Svchost.exe problems

I am getting svchost.exe error 0x7c919af2 referenced memory at 0x00000010 memory could not be written on windows xp

Hi,
About the Windows XP question please post to the Client forum.
Windows XP support forum
http://social.technet.microsoft.com/Forums/windows/en-US/home?category=windowsxpitpro&filter=alltypes&sort=lastpostdesc
Thanks for your understanding and support.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Similar Messages

Having problem with svchost.exe/ntdll.dll errors causing GPSVC (Group Policy Client) to crash preventing users from logging into the server.

Recently (within the past 2 weeks) I have noticed a few of our servers will have problems with the svchost.exe application causing the GPSVC (Group Policy Client) to crash. The only fix at that point is to reboot the server since the GPSVC service is tied
to svchost.exe and therefore is protected from being manually restarted.
I noticed the following errors when this occurs:
Log Name: Application
Source: Application Error
Date: 7/23/2013 4:35:26 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Server1.xxx.xxx.net
Description:
Faulting application name: svchost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000024
Fault offset: 0x00000000000cd7d8
Faulting process id: 0x46c
Faulting application start time: 0x01ce877f9476ac07
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: d252d26d-f372-11e2-8ad4-005056ac00e8
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-07-23T08:35:26.000000000Z" />
<EventRecordID>158950</EventRecordID>
<Channel>Application</Channel>
<Computer>AAW19XM2.agency.nwie.net</Computer>
<Security />
</System>
<EventData>
<Data>svchost.exe</Data>
<Data>6.1.7600.16385</Data>
<Data>4a5bc3c1</Data>
<Data>ntdll.dll</Data>
<Data>6.1.7601.17725</Data>
<Data>4ec4aa8e</Data>
<Data>c0000024</Data>
<Data>00000000000cd7d8</Data>
<Data>46c</Data>
<Data>01ce877f9476ac07</Data>
<Data>C:\Windows\system32\svchost.exe</Data>
<Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
<Data>d252d26d-f372-11e2-8ad4-005056ac00e8</Data>
</EventData>
</Event>
All of our servers are running Server 2008 R2 Enterprise where we use Citrix to deliver desktop sessions to our users, but some are virtual and some are physical. This seemingly impacts our virtual machines more, and our VMs are hosted through VMWare, however,
about 5 months ago a similar error fired on a non-virtual machine:
Log Name: Application
Source: Application Error
Date: 2/27/2013 6:57:58 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: AAW29033
Description:
Faulting application name: svchost.exe_gpsvc, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000024
Fault offset: 0x00000000000cd7d8
Faulting process id: 0x6c0
Faulting application start time: 0x01ce14e1af313fd9
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: ed3d01c4-80d4-11e2-9128-b499baa9e5e8
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-02-27T11:57:58.000000000Z" />
<EventRecordID>286291</EventRecordID>
<Channel>Application</Channel>
<Computer>AAW29033</Computer>
<Security />
</System>
<EventData>
<Data>svchost.exe_gpsvc</Data>
<Data>6.1.7600.16385</Data>
<Data>4a5bc3c1</Data>
<Data>ntdll.dll</Data>
<Data>6.1.7601.17725</Data>
<Data>4ec4aa8e</Data>
<Data>c0000024</Data>
<Data>00000000000cd7d8</Data>
<Data>6c0</Data>
<Data>01ce14e1af313fd9</Data>
<Data>C:\Windows\system32\svchost.exe</Data>
<Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
<Data>ed3d01c4-80d4-11e2-9128-b499baa9e5e8</Data>
</EventData>
</Event>
I've searched and cannot seem to find any information as to what may be causing this, or even really where to start. Would someone be able to help me identify what might be causing this event, specific with the Exception code: 0xc0000024, which causes
the Group Policy Client service to stop?

