Svchost using 1.7GB of RAM!
Okay, from couple of days I noticed that my 8GB ram is being utilized up to 48% in Idle, having nothing running in background. So i used my special tool - ProcessHacker and checked who using this much of ram. my typical usage is around 18% to 20% idle. So i noticed its svchost.exe, a system/NT process. and initially i force killed it running process hacker on elevated level and messed all my network connections and a lot more :(
Later after a small investigation I found that svchost is not a exe, its an agent who runs DLLs (source:howtogeek) and also found out a way of viewing what DLLs is running under specific Process (distinguished by PID) or specific instance of svchost. Its Simple! just a command prompt command,
tasklist /svc
and after executing that, i found-out that this *sick* instance of svchost runs below programmes - simply by having two snapshots of above command, while ram is used and when its normal. identified partners in PID when exceeded ram is consumed, and compared it with normal state snapshot.
Normal state
Fault state
and i went through and noticed a suspect! - wauserv. Did a google on it and found out its Windows Update!
I put that service as manual mode in management console -> services, so it can execute is system calls. So when the PC in fault state, i quickly checked services and yes! its running! so i quickly stopped it and, Bingo! RAM released!
So if you encounter same prob, follow my steps!
Later after a small investigation I found that svchost is not a exe, its an agent who runs DLLs (source:howtogeek) and also found out a way of viewing what DLLs is running under specific Process (distinguished by PID) or specific instance of svchost. Its Simple! just a command prompt command,
tasklist /svc
and after executing that, i found-out that this *sick* instance of svchost runs below programmes - simply by having two snapshots of above command, while ram is used and when its normal. identified partners in PID when exceeded ram is consumed, and compared it with normal state snapshot.
Normal state
Fault state
and i went through and noticed a suspect! - wauserv. Did a google on it and found out its Windows Update!
I put that service as manual mode in management console -> services, so it can execute is system calls. So when the PC in fault state, i quickly checked services and yes! its running! so i quickly stopped it and, Bingo! RAM released!
So if you encounter same prob, follow my steps!
Comments
Post a Comment