svchost.exe memory usage in windows xp


  • sorry, i realize this is supposed to be a vista only post



    i have read a ton of articles on the svchost process


    were good ones.


    svchost.exe is consuming 500+MB of RAM (according to taskmanager) when the computer appears to be otherwise idle.  using the above articles, i've narrowed it down to the offending service group (by PID) and i see it is the "netsvcs" group.  when i open this group in the registry, i see all of the dlls listed below.  how do i determine what the offending .dll  it is, from within this group.  is there a way to see what EACH dll's memory usage is?


    the list of dlls found in netsvcs:


    Thursday, May 10, 2007 4:50 AM

All replies




    I've encountered the same, XP SP3 got svchost.exe to eat up all my memory.

    I've managed to isolate the memory-consuming process, which is DHCP Client. right after stopping it, memory was stop leaking.


    Does anyone posted microsoft about it? It started happening right after installing SP3




    Friday, December 28, 2007 8:34 AM
  • I've also encountered this problem with XP SP3 RC1 (3264.) After installing it the SVCHOST.EXE process that hosts all of the netsvcs services would gradually start eating memory. It was continually rising in memory usage over the day until eventually it crashed the PC. A reboot would temporarily fix it but then it started eating memory again.


    You could see the memory usage rising by watching it in task manager. I too found stopping / disabling the DHCP Client service fixed the problem but upon further investigation I realised its not the DHCP Client itself to blame. It's due to the fact when you disable the DHCP Client service you lose network connectivity if you were dynamically assigned an IP. If you assign a static IP to your network adapter after disabling the DHCP Client service then the memory usage starts rising again.


    Never did find a way of fixing this and ended up uninstalling SP3 RC1 and rolling back to SP2 as it was causing serious problems.





    Wednesday, January 23, 2008 4:44 PM

    You can use tasklist.exe to show all .dll modules loaded with each task. Type the following syntax in the command prompt (cmd).


    1) tasklist.exe /m >c:\tasklist_m.txt




    2) tasklist.exe /SVC >c:\tasklist_svc.txt


    Open drive C: and search for files "tasklist_m.txt" and "tasklist_svc.txt". However, you couldn't see which .dll is actually comsuming the memory. There're third parties software that does this.





    Wednesday, January 23, 2008 5:19 PM
  • I also traced the problem to the dhcp client. And by switching to a static IP, worked for me. First I changed to a static IP on the LAN connection. It worked. I though that perhaps some dll used be the wireless could be the culpid. I then disabled (to avoid IP confits) the LAN connection and set the wireless network connection to the same static IP (to keep things conbstant) and again it worked. No extra CPU time, or memory consumed by svchost.exe.


    Saturday, May 17, 2008 12:04 AM
  • I have at list six svchost.exe in my task manager - processes that are working all at the same time - local, networking, system - 2 or more of each. Which ones don't I need?  I crash all the time so I paid to get more RAM but still crash. Is the problem the svchosts that I have? or 204-226-2859 I'm exhausted from having to repeat/restart/redo stuff from the crashing.

    Tuesday, September 02, 2008 1:27 PM
  •    I had the same problem with svchost.exe in Windows XP SP3. You can't eliminate svchost.exe but you can eliminate from using 100% cpu usage and make it to 50% cpu usage or under. All you have to do is upgrade your processor into a dual core processor, which is 2 processors. It must be at least 1.8 Ghz or greater. Also you need to upgrade your RAM, or system memory to 512 MB of RAM, recommand 1 GB for the ultimate performance in Windows XP. Please make sure you check your motherboard specifications about what manufacture is the processor from, such as Intel, AMD or others, and what type of processor it uses before you upgrade.


    If you need help with upgrading please feel free to contact me at and make sure you give me the computer's brand and model, or model number.


    Once you upgrade it, you shouldn't suffer anymore crashing, and smashing, or whatever. You should be able to go internet, play games, or do other stuff without freezing it. I've done this before, and when I play Rollercoaster Tycoon 3 on the highest quality and playing on huge parks during svchost.exe, I was so amazed that my computer only slow down a little bit and not even a single crash.







    Saturday, October 18, 2008 12:25 AM
  •  John01 Glitch Hunter wrote:


    terminating svchost.exe will not "ruin" the computer.  If it allows you to end this process, its only going to end the services running within.  a simple reboot will cause them to all start back up again.

    Wednesday, October 22, 2008 3:50 PM
  • i am using XP SP3, I noticed that the thread stack that takes most of the processor time refers to a a dll named wbemcore.dll inside service host.