You still out there looking at things? If so I have an update. The issue hasn't stopped, even though it did seemingly die down for awhile, however, it is now back with a vengeance.
I am able to force it to happen by killing the svchost process that is hosting GPSVC. If I run gpupdate /force, then logout/login it does get GPSVC running again. Furthermore, if I simply start svchost again via the Task Manager GPSVC starts running again.
When I access the server remotely with KVM it acts just like it does as if I'm logging into it via Citrix/RDP which for Admin IDs gives an error saying "Failed to connect to a windows service. Windows could not connect to the Group Policy Client service...",
however, normal user accounts just get a message when logging into the server "The Group Policy Client Service Failed the Logon. Access is denied."
I haven't opened a case with Microsoft yet, but we about ready to because of the increase in these errors.
If you have any further suggestions that would be great, otherwise I'll provide an update once I get word back from Microsoft.
**EDIT -- apparently I mistook the the server's SCM's actions as my own. I was able to successfully crash the GPSVC service by killing the hosting svchost process, however, after I crashed it and let it sit crashed for awhile when I attempted
to restart either by starting a svchost task, or running gpupdate /force it failed. Either that, or there is a timing issue where if we don't restart the svchost process, or run gpupdate /force quickly enough it won't be able to recover without a reboot.

'svchost.exe has encountered a problem and needs to close.'

I keep getting this error message svhost has encountered a problem and needs to close. I am running Windows XP 3, Does HP have a solution for XP-3?

Hi,
the error "svchost.exe" that you get is not necessarily because of your printer. i advice you to scan your computer for any kind of virus or trojan, or trt the following steps:
Method 1Leave the svchost.exe - Error dialog box open, and then follow these steps.Step1: Check whether settings for the Automatic Updates service and for the Background Intelligent Transfer Service (BITS) are correctTo do this, follow these steps:
Click Start, point to Run, type services.msc, and then click OK.
In the details pane, locate and double-click Automatic Updates.
Click the Log On tab.
Make sure that the Local System account option is selected and that the Allow service to interact with desktop check box is cleared.
Make sure that this service has been enabled in the Hardware Profile list. If this service has not been enabled, click Enable to enable the service.
Click the General tab, and make sure that the Automatic option is selected in the Startup Type list. Under Service status, click Start to start the service if it is not already running.
Repeat steps 2 through 6 for Background Intelligent Transfer Service (BITS).
Step 2: Reregister Windows Update componentsTo do this, follow these steps:
Click Start, click Run, type REGSVR32 WUAPI.DLL, and then press ENTER.
When you receive the "DllRegisterServer in WUAPI.DLL succeeded" message, click OK.
Type the following commands in the Open box, one after the other, and then press ENTER after each command:
REGSVR32 WUAUENG.DLL
REGSVR32 WUAUENG1.DLL
REGSVR32 ATL.DLL
REGSVR32 WUCLTUI.DLL
REGSVR32 WUPS.DLL
REGSVR32 WUPS2.DLL
REGSVR32 WUWEB.DLL
Step 3: Rename the Windows Update temporary folderThe temporary folder of Windows Update may be corrupted. In this case, you can rename the temporary folder of Windows Update. To do this, follow these steps:
Click Start, click Run, type cmd, and then press ENTER.
At the command prompt, type net stop Wuauserv, and then press ENTER.
Click Start, click Run, type %windir%, and then press ENTER.
In the folder that opens, locate and rename the SoftwareDistribution folder to SDold.
At the command prompt, type net start Wuauserv, and then press ENTER to start the Automatic Updates service.

