none
svchost.exe eating RAM win 7

    Question

  • Recently, within the last few days RAM usage on my computer has spiked significantly with one of the svchost.exe processes listed in task manager.  memory usage peaks at around 120,000k and includes the folllowing services:

    wudfsvc

    WPDBusEnum

    Wlansvc

    UxSms

    TrkWks

    SysMain

    PcaSvc

    Netman

    IpBusEnum

    HomeGroupListener

    hidserv

    AudioEndpointBuilder

     

    I'm running win7 64 bit and I have about 4Gb RAM

    is there a way to reduce this usage and why the increase?

    this consumes around 40% memory.

    Please help. 

     

    Wednesday, December 29, 2010 4:54 PM

Answers

All replies

  • Ok the process uses 120MB, but this is only 2% usage. The value is fine.

    If your PC uses 40% all the time, please download RAMMap [1] and run it when you have the high Memory usage. Now save the data as a RMP file. Zip the RMP file and upload the zip to your SkyDrive [2] and post a link here.

    André

    [1] http://technet.microsoft.com/en-us/sysinternals/ff700229.aspx
    [2] http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Wednesday, December 29, 2010 7:14 PM
  • Hi,

     

    I have viewed the services you mentioned. All of them are normal in Windows 7. Therefore, I suggest we perform a Clean Boot as well.

     

    Please let us know the result.

     

    Regards,

    Simida


    Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Vivian Xing Wednesday, January 05, 2011 8:23 AM
    Friday, December 31, 2010 6:07 AM
  • Hi,

    I'm having the same problem, svchost.exe eat more memory than usual because of this services.

    Laptop Hp probook 4520S, Windows 7 64bits, 4GB Ram

    I was working in xp-mode trying to install a usb modem internet connection (everywhere) and setting ICS. In my host was added Loopback adapter. At the same time it was downloading files from websites not so trusted, so, I've got doubts why this problem.

    Norton 360 Installed (Scan: 36 cookies)

    I'm doing a full scan witho onecare of Microsoft, after that if it's possible I would like to continue this post.

     

    Thank you All

    Monday, January 24, 2011 7:11 PM
  • Please download VMMap [1], run it and select the svchost.exe which uses most RAM. Now save the data as a mmp file. Zip the mmp file and upload the zip to your SkyDrive [2] and post a link here.

    André

    [1] http://technet.microsoft.com/en-us/sysinternals/dd535533.aspx
    [2] http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65
    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Monday, January 24, 2011 8:00 PM
  • Looks like you have to be System to use VMMap on svchost.

     

    Monday, January 24, 2011 10:59 PM
  • Looks like you have to be System to use VMMap on svchost.

    no, you need Admin rights:

    http://windows.microsoft.com/en-US/windows7/How-do-I-run-an-application-once-with-a-full-administrator-access-token

    to use the VirtualQuery API on services.


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Tuesday, January 25, 2011 3:29 PM
  • These are the only processes I can pick with vmmap in 64 bit win 7, even elevating to administrator:

    dwm.exe

    explorer.exe

    taskhost.exe

    vmmap.exe

    vmmap64.exe

     

    Tuesday, January 25, 2011 3:40 PM
  • For me it works. Do you use the latest version?


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Tuesday, January 25, 2011 4:37 PM
  • Yep, I just downloaded 3.01.  Do you have UAC disabled?

     

    Tuesday, January 25, 2011 4:42 PM
  • no. I selected the program to run as admin. But I use the 32Bit Windows. I try it later on a 64Bit Windows 7.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Tuesday, January 25, 2011 4:44 PM
  • Hi

    After more than 14 hours working (and a hard work day for me ), Windows OneCare reports:

    4 Server issues found

    Troja: win32/Comame - Dynamer!dtc      TrojanClicker: Win32/Yabector.gen        Trojan Dropper: Win32/Microjoin.gen

    4 High issues found

    Trojan: win32/bumart!rts - win32/orsam!rts - Trafog!rts   Trojan Dowloader: win32/Troxen/rts

    But is strange that Norton doesn't recognize those, because are older versions no?

    Onecare found out internet connection problems (Usb broadband, no way) and doesn't show me registry reports. I don't know it could deleted. But there where a ventilator over wonking (sounds like it's infected), now decrease.

    Reading your post I remember that I've added 2GB memory not so far (now 4GB) and at first the system reserved 1GB for Hardware so I came back to default conf in msconfig->boot-> advance options 1 processor and dismarked maximum memory at boot (if you know how can i get this configuration without 1GB reserved for Hw....) , maybe Got a problem whit remmaping? I don't know....

    I'm gonna download and use VMMap.

    Thank you

    • Edited by Tom.dpz Tuesday, January 25, 2011 7:51 PM
    Tuesday, January 25, 2011 7:45 PM
  • I'm gonna download and use VMMap.

    Thank you

    ok, do this.

    @JS2010

    I tried it  with a x64 Windows 7 and it woks fine there.


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Tuesday, January 25, 2011 10:23 PM
  • My profile is damage doesn't work the tochpad or I can't save into libraries files from iexplore but it isn't importat. I've created another user and made import data: (Other users works properly)

    This is VMMAp report:

    http://cid-2e0a358885c3ec1e.office.live.com/self.aspx/Logs/svchost.zip

     

     

    I find network activity  in this svchost sending B/sec (Address 255.255.255.255) without receive anything, I read something about that; Is a possible malware recolectiong private information.  

    Tuesday, January 25, 2011 10:52 PM
  • Hi Tomas,

    I can't see anything abnormal from the VMMap data. Your exe uses 120MB as Working Set and my uses 90MB. This is fine.

    If the RAM usage in general is too high, run RAMMap and give me the data.

    André


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Wednesday, January 26, 2011 12:05 AM
  • Ok, really thank you.

    I perform a clean boot and could see that stopping BTMTrayAgent startup item - Unknow Manufacturer  improving my performance, memory began to normal state and ventilator as well (I mean not over spining). The laptop has a couple of weeks and now I feel it like the first day.

    After another OneCare scan this is the report:

    Trojan:Win32/Trafog!rts
    c:\$recycle.bin\s-1-5-21-1678839016-2547162120-242104427-1002\$rlb5onx\zapgrab\setup32.exe
    (autoit)\mfc_cm_ob_ws_fu4im.exe\(autoit)\mfc setup.exe
    But unable to delete. I read something about infected by usb but I don't know..., so I reported it to one care support. The guy offer me this tool http://live.sunbelt.com/download to remove.

    After that I'm trying to use one care scan one more time but I can't , after install component and launch the scan the website redirect me all the time to http://onecare.live.com/site/en-us/sandbox/install.htm?scanner=default&goback=http%3A%2F%2Fonecare.live.com%2Fsite%2Fen-us%2Fcenter%2Fcleanup.htm again without error.

     

    Thursday, January 27, 2011 1:57 AM
  • make a full scan with an AntiVirus Scanner like Microsoft Security Essentials and also scan your PC with Malwarebytes' Anti-Malware .

    If you still have issues, backup all personal data and install Windows again to get rid of all malware on the PC.


    André


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Thursday, January 27, 2011 1:57 PM