Windows 7 svchost.exe hogging all available memory

[Altster]

But in both cases, when it had 1GB system memory and even after
it had 2 GB system memory, the system would "run out" of memory
after some period of time (5 min to 40 min) and it is SVChost.exe
taking up large large chunks. Sometimes as much as 500+ MB memory
for one single svchost.exe instance.

"Run out" of memory? What is the size of the hard drive in the unit? Could be that the drive is severly fragmented and that can also cause "out of memory" errors. I'd also suggest that you upgrade his memory to at least 2GB and ALSO do a good "look-see" at the mainboard for domed / blown cap's.

I also add to the suggestion that you grab a copy of process explorer and check all of the hoggish services / programs and get them down to a minimum amount.

 

[brandonkick]

"Run out" of memory? What is the size of the hard drive in the unit? Could be that the drive is severly fragmented and that can also cause "out of memory" errors. I'd also suggest that you upgrade his memory to at least 2GB and ALSO do a good "look-see" at the mainboard for domed / blown cap's.

I also add to the suggestion that you grab a copy of process explorer and check all of the hoggish services / programs and get them down to a minimum amount.

I get no alerts, or popups telling me the computer is "out of memory".

The hard drive is a 40GB western digital and the machine worked very well up until about a week ago.

After some period of time, it starts to get very very slow and I've noticed that when this happens the available memory (RAM) is almost full. A process called svchost.exe is hogging ALL the available memory and causing the machine to run very slow.

Process Explorer doesn't show what the underlying causes are, I've followed the instructions to the T and nothing shows up in the "Lower Pane View" when I click on the svchost.exe process that is using up all of the memory (500-600MB of the available 1GB) and when I stick in another 1GB stick it scales further to take up any free memory.

I fully well believe this is a software issue, as the machine ran just great before this. I don't think a hardware problem would cause a process to start hogging memory. I guess I could verify this with a live OS disk.

 

[altrenda]

I assume you are running Process Explorer with administrator privileges? You won't see any info in the lower pane and can't kill any processes unless you do. And svchost.exe is just a name for many processes that run from a DLL. Until you find which one you are just shooting in the dark.

For one of our clients, I manage a fleet of GX260, 270, and 280's. But we don't deploy them anymore because they can't keep up. That 40 gig drive is getting close to 10 years old, and if your are lucky, is one of the 7200 rpm ones. Not to say it's the problem, cause they are pretty rugged, but I would be careful. With only 1 gig ram, that thing must have been swapping like crazy.

As Altster said, the GX 270's were recalled during the bad cap era. Dell replaced a lot of mobo's for free, but still got sued for covering it up. I still saw a bunch of bulging caps on ones I took from service last year.
Here's what they look like. http://forums.techguy.org/attachments/223207d1367458859/2477.gx270_capacitors.jpg (not my photo)

 

[brandonkick]

I just ran it again, with admin privlidges and it does show me some info now but it is somewhat convoluted.

The memory counts don't match up at all and I just don't see any way to know what is causing me problems.


At any rate, I tried to run the tweaking.com repair and in doing so I did a disk check followed by a system file check.... upon rebooting after the system file check the machine would only boot to a solid black screen with a cursor.

So I restored the image that I've made from clonezilla and this time went strait into performing the tweaking fix instead of doing the disk/system file checks.

It appears to be better, but still not 100% fixed. I took this screen shot afterwards in process explorer.

 

[HFultzjr]

Where I'm at right now.

Currently in safe mode with networking:

Ran MBAM (updated, version 2.1) and it found nothing
Ran rkill and it found nothing (I guess)
Running rougekiller now (it stopped the SVChost.exe that was hogging memory)

After that I'm going to make a clone of the current hard drive to save myself from damaging the install.

Will run MBAR, TDSSKiller and Adwcleaner again (still in safe mode with networking)

I'll try process hacker to see if it will give me more info on what may be the underlying culprit in my svchost.exe hogging memory.

Then I'll disable windows update (which compnets do I disable, or just turn windows updates off)?

Then I'll try tweaking.com AIO repair and or combofix.



Main reason I care is that he uses a bookeeping/mechanical shop software called invomax. Unless he has an "active" subscription (which is $118 for 3 months) he cannot reinstall the software because THEY have to do it for you. They remote in, load the files and then remove any way for you to do it on your own. We have paid over $700 for this crap and are not willing to pay a cent more to "reload" the software we already own a liscense to use. SO if your hard drive crashes, or seizes up and you don't have an active subscription it will cost you ANOTHER $118 to get back the software.

Otherwise I'd have wiped and reloaded by now, would have saved much more time since it's almost the ONLY thing he uses on the computer.