Memory leaks- high memory usage svchost.exe

hello!
im having a kind of a similar problem. Im using a Q6600 with 4Gb of RAM running on Windows 7 x64. My physical memory usage history is 1.75GB idle but my CPU usage looks good ~ 0%.
In Windows Task Manager when i arranged the memory column, the process with the highest memory usge is svchost.exe with 116,572K. And i have 14 svchost.exe in my computer! I opened process exporer and check the legitimate of all those svchost.exe
and they are all legit. When i look at the properties of the highest svchost.exe in process explorer, the services which is running under it is as follows
AudioEndPointBuilder c:\Windows\System32\Audiosrv.dll
CscService c:\Windows\System32\cscsvc.dll
hidserv c:\Windows\System32\hidserv.dll
Netman c:\Windows\System32\netman.dll
PcaSvc c:\Windows\System32\pcasvc.dll
SysMain c:\Windows\System32\sysmail.dll
TrkWks c:\Windows\System32\trkwks.dll
UxSms c:\Windows\System32\uxsms.dll
wudfsvc c:\Windows\System32\WUDFSvc.dll
All are legit DLLS.
Is it normal to have 14 svchost.exe running at the same time(system, local service, network service in Task Manager)
and how can i reduce the memory usage of the svchost.exe?

Hi,
There can be multiple instances of Svchost.exe running at the same time. Each Svchost.exe session can contain a grouping of services, so that separate services can
be run depending on how and where Svchost.exe is started.
If you would like to reduce the usage of this service, I could share the following article with you:
Getting Started with SVCHOST.EXE Troubleshooting
PRF: High CPU (SVCHOST.EXE)
Hope it helps.
Alex Zhao
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Svchost.exe with "Dhcp, eventlog, lmhosts" services is generating thousands of page faults and I/O reads per second?

On one of our Windows 2008 R2 Enterprise (SP1) servers, we're noticing a strange phenomenon.....that the svchost.exe that hosts "Dhcp, eventlog, lmhosts" is constantly generating page faults....a few thousand per second, accumulating to billions of total
page faults. I/O reads and I/O other are also rising every second. Cpu is consistently 2%, and memory is constant. (~40M).
I'm guessing that it's the eventlog service because our HP openview log reader (opcle.exe) is also working hard to keep up. I've searched for others posting a similar problem but am coming up empty handed.
This is a MS Analysis Services 2008 server, but we haven't noticed any problems coming from SSAS. We have other file sharing-related jobs that interact with this server, that sometimes take 30 min and sometimes 6 hours, for the same workload....and
we're thinking that the 6 hour runs are somehow related to this process's unusual page faults.
Anyone else seen this eventlog strange behavior?
Thanks
-Mark

Hi,
The best thing would be downloading the Process Explorer and analyzing the problem.
Process Explorer
http://technet.microsoft.com/en-us/sysinternals/bb896653
For how to use Process Explorer to troubleshoot the performance issue, please refer to the following Microsoft TechNet blogs:
HIGH CPU – SVCHOST.EXE
http://blogs.technet.com/b/askperf/archive/2009/04/10/prf-high-cpu-svchost-exe.aspx
Getting Started with SVCHOST.EXE Troubleshooting
http://blogs.technet.com/b/askperf/archive/2008/01/11/getting-started-with-svchost-exe-troubleshooting.aspx
If you find the cause is Automatic update, please also refer to the following Microsoft TechNet blog:
Automatic Update causes SVCHOST.exe high CPU
http://blogs.technet.com/b/asiasupp/archive/2007/05/29/automatic-update-causes-svchost-exe-high-cpu.aspx
Regards,
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Svchost.exe errors after installing iTunes 7.0.1.8

I have two computers that starting throwing svchost.exe errors immediately after installing iTunes 7. First it happened on my desktop. In preparation to reinstall Windows XP on my desktop, I prepared my laptop to use while my desktop was out of commision. I installed iTunes 7 and immediately I started getting svchost.exe errors. I don't have the blaster worm on either machine (already checked). My desktop is behind three firewals, runs Norton, and I already did a full virus scan on both.
This is causing significant problems as my computer can't see the network, outlook can wig out, and in general my machine is unpredicatable. I hate to think that installing iTunes 7.0 leads to the need to reinstall Windows. If anyone has any ideas I would appreciate any help.