    This DLL is part of the WMI found in \WINDOWS\system32\wbem
    i noticed a lot of activity that this thread is accessing log files in the folder

    the log file wbemess.log contains error message like the following

    (Sat Nov 01 16:18:57 2008.357494328) : NT Event Log Consumer: could not retrieve sid, 0x80041002

    while the log file wbemcore.log contains error message like this

    15:56:42 2008.356159421) : GetUserDefaultLCID failed, restorting to system verion(Sat Nov 01

    i thought it is something related to the locale!
    i tried to disable the error log from the Computer management, but still the problem is not fixed
    Saturday, November 01, 2008 2:42 PM
  •  ThomasLee wrote:

    You can use tasklist.exe to show all .dll modules loaded with each task. Type the following syntax in the command prompt (cmd).


    1) tasklist.exe /m >c:\tasklist_m.txt

    Thanks, I didn't know about that switch.  But if you look at my origional post, you'll see I already had that information.

    Sunday, November 02, 2008 2:14 PM
  • OK, given that the majority of responses here are XP related and as there is not a thread in the XP area (that I can find) I will add my response here. I too am trying to resolve the problem of svchost.exe consuming excessive CPU cycles, up to 100%. Using Proces Explorer, I can see that, after startup, svchost is loaded multiple times with the last iteration being the -netsvcs. That one persists with no additional iterations added and continues to add a bunch of services not directly network related (AudioSrv, dmserver, EventSystem, helpsvc, NtmsSvc, and 25 other). Each time, wbemcore.dll is called, hangs around for a bit, then drops out leaving what I think are pointers to code for the added service. Once all loaded there it consumes memory, increments IO reads and accumulates over 600,000 memory page faults. Processor usage is sparse until wbemcore.dll is called one final time and CPU utilization immediately jumps to 90%+. From then on wbemcore.dll remains, using 80%+ CPU and the system crawls. I have found that suspending svchost restores CPU utilization but then net services ( and all others loaded in this iteration) are disabled. A work around I am using Instead is targeting wbemcore.dll inside the svchost instance and killing it. That also releases the CPU while net services, etc. remain functional. Only thing is that new processes take a very long time to start up. For instance another iexplorer task may take up to 10 minutes to start from clicking on the desktop icon. System is XP SP2 - I am leary of overlaying SP3 especially witth above comments. I figure some limit, memory, IO, page fault, etc. is reached and the new wbemcore task stalls and takes up excessive CPU cycles. I'll continue to investigate, but hopefully someone's figured this out and will post a fix. Cheers.

    Thursday, November 06, 2008 2:11 PM
  • Have any of you tried deleting the c:\windows\system32\wbem\repository folder and allowing WMI/winmgmnt to rebuild it as necessary?

    You will need to stop the Windows managements Instrumentation service, rename the repository folder and then restart WMI.

    There is also a commandline to dynamically detect and repair the WMI repository:

    rundll32 wbemupgd, UpgradeRepository.


    I've had better luck just deleting renaming the folder and allowing WMI to rebuild it.

    Hope this helps someone.

    Wednesday, November 26, 2008 8:40 PM
  • Try this it will show just SVCHOST threads and related processes for each:

    tasklist /SVC /FI "IMAGENAME eq svc*"


    Wednesday, November 26, 2008 10:46 PM
  • You can seperate DHCP into its own svchost thread and give it a unique name to make it easier to troubleshoot...

    First make a unique copy of svchost.exe:

    copy c:\windows\system32\svchost.exe c:\windows\system32\svchost_dhcp.exe

    Now set the DHCP service to start in it's own thread and use the newly named instance of SVCHOST:

    sc config dhcp type= own binpath= "C:\WINDOWS\system32\svchost_dhcp.exe -k netsvcs"


    This way if DHCP causes its version of SVCHOST to crash you won't bring down all the other services running in the original SVCHOST thread and the logged error will indicate that svchost_dhcp crashed.

    I have actually seperated 10 or 11 services into unique threads in this manner to troubleshoot some application error issue related to SVCHOST.

    Wednesday, November 26, 2008 11:02 PM
  • I had the same problem as the original poster. Something in Netsvcs slowly using 500+Mb memory. Stops when DHCP is stopped. I only realized it was happening when I noticed the light on the router constantly flashing one night. I could not pin down when it had started.

    After alot of hair pulling and net searching I came across this forum which gave me some more to think about.

    I downloaded the microsoft Process Explorer. Double clicking on the svchost which was consuming memory, showed the properties page.  Clicking on the Threads tab brought up some dlls which flashed up as being active. One of which was the wbemcore.dll as found by Ahmed but also two other dlls which were named something like upnp.dll  .  Then I remembered I had activated Universal Plug N Play while playing around with network services some months earlier.

