Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Svchost.exe high memory usage


  • Please log in to reply

#1
Jenna91

Jenna91

    Member

  • Member
  • PipPip
  • 86 posts

111.png

 

Videos:

 

 

After searching around I am still not sure how to go about fixing this issue. If anyone has an idea I would appreciate your time.

 

Misc info: This is a brand new windows 7 installation on my laptop. I just reinstalled the windows operating system on it 2 days ago.

_________________________________________

 

Update:

-I  was looking at DWM.EXE on my laptop and noticed it is also using 30,000k to 50,000k on my laptop and on my desktop DWM.EXE is only using 15,000k memory.

-The desktop has no problems I am only using it for comparison purposes

-I figured there was a common problem on the laptop  between these services using more memory than they are supposed to so I was reading on tech forums about DWM.EXE. It was said that drivers not being up to date could cause this.

-I had used only the windows update utility for drivers in the first 2 videos so I just used a free program called " driver booster " to update my drivers.

- The result is I am having the same small issue with svchost.exe and dwm.exe using unusually high amounts of memory after the driver updates, but a difference is that when I ask svchost.exe to " go to service " it is now pointing at a different service than in the other videos (before I used a driver update program):

https://www.youtube.com/watch?v=XPdtgEz2-xg

-I also notice on my windows 7 desktop, svchost.exe is not even listed in the process list; however, on my laptop with the fresh install of windows 7 it is. :huh:


Edited by Jenna91, 11 December 2019 - 01:28 PM.

  • 0

Advertisements


#2
RKinner

RKinner

    Malware Expert

  • Expert
  • 22,050 posts
  • MVP

Get Process Explorer

https://live.sysinte...com/procexp.exe

Save it to your desktop then run it (Vista or Win7+ - right click and Run As Administrator).  

View, Select Column, check Verified Signer, OK
Options, Verify Image Signatures


Click twice on the CPU column header  to sort things by CPU usage with the big hitters at the top.  

Wait a full minute then:

File, Save As, Save.  Note the file name.   Open the file  on your desktop and copy and paste the text to a reply.


Copy the next 2 lines:

TASKLIST /SVC  > \junk.txt
notepad \junk.txt

Open an Elevated Command Prompt:
Win 7: Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator
Win 8: http://www.eightforu...indows-8-a.html
win 10: http://www.howtogeek...-in-windows-10/

Right click and Paste (or Edit then Paste) and the copied lines should appear.
Hit Enter if notepad does not open.  Copy and paste the text from notepad into a reply.


Get the free version of Speccy:

http://www.filehippo...ownload_speccy/ 

(Look in the upper right for the Download
Latest Version button  - Do NOT press the large Start Download button on the upper left!)  
Download, Save and Install it.  Tell it you do not need CCLEANER.    Run Speccy.  When it finishes (the little icon in the bottom left will stop moving),
File, Save as Text File,  (to your desktop) note the name it gives. OK.  Open the file in notepad and delete the line that gives the serial number of your Operating System.  
(It will be near the top,  10-20  lines down.) Save the file.  Attach the file to your next post.  Attaching the log is the best option as it is too big for the forum.  Attaching is a multi step process.

First click on More Reply Options
Then scroll down to where you see
Choose File and click on it.  Point it at the file and hit Open.
Now click on Attach this file.


 


  • 0

#3
Jenna91

Jenna91

    Member

  • Topic Starter
  • Member
  • PipPip
  • 86 posts

-the process  " ffmpeg " in the video is from my screen recorder program (sharex).

-image of process explorer without ffmpeg: https://i.postimg.cc...en-recorder.png

-Requested notepads from your reply attached.

Attached Files


Edited by Jenna91, 11 December 2019 - 06:13 PM.

  • 0

#4
RKinner

RKinner

    Malware Expert

  • Expert
  • 22,050 posts
  • MVP

SVCHOST is a standard Windows process which is used to carry multiple services and there should be multiple instances on your desktop too.  The junk file shows which services are on which svchost.  You tell them apart by the PID number which you can get by process explorer.  (will change after each reboot)  How much memory each uses depends on the services.  For example WUAUSERV is windows update.  If an update is pending (being downloaded or waiting to install or being installed) the amount of memory will jump up a lot.  Once the update completes it should go down.  The BITS service is also part of the update process.  It downloads files from the windows update servers in the background so expect to see it vary considerably.  More info on each service can be found here:

http://www.blackvipe...ndows-services/

 

I just installed a Win 7 last month and it needed 150 or more updates.  Speccy shows only about 20.  Unless Microsoft has changed things drastically there is something wrong with yours.  Try running:

 

System Update Readiness Tool for Windows 7

This link is for 64 bit:
https://www.microsof...s.aspx?id=20858

Download Save and run.  It will act like it is installing an update.  May take several hours to complete. 