I changed my "Startup Type" for "Terminal Services" from "Disabled" to "Manual". Resolved issue.
http://docs.info.apple.com/article.html?artnum=304434
Windows XP Pro

Windows Server 2008 R2 - When svchost.exe memory-leaks Outlook does not load properly

Hi all,
We have a server which runs Windows Server 2008 R2, fully updated, and acts as a Terminal Server (Citrix XenApp 6.5).
In the past couple months we have had problems with svchost.exe leaking memory, growing to 2-3GB of RAM usage. Sometimes is occurs with weeks between the incidents, sometimes days. To solve the issue we have to reboot the server.
When this occurs, Outlook (fully updated) doesn't start for any users at all. Outlook doesn't continue from the "Loading profile.."-stage. The users who already has Outlook started doesn't have any problems, unless they close Outlook ;) .
The svchost.exe is the one which runs the services:
NSI
WinHttpAutoProxySvc
W32Time
Netprofm
FontCache
EventSystem
We've patched the server with KB2847346 but with no result. Patch KB2950358 is not applicable..
Any ideas?

svchost is hosting multiple services. when the issue occurs you can use sysinternals procmon (or enable the command line column in task manager process tab) to view to determine which service is using that much memory.
MCP/MCSA/MCTS/MCITP
Did you read my whole post, or did you just misunderstand the part were I wrote:
The svchost.exe is the one which runs the services:
NSI
WinHttpAutoProxySvc
W32Time
Netprofm
FontCache
EventSystem"
I know that svchost.exe runs ALOT of services, so when the problem occurred I checked which services the specific svchost.exe runs. Everytime it happens the svchost.exe (which leaks and has 2-3GB mem usage) runs this specific services.

SVCHOST.EXE Overflow and WMI Crash

Hello, collegues!
I faced with a problem after deploying SCCM 2012 Agent and SCEP 2012 on clients on Windows 7 SP1.
The WMI Compent crushes and svchost.exe proccess for netsvc services got overflowed and it uses a lot of RAM Memory and grows and grows.
I found out that this error appears when the agent tries to ask WMI and recieves an error ".....WBEM_E_NOT_FOUND....."
Also i found some hotfixes from MS how to solve this problem, here they are:
KB2492536
KB2465990
KB2492536
KB982293
KB974930
Anyway, these help only before installing SCCM 2012 agent, afterwards i need to rebuild WMI Repository for system working correct. By the way there is no log information in Event Viewer, provided by system. I found this error only in log files of SCCM agent
located localy in the System.
Did anyone faced with this issue?
Is there any normal solves provided by MS or maybe is it known?

Since no one has answer this post, I recommend opening a support case with CSS as they can work with you to solve this problem.
Garth Jones | My blogs: Enhansoft and
Old Blog site | Twitter:
@GarthMJ

IPod generates a svchost.exe error and blocks the computer

Ok, I got an iPod Nano 2GB Silver today and when I plug it in the USB port, a svchost.exe error pops up. The only thing I can do is to press OK, but when I do that, another and another and another... same error pops up. I have to reset the computer in order for the computer to start functioning normally.
I will try to translate what the Event Viewer says about the error (and this is what the error pop-up also states):
Opening application: svchost.exe - Program error : Instructions on »0x00000000« reffered to the memory on »0x00000000«. The memory couldn't be written.
The thing is though, it's working fine on some other laptop, but I don't understand why this is happening on my desktop?! And some of the older mp3 players (not iPods) are working just fine.
Please, help me!

I have a similar problem which began a couple weeks ago. Same svchost.exe closure, only I couldn't figure out what was causing the problem. Did the format C: and clean XP install, then gradually reinstalled software. When I got around to installing iTunes again, and about 24 hours goes by, I get the same message again. Both the popup and event viewer tell me that the iPod
Service caused the failure. Windows would only suggest that the problem was caused by Windows Update.
Before the fault bucket was generated, there was an Application Information message that states:
The description for Event ID ( 0 ) in Source ( iPod Service ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Service started.
So now I am unable to keep my iPod updated, charged, used. Is this what I paid a premium price for?

SVCHost.exe

svchost.exe, is consuming 200-600mb of memory on start up and does not stop until i kill the process then does it again x2, then the display settings go from the sleek design to a windows 98 look then svchost.exe stops leaking but
why is svchost.exe leaking in the first place after not doing it for 2-3 years of owning this computer running the same os.
os: Windows 7 64 bit - fully up-to-date
thanks in advance

Hi Huzaifa,
Please make sure the svchost.exe file is located in the folder C:\Windows\System32. In other cases, svchost.exe is a virus, spyware, trojan or worm. Also check the user name of the process, it should be SYSTEM、LOCAL
SERVICE or NETWORK SERVICE.
This process manages system services that run from dynamic link libraries (files with extension .dll). Examples for such system services are: "Automatic Updates", "Windows Firewall", "Plug and Play", "Fax Service",
"Windows Themes".
First you need to know what service/dll sys is running by SVCHOST.exe.
Download Process Explorer from this website
https://technet.microsoft.com/en-us/sysinternals/bb896653.aspx?f=255&MSPPError=-2147217396
Information about pool monitor
https://msdn.microsoft.com/en-us/library/windows/hardware/ff550442%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396
Open Process Explorer and find the problem SVCHOST.exe and check which service is taking resources.
Regards
D. Wu
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]

2008 R2 - Memory Leak from svchost.exe - Module "rpcrt4" is the culprit

Hi All
Over the past week or so (after a set of Windows updates and restart) svchost.exe has increasingly used more and more memory. It probably gobbles up an extra 1GB per day and doesn't relent.
After running various diagnostics, the debug diagnostic tool finally provided me this information after a memory leak test:
rpcrt4.dll is responsible for 1.76 GBytes worth of outstanding allocations. The following are the top 2 memory consuming functions:
rpcrt4!AllocWrapper+2b: 1.76 GBytes worth of outstanding allocations.
rpcrt4!Ndr64ClientInitialize+964: 1.36 MBytes worth of outstanding allocations.
Detailed module report(Memory)
Module details for rpcrt4
Module Name rpcrt4
Allocation Count 946941 allocation(s)
Allocation Size 1.76 GBytes
Module Information
Image Name: C:\Windows\System32\rpcrt4.dll Symbol Type: PDB
Base address: 0x00000003`00905a4d Time Stamp: Sat Nov 20 13:13:18 2010
Checksum: 0x00000000`00000000 Comments:
COM DLL: True Company Name: Microsoft Corporation
ISAPIExtension: False File Description: Remote Procedure Call Runtime
ISAPIFilter: False File Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
Managed DLL: False Internal Name: rpcrt4.dll
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights reserved.
Loaded Image Name: rpcrt4.dll Legal Trademarks:
Mapped Image Name: Original filename: rpcrt4.dll
Module name: rpcrt4 Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating System
Module Size: 1.18 MBytes Product Version: 6.1.7601.17514
Symbol File Name: c:\symcache\rpcrt4.pdb\7D748DA6D7454C9EA38C8CEF1C9E75F22\rpcrt4.pdb Special Build: &
rpcrt4!AllocWrapper+2b has 944,468 allocations!
I'm running 2008 R2 64bit with anywhere up to 80/100 simultaneous RDP connections at any one time.
Can anyone help or advise as I cannot find any hotfixes for this issue.
Thanks
Ryan

Hi Ryan,
Please narrow it down to the specific service that is having the issue. That way you will know where to focus on.
For the specific svchost.exe that is showing the large memory usage, use task manager/process explorer/etc. to determine which service(s) are running within it. If there are multiple services running within it, I recommend you isolate them and then
restart your server. For example, say you determined that the following services are running in the "problem" svchost.exe: AudioEndpointBuilder, Netman, TrkWks, UmRdpService, Uxsms. You would open an admin command prompt and enter the following
commands:
sc config AudioEndpointBuilder type= own
sc config Netman type= own
sc config TrkWks type= own
sc config UmRdpService type= own
sc config Uxsms type= own
After entering the above commands you would restart your server for the changes to take effect. Over time you would monitor memory usage of the suspect services, and eventually it will become apparent which one is using too much memory.
Thanks.
-TP