    The solution for me was to goto "Add and remove windows components"-"Network services"- then un-tick "Internet Gateway device discovery and control client". This stopped the annoying router flashing problem for me.
    Tuesday, February 03, 2009 12:11 AM
  • I have been having the same problem for quite some time myself. But, I was having the problem before I installed SP3; however, it's gotten worse since. I sometimes have 5+ svchost.exes running. I have a Sony Vaio with an Intel processor, 3 Ghz clockspeed & 1.5 GB RAM, but it still runs (creeps) very, very slow!!! I have it running on a wireless network and am planning on reformatting it because it uses 50-60% memory when idle & 100% if I try to do anything. In fact, the only reason I finally installed SP 3 was because I was hoping that it would correct the problem--instead, it got worse. When it first started up, earlier last year, I thought it was because it was fragmented. But, defraging didn't do any good, and I was having problems with that as well. Norton SystemWorks couldn't defrag it so I began using Windows defrag program, but had to do it at least twice. I finally bought Diskkepper, which got it to 0% fragmentation. But, that didn't help either. (I am writing this on a HP Pavilion running Windows Vista 64 bit which, so far, is working fine.) I would appreciate any and all help on this problem.
    Ron Shanbrom
    Thursday, February 05, 2009 6:49 PM
  • This might or might not work for some, but it's a great troubleshooter:

    1.  Open your task manger and make sure the PID's are showing.  If not, go to view, select colums and check off PID

    2.  From a command prompt, type:  tasklist /SVC /FI "IMAGENAME eq svchost.exe"  This will list all the services running on a particular svchost.exe you see in the task manager.  Based on the svchost.exe in the task manager that is going crazy, you can get the PID.  Then look at your command prompt.  Match up the PID and you'll see which svchost has which services.  Make a note of these services.

    3.  Still from the command prompt, taking the processes from the crazy svchost, we want to seperate each service into its own process (which will create many svchost.exe's in the task manager.  Type:  sc config <service name> type= own  (yes, that's a space between the = own).  Do that for every service under your crazy svchost.exe.

    4.  Reboot the computer

    5.  Upon restarting, give the computer some time for an svchost.exe to go crazy again.  Once you see it, mentally note the PID.

    6.  Open the command prompte and type:  tasklist /SVC /FI "IMAGENAME eq svchost.exe"

    7.  Compare the PID from the crazy svchost.exe in task manager to the one you see in your command prompt.  This will immediately tell you which service is the problem child. 

    Now it's up to you to do what you want w/the service.  In my case, it was themes.exe that was the problem.  Since the computer doesn't need it (or more like the user who uses the computer doesn't need it, I just stopped/disabled the service and no more crazy svchost.exe).

    The services you made into their own processes - if you want to put them back under the umbrella svchost.exe, from a command prompt, type:  sc config <service name> type= share.  Reboot the computer when you're done.

    Like I said..this worked for me.  It's a great troubleshooting step to probably pin-point the problem.  What you do w/the culript service is up to you...but this should lead in you the right direction.

    btw, read these two websites (which is basically what I wrote):

    • Edited by steve02aa Friday, June 29, 2012 11:44 PM adding text
    Friday, June 29, 2012 11:42 PM
  • SvcHost Memory Issue

    WindowsXP Professional SP2

    Ever increasing ram usage from the system tracked to Cyptographic Services 'CryptSvc'
    Original files restored from genuine XP Pro SP2 OS disk did not solve the issue.

    Use the cryptographic service files from a genuine XP Home SP2 OS disk to replace those on a faulty XP Pro SP2 machine after having verified it is not host to malware or viruses.


    Code to remove Cryptographic Services into a separate process:

    Step 1: Generate a copy of svchost
    copy c:\windows\system32\svchost.exe c:\windows\system32\svchost-cryptsvc.exe

    Step 2: Set the new copy to host cryptographic services
    sc config CryptSvc type= own binpath= "c:\windows\system32\svchost-cryptsvc.exe -k netsvcs"

    Code to restore it:
    sc config CryptSvc type= share binpath= "c:\windows\system32\svchost.exe -k netsvcs"

    • Edited by Blebadef Friday, June 21, 2013 11:54 AM ......
    Friday, June 21, 2013 11:51 AM
  • I think that fixed it!  I'll lose this page when I reboot to be sure, but already I'm down to 6-8% CPU usage, versus 100% before.  Thanks!
    Tuesday, November 19, 2013 5:38 AM