svhost.exe

[SHAWN]

svhost.exe on all machines on my domain are using tons of memory even at idle. This issue happens when the workstation is up and running for a while. If I reboot the workstations, the memory usage goes down signiificantly. If I leave my machine on for about 2 days, this process will be using 500-700mb of RAM. I have tried disabling/reenabling all services available on the workstation with no success. Is there a way to find out what is causing this on this generic service?

 

[NayNay1991x]

svhost.exe info: http://www.liutilities.com/products/wintaskspro/processlibrary/svhost/

 

[SHAWN]

svchost.exe sorry.

 

[baronvongogo]

any link with this thread?:

http://www.techist.com/showthread.php?s=&threadid=134580

apart from a complete virus scan using warez monsters guide its hard to pin point.

 

[Inaris]

download this: procesXP

run it on the system and look at the PID from taskmanager to see what process this really is. then look at what is running under it.

What we have found in our environment, is that the Wsus/SUS/windows update stuff that runs on the machine, runs under SVChost, and from what we can tell stores all the info in memory, eventhough it's downloaded to the machine. Then, until you install/reboot them, the memory remains allocated.

hope that helps you.

 

[SHAWN]

Process ID is 1752

 

[Inaris]

You have to do the work on this one Shawn. Can't look at your machine for you.

Run that program I linked. Look for that PID in the program (if you reboot, you will have to get the PID from taskmanager again to make sure your on the right one). Once you find it, look to see what is running under that in procesxp. That is where the problem is most likey at.

good luck

 

[fixal0t]

i know this one....

1. boot into safemode with networking
2. log in with an admin account
3. navigate to c:\windows
4. delete the folder named 'SoftwareDistribution'
5. restart

there is a known issue with one of the windows updates that causes this... there should be a KB article on it

or if you prefer command line:
if the PC is not locking up on you...
log in with admin rights
net stop auwuserv
rmdir C:\Windows\SoftwareDistribution /s /q
net start auwuserv
shutdown -r -t 00