Svchost.exe taking up almost all of my cpu after the computer has been running for a number of hours

My computer is almost a year old and it is a custom build gaming rig with the following specs
Intel Core i5-3570k CPU @ 3.40GHz
8.0GB of Ram
AMD Radeon HD 6870
running windows 8.1
The issue is that after a few hours my computer starts to drastically drop in performance. This is due to two reasons. Firstly explore.exe starts to use up my cpu. I can easily stop this by using process explorer to close the offending thread (only 1 thread
i causing the issue, the rest are using minimal cpu) killing this thread reduces the cpu and appears to have no concequence in terms of functionality of my pc.
After this on average ten minutes later what happen is that svchost.exe starts using from 40%-60% of my cpu at which point if I do not quit any game I am playing my computer will crash. using process explorer to find the offending threads lead me to a thread
with a TID of 1836. If I kill this process I lose internet connection. Yet before this happens there is no sign of this thread. It appears to not be present until the issue appears and when it does appear this process is essential to my internet connection.
Please can someone help me

Please provide us with your Event Viewer administrative logs by following these steps:
Click Start Menu
Type eventvwr into Search programs and files (do not hit enter)
Right click eventvwr.exe and click Run as administrator
Expand Custom Views
Click Administrative Events
Right click Administrative Events
Save all Events in Custom View As...
Save them in a folder where you will remember which folder and save as Errors.evtx
Go to where you saved Errors.evtx
Right click Errors.evtx -> send to -> compressed (zipped) folder
Upload the .zip file to skydrive or a file sharing service and put a link to it in your next post
If you have updated to win 8.1 and you get the error message "the system cannot find the file specified" it is a known problem. The
work around is to edit the registry. If you are not comfortable doing this DONT. If you are, backup the key before you do
Press Win+"R" and input regedit
Navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels. Delete "Microsoft-Windows-DxpTaskRingtone/Analytic"
Wanikiya and Dyami--Team Zigzag

Satellite P100-238 freezes after an svchost.exe program error message:

PC: Satellite P100-238 from December 2006.
approx. a minute after startup i get an error message:
Danish:
svchost.exe - programfejl
Instruktionen ved "0x745f278o" refererede hukommelse ved "0x00000000". Hukommelsen kunne ikke "read".
Klik p OK for at afslutte program.
Klik p Annuller for at udfe fejlfinding i programmet.
English translation:
svchost.exe - program error
Instruction on "0x745f278o" refered memory on "0x00000000". Memory could not "read".
Click OK for ending program
Click Cansel to do error search in the program.
After the above error message the PC freezes totally and I can only turn it off by the on/off button.
What has happened with my PC?
What should i do?
How do I get access to my data to make a backup?

Hi
I goggled a little bit in the net for some help and I was surprised that many Windows users have had the same problem
So I thought there must be generally something wrong with the windows operating system.
I have investigated a little bit in the MS knowledge base and found this:
http://support.microsoft.com/kb/916089/en-us
According to the MS info this problem may occur when you have Microsoft Office installed and the Windows Update Agent tries to scan for Windows Installer updates.

Win2k8R2 svchost.exe suddenly starts to use all memory

Dear all
I have a Windows 2008 R2 SP1 + current Patchlevel Remote Desktop Host. Installed are a lot of applications, SCCM 2012 Client, Kasperksky AntiVirus Enterprise Edition.
Yesterday i had the problem that the svchost.exe is using all RAM of the Server (32GB) and has a private working set of 120GB. A quick "fix" was to restart the server. And now after around 24h i have the same problem again.
I did not change something on the server except install the Microsoft CA Hotfix against flame.
The svchost that has this problem controls this services:
svchost.exe
AeLookupSvc, CertPropSvc, gpsvc, IKEEXT, iphlpsvc, LanmanServer, MMCSS, ProfSvc, Schedule, SENS, SessionEnv, ShellHWDetection, Themes, Winmgmt
The server is now running since 2 Years without any problems and now it starts :/
After a restart this svchost.exe is using just 48MB RAM.
Thanks for any tips
JBAB