 

Once that runs then get (if you don't already have them -it will tell you if you already have them so try to get them)

 KB3083710 and KB3102810

https://support.micr...n-us/kb/3083710

https://support.micr...n-us/kb/3102810

Then check your Windows Updates again and see if it finds anything.

 

Also search for

 

services.msc

hit Enter

 

This should open the services window.  Find:

 

##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##

 

if you can and right click and select Properties.  Can you give me a screen shot?


  • 0

#5
Jenna91

Jenna91

    Member

  • Topic Starter
  • Member
  • PipPip
  • 86 posts

I will do that first thing in the morning. It is 11:30 p.m. here. sleep time. Just giving you a heads up not to watch for me. Thank you for working with on this. night night. :happy:  


  • 0

#6
Jenna91

Jenna91

    Member

  • Topic Starter
  • Member
  • PipPip
  • 86 posts

Hello,

 

-I downloaded:
System Update Readiness Tool for Windows 7

received "successfully installed"

- for KB3083710 and KB3102810 the links provided pointing to the microsoft site were dead for me. I receive 404 directory not found when clicking the download link. Instead, I searched and I went to the following links which seemed fine to me. You can double check me if you like.

-KB3083710

https://www.microsof...s.aspx?id=49174

KB3102810

https://www.microsof...s.aspx?id=49540

received "successfully installed" on these updates also

-at this point i restart

-I then run the windows update from control panel. It scans for maybe 5 minutes ( not a long time ). I get this:

https://i.postimg.cc...5/Picture-1.png

-I check the process explorer for changes and see this:

https://i.postimg.cc...g/Picture-2.png

-Image requested from services.msc:

https://i.postimg.cc...z/Picture-3.png

 

Misc info: when i installed in this windows 7 operating system a few days ago, you are right that the windows update found 140 ( or something ) updates. I told it to download and install and it appeared to download, restart and install everything successfully. However, you are also right that when i list installed updates in the control panel i see only this:

https://i.postimg.cc...f/Picture-4.png

which is around 20 ( like you said ).


Edited by Jenna91, Yesterday, 10:36 AM.

  • 0

#7
RKinner

RKinner

    Malware Expert

  • Expert
  • 22,050 posts
  • MVP

Right click on (My) Computer and select Manage (Continue) Then click on the arrow in front of Event Viewer. Next Click on the arrow in front of Windows Logs Right click on System and Clear Log, Clear. Repeat for Application.

Reboot.

Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator.  Then type (with an Enter after each line).

sfc  /scannow

(This will check your critical system files. Does this finish without complaint?  IF it says it couldn't fix everything then:

Copy the next two lines:
findstr  /c:"[SR]"  \windows\logs\cbs\cbs.log  >  %UserProfile%\desktop\junk.txt
notepad %UserProfile%\desktop\junk.txt

 


Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue.  Right click and Paste or Edit then Paste and the copied line should appear.
Hit Enter. Copy and paste the text from notepad or if it is too big, just attach the file.)


1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Right-click VEW.exe and Run AS Administrator
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning


Then use the 'Number of events' as follows:


1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.


Please post the Output log in your next reply then repeat but select Application.  (Each time you run VEW it overwrites the log so copy the first one to a Reply or rename it before running it a second time.)

 


  • 0

#8
Jenna91

Jenna91

    Member

  • Topic Starter
  • Member
  • PipPip
  • 86 posts

- the logs in the event viewer cleared without issues.

- I then ran sfc  /scannow with this result:

https://i.postimg.cc...W/Picture-5.png

- the scan finished without finding integrity violations

-I then proceeded to use the Event Viewer Tool by Vino Rosso. The log is attached.

 

Attached Files


  • 0

#9
RKinner

RKinner

    Malware Expert

  • Expert
  • 22,050 posts
  • MVP

Can you run VEW for Applications too?


  • 0

#10
Jenna91

Jenna91

    Member

  • Topic Starter
  • Member
  • PipPip
  • 86 posts

attached

Attached Files


  • 0

#11
RKinner

RKinner

    Malware Expert

  • Expert
  • 22,050 posts
  • MVP

I don't see anything wrong with your PC other than the lack of updates but perhaps your Win 7 image already included a bunch of them.

 

DWM.EXE is going to use memory based on what is on your desktop and also on how many windows you have open and what is in them.  See:

 

https://www.computer...es/ch001182.htm


  • 0

#12
Jenna91

Jenna91

    Member

  • Topic Starter
  • Member
  • PipPip
  • 86 posts

Thank you for explaining with links in your posts and thank you for taking time to look at my laptop with me. :yes: :smashcomp: :geek: :geek: :laughing:


  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP