, see what you think.

    I've restarted a couple of times since my first post, but the host is now 615200+k mem usage/926500 VM size :-(
    Wednesday, March 19, 2008 9:20 PM
  •  ChrisTheGeek wrote:
    i cant remember. all i can tell you is that it say's 'service pack 3 v 3244' in my computer. not sure how i find out otherwise...

     

    Chris,

     

    If its said "Service Pack 3, v.3264", you have an older version of SP3. To reconfirm, go to Start --> Run... --> and type "winver" without quotes, and hit the Enter button, an "About Windows" context should shows.

     

    Uninstall SP3 from Add or Remove Programs inside control panel, download the latest SP3 v.3311 from Microsoft website for testing purposes.

     

    1) For English Version of XP - WindowsXP-KB936929-SP3-x86-ENU.exe

    http://www.microsoft.com/downloads/details.aspx?familyid=114f3599-12af-42b2-aab1-b969a62c68a7&displaylang=en&tm

     

    Regards,

    Thomas

    Wednesday, March 19, 2008 9:30 PM
  • i just did the dump, and it came up with a couple of errors to do with where i was saving it, but upon trying it again, the Pid has changed. i have looked around in the process explorer and the svchost has dissapeared, however windows audio has appeared in another, but the dhcp client has gone altogether from all the svchost instances, but my internet is still working...

    i dont know if its just coincidence that it happened when i did the dump, but i also have no growing svchost any more... i dont wanna restart now if its going to be fine ;-)
    Wednesday, March 19, 2008 9:33 PM
  • i also seem to have less cpu utilisation (as well much more free ram obviously!) i do indeed have an older version of sp3 (v3244 to be exact) so i'm downloading the new version. shame i have to uninstall the old before installing the new though, but thats what i get for wanting to try out these things early!
    Wednesday, March 19, 2008 9:42 PM
  • Before uninstalling and reinstalling SP3, do make backup of your important documents. Also do system restore point or clone/ghost image. Good luck!

     

    Regards,

    Thomas

     

    Wednesday, March 19, 2008 9:58 PM
  • all my important stuff i keep backed up on a seperate hdd, so i'm alright.

    anyway, just uninstalled and installed the newer version!

    This seems to have done it thank god. although one of the svchosts are 50+ meg its not getting any bigger, and with 4 gig of ram to roll around in, i'm sure i'll survive!

    Thanks for your help guys! i'll be back if i have another problem i cant fix on my own!
    Wednesday, March 19, 2008 10:49 PM
  •  ChrisTheGeek wrote:
    although one of the svchosts are 50+ meg its not getting any bigger,

     

    Chris,

     

    BTW, there're some new services installed by SP3. You may disable Network Access Protection Agent or change to manual startup if you don't need it.

     

    These are the new services; (Personally, I've disable all these services because I don't need them.)

     

    Bluetooth Support Service,

    Extensible Authentication Protocol Service,

    Health Key and Certificate Management Service,

    Network Access Protection Agent,

    Network Provisioning Service,

    Wired AutoConfig

     

    Regards,

    Thomas

    Wednesday, March 19, 2008 11:20 PM
  • Hi,
      I want to mention here that I am experiencing the same problem since last week.  I cannot nail down what created the problem.  My laptop has XP Service Pk 2.  I have been to the download center and downloaded latest updates.  Still I see the problem.  Basically, svchost.exec NETWORK SERVICE is leaking memory. I see a correlation between the leak and the browsing pattern, more data downloaded, faster the leak.  There is another svhost.exe. SYSTEM which is basically using 25% of CPU.  If I kill this one, the memory leak on NETWORK SERVICE stops.  I cannot kill the NETWORK SERVICE svchost since it is related to RPC and hence if I kill it, I need to reboot the system.  Please help.

    Thanks

    Saturday, April 05, 2008 8:35 PM
  • Thanks for the input Thomas.

    We know about some of these, which are maintaining their behavior as shown by SP2.

     

    Keeping these services on would not impact the functionality as long as they are not used. You can safely trun these off, if you would like to.

     

    Thanks

    Shashank

     

    Wednesday, April 09, 2008 3:39 PM