Hi,
For troubleshooting purposes please reconfigure so that the services for this group run in their own process. To do this you may create a .cmd file using Notepad with the following contents:
sc config AeLookupSvc type= own
sc config Appinfo type= own
sc config AppMgmt type= own
sc config BITS type= own
sc config Browser type= own
sc config CertPropSvc type= own
sc config EapHost type= own
sc config gpsvc type= own
sc config hkmsvc type= own
sc config IKEEXT type= own
sc config iphlpsvc type= own
sc config LanmanServer type= own
sc config MMCSS type= own
sc config MSiSCSI type= own
sc config ProfSvc type= own
sc config RasAuto type= own
sc config RasMan type= own
sc config RemoteAccess type= own
sc config sacsvr type= own
sc config Schedule type= own
sc config SCPolicySvc type= own
sc config seclogon type= own
sc config SENS type= own
sc config SessionEnv type= own
sc config SharedAccess type= own
sc config ShellHWDetection type= own
sc config Themes type= own
sc config wercplsupport type= own
sc config Winmgmt type= own
sc config wuauserv type= own
After saving the file please double-click to apply the changes and then restart your server so that they will take effect.
After restarting your server please open task manager, select the Processes tab, and sort the display by the memory column so that the processes that are using the most memory will appear on top. When one of the services starts to use too much memory
you will be able to right-click on it and choose Go to Service(s) and you will know which service is misbehaving.
Thanks.
-TP

Router continually accessing svchost.exe, cycling through all ports

Hi,
I recently did a clean install of Windows XP, since then my firewall (ZoneAlarm) has been continually blocking access attempts made by my router (WRT54G) to access svchost.exe, as shown here:
http://img28.imageshack.us/img28/9425/89700028.png
My router has a wired connection to my PC and by disconnecting the wire the access attempts stop. I don't know what is causing this or how to resolve the issue. So far I've only tried hard-resetting the router, which didn't help.
Any help would be appreciated

Firstly, thanks a lot for your help, I appreciate it.
Secondly, I'm reasonably sure that the problem isn't malware. Like I said in my first post, I only did a clean install of WinXP yesterday and since then I've only updated to SP3 and installed Firefox, ZoneAlarm, AVG, Adobe Reader and Flash. Just incase I just installed and ran Malwarebytes and Hijackthis and I couldn't see anything out of the ordinary. Of course I want to make sure that it isn't malware.
I've done what you said (this version of WinXP doesn't have tasklist apparently but I downloaded "Process Explorer" which serves the same function) and tried to find the process which needs those ports. The problem is that the ports accessed began at 10xx and continued all the way up to 25xx and probably would continue beyond. The svchosts with PIDs running in that range are running about 20 services... I'm not sure how I can find which service is causing the specific problem. I'm not even sure what services should be provided in the normal running of Windows.
e.g. termsrv.dll - Remote Desktop Session Host Server Remote Connections Manager
rpcss.dll - Remote Procedure Call (two instances of this running under two different svchost processes)
ssdpsrv.dll - permits discovery of UPnP devices on your home network
Should all of these be running normally as part of Windows? And seaching all of these processes on Google says that they COULD be a trojan/malware but I don't know how I could find out which are (outside of virus scanning - which I've already done). All are located in the windows/system32/ folder which makes me think they're not anything untoward but, again, I don't know for sure.
I appreciate that you can't help any more than you have but given everything I've tried is there anything else that I can do?
Thanks again.
Message Edited by LennethValkyrie on 03-09-2010 02:34 PM

Svchost.exe problems

Similar Messages

Maybe you are looking for