svchost.exe hogging virtual memory

[josephhunt]

G'day,

A friend of mine (seriously!) is having problems with their virtual memory. They get errors stating they their virtual memory is too low. Then applications refuse to respond etc etc.

First I just instructed them to increase their page file size (it was already had a 1.5 gig or so limit). Further investigation revealed they were indeed using huge amounts of virtual memory. Commit charge: 2041/2517 (MB). We then discovered it was svchost.exe (well, one of the instances of svchost.exe, one labelled as "SYSTEM" in the "User Name" column of "processes" in task manager) which was hogging the virtual memory. It was using 1.7 gigs of virtual memory at that time. On my PC the most that any of the svchost.exe processes are using is about 17 megs...

I’ve no idea what might be causing svchost.exe to use this massive amount of virtual memory?

We've scanned svchost.exe (c:/windows/system32) for viruses and it came up clean with virus definitions updated yesterday.

Background Information:

Windows XP Professional SP2

Physical Memory: 512 megs (of which only 200 megs were being used when I asked)

Cheers,

Joseph

[Bezalel]

It could be a memory leak in any service that doesn't have its own exe file. Look at the properties for each running service to see if it uses svchost.exe. Try stopping these services until the memory is released.

[Jeremy]

Scan for viruses on your whole computer using Kaspersky or NOD32. Scan for spyware with Ad-Aware SE, Spybot 1.4, and Microsoft AntiSpyware Beta, CWShredder v2.19. Even if it isn't a virus/spyware problem, you might happen to stumble on malware you didn't know you had.

How much RAM do you have? Do you have a lot of programs running at startup? If your amount of RAM is insufficient for the number of programs you have running and you're doing something like gaming, Windows has to swap from the RAM to the page file excessively, which results in poor performance.

[suryad]

I think it is a virus. You can turn on the cmd prompt and type in netstat -bv to see if it is trying to call home thru the network as well....

[cluberti]

The above posts are very good suggestions, but I'd add my own - use Process Explorer from http://www.sysinternals.com to see which service or or thread is running in the svchost.exe process that is consuming all of the CPU. Since svchost.exe is a "container" that runs other services from your system's service list that aren't set to directly communicate with the SCM, it could be ANY of those services or processes within those services that are causing this. Process Explorer should allow you to go into the properties of the svchost.exe process that's hogging CPU, and see which service or process in svchost.exe is actually faulting.

Otherwise, you're just guessing .