The only issue I see is running AIO Repair after turning off windows update components. It will more than likely just turn them back on. If you want to turn off windows update go into services and disable anything related to windows update. Remember what you change, so you can change them back if needed. Look at the descriptions for the service and disable anything related to windows up date. If it doesn't make any changes, easy to go back and turn them to where they were. I have run into this issue several times in the past. CPU was being pounded by "something". Turn off the services and go from there to correct the problem. You may be able to narrow it down to one service causing the issue. You may need to reboot after disabeling.

 

[Larry Sabo]

There's a good article on Raymond regarding analyzing the services behind svcshost.exe processes, with lots of different tools discussed.

Edit: On re-reading it, not much new there, actually.

 

[HFultzjr]

Excellent find!

 

[brandonkick]

Still at a loss on this one.

I think the best course of action may be to argue with Invomax until I get them to reload it for free. I see no reason why they should not, and instead are trying to force my father back into a "subcription" in order to have his software reloaded.

It's bogus, if you buy quickbooks you get a serial number. You can reload it at any time,without needing to pay for something you already own a liscense to.

Their "catch" is that the fee is because of the updates to the program, so their always "providing" you with the updates. Well as crappy as that is, what if I don't want updates? What if I want the version of program that was working just fine before hand, that I already had?

I tried putting in extra memory chips, but they weren't recognized. Machine still only shows 1GB of memory.

 

[altrenda]

Looking at your screenshot, it looks like you highlighted the html viewer dll.

The ~fontcacheFontFA... entry looks odd. Anything that doesn't have a description or Company name is suspect these days. Does it's memory usage increase?

I ran across this, might be your problem.
http://wiki.serviio.org/doku.php?id=win_highresources

I was also thinking of a munged up video driver update, but that's just a guess. Not enough info to really tell.

 

[Porthos]

I would consider a better machine and use this guide to move 7 to it. Of course clone/image first.

http://www.sevenforums.com/tutorials/135077-windows-7-installation-transfer-new-computer.html

 

[altrenda]

I would consider a better machine and use this guide to move 7 to it. Of course clone/image first.

http://www.sevenforums.com/tutorials/135077-windows-7-installation-transfer-new-computer.html

I htink we all agree that a 8 or 9 year old Pentium 4 with a 40 gig drive and very low ram is not optimal. But the OP has reasons why he doesn't want to replace the machine.

However, if you have to pay the LOB provider for an update anyway, it's definitely time to move up.

 

[brandonkick]

Looking at your screenshot, it looks like you highlighted the html viewer dll.

The ~fontcacheFontFA... entry looks odd. Anything that doesn't have a description or Company name is suspect these days. Does it's memory usage increase?

I ran across this, might be your problem.
http://wiki.serviio.org/doku.php?id=win_highresources

I was also thinking of a munged up video driver update, but that's just a guess. Not enough info to really tell.

I have the very top svchost.exe highlighted, at the top of the screenshot.
The biggest issue I see is that it's using (looking at the list on the right hand side of the lower part of the screen shot) MAYBE 30-35K (35MB or less) of memory in those processes... yet it shows a total of around 233MB being used. This was with 512MB system memory.

The system exhibits similar behavior when I put in an old 512MB dimm that was left lying around (bumping the total to 1GB). The svchost.exe process at the top will using around 500-600MB of memory and the list still isn't anywhere near accurate.

I would consider a better machine and use this guide to move 7 to it. Of course clone/image first.

http://www.sevenforums.com/tutorials/135077-windows-7-installation-transfer-new-computer.html

Problem with that is, is I wonder if the new machine will still act this way. I think it's a software/OS problem. I'd be cloning this OS onto a new system and it'd still have the issue with svchost.exe hogging up whatever extra memory there is.

I htink we all agree that a 8 or 9 year old Pentium 4 with a 40 gig drive and very low ram is not optimal. But the OP has reasons why he doesn't want to replace the machine.

However, if you have to pay the LOB provider for an update anyway, it's definitely time to move up.

The golden ticket is avoiding having to pay the software provider to reinstall the software for me. I feel that is garbage, I've already paid a lot of money for this software and now unless I'm in a "subscription" for $118 every three months then I'm on my own. If my computer crashes or windows needs reloaded, I can't use my software unless I pay them to load it back in.

If I can get this to stop, I'm heavily considering cloning and trying to deploy to a new machine. I'll agree that this machine has seen it's day, but I have some obstacles to work around before I can think about doing that.

 

[altrenda]

Ok how about an update.
what have you tried beyond malware scans? something might have been damaged in that process.

identified the process beyond "svchost.exe" ? either with process explorer or as described in Larry's link?
Killing the process now that you have admin rights with procexp.exe? Does it restart?
identifying what the unsigned fontcache...dll is ?
disabling the font cache services as described in the link?
deleted and reinstalled the video driver?
anything else?

 

[brandonkick]

So, I solved the issue.

I purchased two 1GB sticks of PC 3200 DDR memory and inserted them.

Afterwards, enough memory is always free for fast operation. Usually he
has at any one time several hundred MB available and several hundred cached.
It's never jumped above 1.3GB used.